ISO 27701 Transition key terms

A management system that governs how an organization handles personally identifiable information, combining privacy-specific policies, controls, and governance with the broader information security management system in which it operates.

The structural approach in which privacy requirements are added to an existing ISMS rather than built as a standalone system, so that privacy governance reuses the same leadership, planning, and improvement processes.

Any information relating to an identified or identifiable individual, including data that can be linked to a person directly or through combination with other available information.

The individual to whom personally identifiable information relates; the person whose privacy interests the management system is designed to protect and whose rights drive many processing decisions.

The party that determines the purposes and means of processing personally identifiable information, and therefore carries the primary accountability for lawful and responsible handling.

A party that processes personally identifiable information on behalf of and under the instructions of a controller, without independently deciding why or how the data is used.

Two or more organizations that jointly determine the purposes and means of processing, sharing accountability for the processing and for responding to principals' rights.

A further party engaged by a processor to carry out part of the processing, which requires controller authorization and flows down the same privacy obligations.

Any operation performed on personally identifiable information, such as collection, recording, storage, retrieval, use, disclosure, transfer, or deletion, whether automated or manual.

The effect of uncertainty on privacy objectives, typically expressed as the likelihood and severity of harm to individuals arising from processing activities and possible control failures.

A structured analysis of a processing activity's risks to individuals and the safeguards that address them, performed before or during significant changes to how data is handled.

A regulatory-style impact assessment required in many jurisdictions for high-risk processing, often satisfied by a well-documented privacy impact assessment process embedded in the management system.

The management system defined by ISO/IEC 27001 that establishes, operates, and continually improves information security through risk management, controls, and governance processes.

The control set in ISO/IEC 27701 that adds privacy-specific controls to the information security controls of ISO/IEC 27002, organized by controller and processor roles.

The documented correspondence between privacy controls and other frameworks, standards, or legal requirements, used to demonstrate coverage and avoid duplicating or conflicting obligations.

The deliberate comparison of the PIMS with external privacy frameworks and laws so that common obligations are met once and gaps are identified for remediation.

The state of meeting applicable privacy laws and regulations, achieved by identifying obligations, translating them into controls, and monitoring changes that affect the management system.

A maintained record of privacy laws, regulations, and contractual duties that apply to the organization, used to scope the PIMS and keep controls current.

The documented boundary of the privacy management system, naming the organizational units, processing activities, locations, and shared services covered by the system.

The internal and external factors, interested parties, and legal environment that shape how the organization designs and operates its privacy management system.

A person or organization that can affect, be affected by, or perceive itself to be affected by privacy decisions, including principals, regulators, customers, employees, and partners.

Top management's active involvement in the PIMS, shown through policy approval, resource allocation, role assignment, and accountability for privacy outcomes.

A top-level statement of the organization's privacy intentions and direction, providing a framework for setting privacy objectives and committing to legal and contractual obligations.

Measurable goals set for privacy performance, consistent with the privacy policy, that translate commitments into targets the organization tracks and reviews.

The documented assignment of privacy duties across the organization, ensuring that authority for decisions, operations, and oversight is clear and does not fall between functions.

A designated individual accountable for coordinating the PIMS, advising on privacy matters, and liaising with regulators and principals where required.

The process of identifying, analyzing, and evaluating privacy risks to individuals and to the organization, producing information used to select and prioritize controls.

The selection and implementation of options that modify privacy risk, such as avoiding, reducing, transferring, or accepting it, together with records of the decision.

A document listing applicable privacy and security controls, stating whether each is implemented, and justifying inclusions and exclusions relative to assessed risk and obligations.

The ongoing measurement and evaluation of whether the PIMS meets its privacy objectives, using defined metrics, audits, and reviews to detect drift or failure.

A periodic top-management examination of PIMS performance, risks, incidents, and improvement opportunities, producing decisions and actions that keep the system effective.

The recurring process of identifying and acting on opportunities to strengthen privacy performance, closing gaps found through monitoring, audits, and reviews.

The handling of a requirement that was not met: containing the issue, determining its cause, correcting it, and checking that the fix prevented recurrence.

An event that compromises confidentiality, integrity, or availability of personally identifiable information, or otherwise breaches privacy obligations, requiring response and notification decisions.

The documented process for detecting, containing, investigating, and recovering from privacy incidents, including assessment of notification duties and evidence retention.

The obligation to inform regulators or affected individuals about a qualifying privacy incident within defined timeframes, based on assessed risk of harm.

A contract between controller and processor setting out processing instructions, security duties, sub-processor rules, assistance obligations, and deletion or return of data.

A single management framework covering multiple disciplines, such as security, privacy, and quality, that shares policy, risk, audit, and improvement processes to reduce duplication.

The window allowed for certified organizations to move from an earlier edition of the standard to the current edition, after which certificates against the old edition lose validity.

An assessment that verifies an organization's management system conforms to the current edition of the standard, covering new or changed requirements before certification is updated.

An accredited organization that audits management systems against a standard and issues, maintains, or withdraws certificates based on conformity evidence.