ISO 27701 Overview and Guides

ISO 27701 Overview and Guides talk about ISO/IEC 27701:2019, the data privacy extension to ISO 27001. ISO 27701 was released in 2019 to provide guidance for establishing, implementing, maintaining, and continually improving a Privacy Management System (PIMS). It provides guidance on how organizations can integrate privacy controls into their existing Information Security Management Systems (ISMS). The framework can help demonstrate that effective systems are in place to support compliance with GDPR, CCPA, and other related privacy legislation.

27701 is designed to help organizations establish a systematic approach to managing privacy risks and complying with privacy regulations. It provides a comprehensive framework for managing personal information that can help organizations build trust with their customers and stakeholders and demonstrate their commitment to protecting personal privacy. 

Learn more about TrustCloud’s continuous ISO 27001 compliance with TrustOps for ISO 27001.

What is a PIMS?

PIMS stands for Privacy Management System and is a collection of documents, including policies, processes, procedures, and security and privacy controls, that together implement an effective process for collecting, processing, storing, and destroying Personally Identifiable Information (PII).

ISO 27701 is composed of 10 sections (referred to as “clauses” in ISO 27701 terminology) that overlap with ISO 27001 and six (6) annexes that are normative (Annexes A to B) and informative (Annexes C to F). The first four clauses are introductory in nature and serve as an overview of the process itself. Clauses 4 to 10 are more intentional, providing guidelines for PII security and privacy. Each clause contains a set of guidelines intended to improve your organization’s data privacy posture. We have outlined these below:

1. Clause 4: ISMS requirements related to ISO/IEC 27001
   Context of the organization: This clause specifies the requirements for identifying and analyzing the internal and external factors that affect the organization’s privacy management system, including the privacy risks and opportunities.
2. Clause 5: PIMS-specific requirements related to ISO/IEC 27001
   Leadership: This clause specifies the requirements for the leadership of the organization in establishing and maintaining the PIMS, including the assignment of roles and responsibilities, the development of privacy policies, and the establishment of a privacy culture.
3. Clause 6: PIMS-specific guidance related to ISO/IEC 27002
   Planning: This clause specifies the requirements for the planning of the PIMS, including the development of a privacy risk management plan, the identification and evaluation of privacy risks, and the development of privacy objectives and targets.
4. Clause 7: Additional ISO/IEC 27002 guidance for PII controllers
   Support: This clause specifies the requirements for providing the necessary resources, infrastructure, and support for the implementation and maintenance of the PIMS, including training, awareness, and communication.
5. Clause 8: Additional ISO/IEC 27002 guidance for PII processors
   Operation: This clause specifies the requirements for implementing and operating the PIMS, including the implementation of privacy controls, the management of personal data, the handling of privacy incidents, and the monitoring and measurement of the PIMS.
6. Clause 9: ISMS requirements related to ISO/IEC 27001
   Performance evaluation: This clause specifies the requirements for monitoring, measuring, analyzing, and evaluating the performance of the PIMS, including the use of internal audits and management reviews.
7. Clause 10: ISMS requirements related to ISO/IEC 27001
   Improvement: This clause specifies the requirements for continually improving the effectiveness of the PIMS, including the implementation of corrective and preventive actions, the management of nonconformities, and the implementation of improvements based on the results of performance evaluations.