PIMS Requirements and Guidance for PII Controllers
This domain tests Clause 5's additions to the management system and the controller-specific guidance in Clause 7 and Annex A. Questions usually present a scenario and ask which control family applies.
Clause 5: what the PIMS adds to the ISMS
- Context - determine internal and external issues and interested parties relevant to PII: PII principals, regulators, customers, employees.
- Leadership - top management must show commitment to privacy, not just information security, and approve a privacy policy.
- Planning - risk assessment must address harm to PII principals as well as harm to the organisation, with privacy objectives and plans.
- Support and operation - competence, awareness, communication and documented information, including records of processing.
- Performance evaluation and improvement - as in 27001, applied to privacy objectives.
Clause 7 and Annex A for controllers
- Conditions for collection and processing - document purposes, identify the lawful basis, design and record consent, run privacy impact assessments, contract with processors, handle joint controller arrangements, keep processing records.
- Obligations to PII principals - provide information; offer mechanisms to modify or withdraw consent, object, access, correct and erase; handle requests; address automated decision-making.
- Privacy by design and by default - limit collection and processing, ensure accuracy, minimise, de-identify and delete at end of processing, control temporary files, set retention periods.
- Sharing, transfer and disclosure - identify a transfer basis, list destination countries and organisations, record disclosures, handle disclosure requests and lawful requests from authorities.
Worked example
A retailer launches a loyalty app. It documents the purpose (loyalty), the lawful bases (contract for points, consent for marketing), runs an assessment for profiling, builds withdrawal and access mechanisms, sets 24-month retention, and records the transfer basis for an overseas cloud provider. Each step lands in a distinct Annex A family, which is why a privacy policy alone scores nothing.
Traps that cost marks
- Producing a privacy notice and treating the control as satisfied.
- Missing processor contracts or joint controller arrangements.
- Confusing privacy by design with security by default.
- Having no evidence trail for how PII principal requests were handled.