ISO/IEC 27701

ISO/IEC 27701:2019 (BDS ISO/IEC 27701:2020) Security methods. Addendum to ISO/IEC 27001 and ISO/IEC 27002 on Privacy Management. Requirements and guidelines

ISO/IEC 27701

ISO/IEC 27701 is a privacy extension to ISO/IEC 27001 and ISO/IEC 27002. Its purpose is to improve the existing Information Security Management System (ISMS) with regard to issues related to information security and personal privacy.

ISO/IEC 27701, also referred to as PIMS (Privacy Information Management System), outlines a framework for controllers and processors to manage privacy and personal information (Personally Identifiable Information (PII).

The standard is applicable to all types and sizes of organizations, including public and private companies, government entities and non-profit organizations, that are PII administrators and/or process PII within the framework of the ISMS. As ISO/IEC 27701 is an extension standard, it requires that ISO/IEC 27001 be implemented in advance. Organizations that want to obtain ISO/IEC 27701 certification will either need to have an existing ISO/IEC 27001 certification, or they can implement ISO/IEC 27001 and ISO/IEC 27701 at the same time.

ISO/IEC 27701 helps the organization manage its risks to the confidentiality, availability and integrity of personal data and demonstrate to customers, partners and employees that there are effective controls for compliance with the General Data Protection Regulation (GDPR) and other legal provisions related to the privacy of personal information.

Structure of ISO/IEC 27701:

• Clause 5 provides PIMS-specific requirements and other information on information security in relation to the requirements in ISO/IEC 27001 appropriate for an organisation acting as a PII controller or processor. The clause contains sub-clauses thematically mirroring those in ISO/IEC 27001;
• Clause 6 provides PIMS-specific guidance and other information on information security in relation to controls in ISO/IEC 27002 and specific PIMS guidance for an organisation acting as a PII controller or PII processor. The clause contains sub-clauses thematically mirroring those in ISO/IEC 27002;
• Clause 7 provides additional guidance and requirements for PII controllers;
• Clause 8 provides additional guidance and requirements for PII processors;
• Annex A lists the PIMS-specific control objectives and controls for an organization acting as a PII administrator (whether or not it uses a processor and whether or not it acts in conjunction with another administrator).
• Annex B lists the PIMS-specific control objectives and controls for an organisation acting as a PII processor (whether or not it subcontracts the processing of PII, and including those that process PII as subcontractors of PII controllers).
• Annex C contains compliance with ISO/IEC 29100.
• Annex D contains an analogous comparison of the controls in the standard against the GDPR.
• Annex F contains correspondence between ISO/IEC 27018 and ISO/IEC 29151.
• Annex F explains how ISO/IEC 27001 and ISO/IEC 27002 are being extended to protect privacy when processing personal information (PII).

ISO/IEC 27701 would help your organisation with guidance and measures regarding:

• Defining the requirements and objectives of personal data and information security;
• Ensuring the implementation of the applicable legislation regarding the protection of personal data and ensuring network and information security;
• Definition of information security management processes;
• Increasing security in the selection, appointment and dismissal of employees;
• Security management in relationships with suppliers;
• Provision of backup copies of information and critical information systems;
• Mechanisms to control mobile devices, removable media and other IT assets in your organization so as to limit the risk of accident and leakage/loss of information;
• Development of action plans in case of an information security incident;
• Necessary documented rules (procedures, policies, etc.) to define the permitted and prohibited actions regarding the handling of personal data and sensitive information;
• and many others.