Privacy Risk Assessment, Controls and Continual Improvement
This domain tests how privacy risk is assessed, how controls are selected and justified, and how the PIMS keeps improving. Questions often hinge on the difference between organisational risk and harm to individuals.
Two risk lenses
27001 addresses risk to the organisation's information and assets. 27701 adds risk to PII principals: the likelihood and severity of harm - discrimination, distress, financial loss, reputational or physical harm - arising from processing. Both must be assessed, with privacy criteria written into the risk methodology and the risk register.
A workable method
- Inventory processing activities: purposes, PII categories, principals, recipients, transfers, retention.
- Identify obligations from law, contracts, ISO/IEC 29100 principles and Annex A or B.
- Assess plausible events - over-collection, unauthorised disclosure, inaccurate data, excessive retention, unfair automated decisions - against likelihood and severity of harm to individuals.
- Treat by selecting controls from Annex A or B and 27002, recording each in the extended Statement of Applicability with justification for inclusion or exclusion, and assigning an owner and a residual-risk acceptance authority.
- Monitor through metrics, audits and reviews.
Continual improvement
Clause 9 and Clause 10 apply 27001's monitoring, internal audit, management review, nonconformity and corrective action to privacy objectives. Privacy-specific inputs include complaint trends, assessment outcomes, breach and near-miss data, regulatory change and training completion. Audits should sample real cases, not just documents.
Worked example
A hospital plans a patient portal. Unauthorised family access is rated high severity, medium likelihood. Treatment: an identity verification procedure plus access logging. Residual risk is accepted by the accountable manager, recorded in the Statement of Applicability, sampled by internal audit across twenty accounts, and reported to management review with near-miss statistics.
Traps that cost marks
- Assessing only organisational impact and omitting harm to PII principals.
- Treating a privacy impact assessment as a one-off document outside the risk process.
- Leaving Annex A or B controls out of the Statement of Applicability.
- Recording residual risk as accepted with no accountable owner.