ISO/IEC 27701: Privacy Information Management in Practice

Purpose

ISO/IEC 27701 concerns privacy information management. It gives organizations a structured way to govern privacy-related responsibilities and processes in relation to personal information. Apply it in the context of the organization's applicable privacy obligations, services, data flows and relationships with customers and suppliers.

Define scope and accountability

Document the services, locations, systems, personal-information flows and organizational roles covered. Clarify responsibilities for determining purposes and means, processing on behalf of others, responding to individuals and coordinating with suppliers, as applicable. Connect privacy decisions to security, records management, product design, procurement and incident response so that controls are part of normal operations.

Operate and improve

Establish processes for identifying privacy risks, assessing changes, handling requests and incidents, controlling access, retaining or deleting information, and maintaining supplier evidence. Assign owners and retain records showing the decision, scope, approval and outcome. Monitor issues, complaints, exceptions and corrective actions; reassess when data uses, technology, jurisdictions or business relationships change.

Boundaries

A management system does not itself establish compliance with every privacy law, guarantee individual rights outcomes or eliminate risk. Determine legal obligations separately and document how scope and controls address them. A certificate, if obtained, applies only to its stated scope and assessment criteria.