Overview of the Changes in Clauses 4–10
What this domain tests
This domain tests how the 2025 edition restructures PIMS requirements across clauses 4–10 compared with the 2019 edition. You need to know where privacy-specific requirements now sit in the management system, and why the change matters for auditors and implementers.
Core rules and concepts
- The 2019 edition used clauses 5–8 with PIMS-specific extensions and separate annexes for controllers and processors. The 2025 edition aligns with ISO/IEC 27001:2022's Harmonized Structure and places PIMS-specific requirements directly in clauses 4–10.
- Clause 4 (Context) adds privacy-relevant external and internal issues, interested parties such as regulators and PII principals, and PIMS scope.
- Clause 5 (Leadership) adds top-management accountability, a privacy policy, and assigned privacy roles and responsibilities.
- Clause 6 (Planning) addresses privacy risk assessment and treatment and privacy objectives.
- Clause 7 (Support) covers resources, competence, awareness, communication, and documented information for privacy.
- Clause 8 (Operation) covers operational planning and control for privacy, including risk treatment and PII-related processes.
- Clause 9 (Performance evaluation) requires privacy-relevant monitoring, measurement, internal audit, and management review.
- Clause 10 (Improvement) covers nonconformity, corrective action, and continual improvement of the PIMS.
Worked example
A 2019-based PIMS had a separate privacy risk assessment procedure under its extended clause 6. In 2025, that content is planned under clause 6 (Planning) and controlled under clause 8 (Operation), while audit and review move under clause 9. The reasoning is that the 2025 structure mirrors the ISMS lifecycle, making the PIMS auditable as part of the same management system rather than as a parallel set of clauses.
Traps that cost marks
- Assuming clauses 4–10 are word-for-word identical to ISO/IEC 27001; they contain privacy-specific additions.
- Looking for all privacy controls only in Annex A and ignoring clause 8 operational requirements.
- Using 2019 numbering (e.g., 5.2, 6.2, 7.2) in a 2025 context.
- Forgetting that leadership and performance evaluation also have privacy-specific requirements.
- Confusing documented information requirements with control implementation evidence.