ISO/IEC 27701 Foundation study plan

Define privacy, data protection, and personally identifiable information (PII) in your own words and map each definition to the ISO/IEC 27701 vocabulary so you can distinguish PII from anonymised and pseudonymised data.

Explain the relationship between privacy and information security by listing three ways security controls support privacy outcomes and two ways they differ in purpose.

Summarise the core privacy principles (lawfulness and fairness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability) and give one concrete organisational example for each.

Describe the roles of PII principal, PII controller, PII processor, and joint controller, and classify five realistic scenarios into the correct role.

Outline the main legal frameworks that shape privacy expectations globally (for example GDPR-style regimes and other national data protection laws) without quoting specific articles, focusing on how they drive the need for a management system.

Draw the structure of ISO/IEC 27701 from memory, showing the main clauses and the annexes, and label which annexes address PII controllers and which address PII processors.

Explain how ISO/IEC 27701 extends ISO/IEC 27001 and ISO/IEC 27002, stating precisely what the PIMS adds on top of an ISMS and what it reuses unchanged.

Identify the scope boundaries of a PIMS and describe how an organisation determines which PII processing activities fall inside that scope.

Compare the control-structure approach of the privacy extension with the information security controls it builds on, noting how the two sets are cross-referenced.

List the normative references and the intended audience of the standard, and explain why it is described as applicable to organisations of any size and sector.

Walk through the PIMS-specific requirements that sit alongside the ISO/IEC 27001 management clauses, and explain what additional evidence a PIMS needs beyond a conventional ISMS.

Explain how the PIMS context, leadership, planning, support, operation, performance evaluation, and improvement clauses interlock, and give one privacy-specific example for each clause.

Describe the controller-specific guidance areas in the annex for PII controllers, grouping them into themes such as governance, processing conditions, and transparency obligations.

Explain the role of the PII controller's privacy risk assessment and how its outputs feed the selection of controls.

Draft a short scope statement for a fictional organisation that processes customer and employee PII, justifying each inclusion and exclusion.

Explain each controller-oriented control area in the annex in plain language and describe the evidence an auditor would expect for it.

Map the controller controls to the privacy principles from week 1, showing where each principle is operationalised.

Describe how consent, purpose specification, and records of processing are handled as management-system obligations rather than one-off tasks.

Analyse three short fictional scenarios and identify which controller controls are missing or weak in each.

Explain the relationship between controller obligations and the organisation's wider legal compliance duties, making clear that the standard supports but does not replace legal advice.

Explain the processor-specific guidance areas in the annex for PII processors and describe how processor obligations differ from controller obligations.

Describe how a processor determines whether it is acting as a processor or a controller in a given processing activity, and what happens when it acts as both.

Explain the controls around processing on behalf of a controller, including instructions, subcontracting, and assistance with the controller's obligations.

Draft the privacy-relevant clauses of a data processing agreement outline that reflects processor controls, without copying any standard text.

Identify five realistic processor risk situations, such as onward transfers or sub-processor changes, and match each to the relevant control area.

Distinguish privacy risk from information security risk and explain why a PIMS needs both perspectives.

Describe a repeatable privacy risk assessment method: identifying processing activities, assessing impact on PII principals, evaluating likelihood and severity, and treating the risk.

Explain how risk treatment decisions translate into control selection and how residual risk is accepted and recorded.

Describe the monitoring, measurement, internal audit, management review, and continual improvement activities that keep the PIMS effective.

Explain how nonconformity and corrective action work in a PIMS, and how lessons learned feed back into risk assessment and control selection.

Explain how a PIMS integrates with an existing ISMS so that audits, documentation, and risk processes are not duplicated.

Describe how certification works at a high level, including what an accredited certification body examines and how the Statement of Applicability functions in a PIMS context.

Identify the most common integration pitfalls, such as separate risk registers or unclear ownership, and propose a mitigation for each.

Revisit your week 2 structure map and week 4 control matrix and update them with everything learned in weeks 5 and 6.

Explain how continual improvement applies across the whole PIMS lifecycle, from scope changes to control updates.

Consolidate all five domains into a single concept map linking principles, structure, controller controls, processor controls, and risk management.

Complete a timed practice set covering all domains and review every wrong answer to identify the underlying concept gap, not just the correct option.

Recite from memory the clause and annex structure of ISO/IEC 27701 and the distinctions between controller and processor guidance.

Re-explain the privacy risk assessment method and the continual improvement cycle without notes, checking against your week 6 deliverable.

Write a personal list of the ten facts you are least confident about and resolve each one using the standard text or a reputable summary.