Iso 27701 Pims

ISO 27701 Privacy Information Management System Implementation

Overview

ISO/IEC 27701:2019 specifies requirements and provides guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS) as an extension to ISO/IEC 27001:2022 and ISO/IEC 27002:2022. Published in August 2019, ISO 27701 is the first certifiable international standard for privacy management, providing a framework that maps to GDPR, LGPD, PIPA, APPI, and other data protection regulations. The standard transforms an existing Information Security Management System (ISMS) into a PIMS by adding privacy-specific requirements and controls applicable to PII controllers and PII processors.

Organizations such as Sentinel Compliance Group implement ISO 27701 to demonstrate accountability under Art. 5(2) GDPR, satisfy Art. 42 certification requirements, and provide contractual assurance to data subjects, customers, and supervisory authorities that privacy obligations are systematically managed.

Standard Structure

Clauses 5-8 Architecture

Clause 5: PIMS-Specific Requirements

5.2 Context of the Organization (extends ISO 27001 Clause 4)

5.2.1 Understanding the Organization and its Context

The organization shall determine external and internal issues relevant to privacy that affect its ability to achieve the intended outcomes of the PIMS. This includes:

• Applicable privacy legislation and regulation (GDPR, CCPA/CPRA, LGPD, PIPA, APPI, PDPA)
• Applicable judicial decisions and court orders
• Applicable administrative regulations and standards
• Contractual obligations related to PII processing
• Organizational governance, policies, and procedures relevant to PII processing
• Decisions regarding PII processing (particularly where the organization acts as both controller and processor for different processing activities)

5.2.2 Understanding the Needs and Expectations of Interested Parties

Interested parties specific to PIMS include:

5.2.3 Determining the Scope of the PIMS

The PIMS scope must define:

• The types of processing performed (collection, storage, use, disclosure, deletion)
• Whether the organization acts as PII controller, PII processor, or both
• The categories of PII processed
• The categories of PII principals affected
• The organizational units, locations, and systems in scope
• Third parties to whom PII is transferred

5.2.4 PIMS

The ISMS shall be extended to include privacy by addressing PII protection requirements in all ISMS processes, including risk assessment, risk treatment, policy, awareness, internal audit, management review, and continual improvement.

5.4 Planning (extends ISO 27001 Clause 6)

5.4.1.2 Privacy Risk Assessment

The organization shall implement a privacy risk assessment process that:

1. Identifies risks to PII principals (not just to the organization) arising from loss of confidentiality, integrity, and availability of PII
2. Considers privacy-specific threats: unauthorized access, unauthorized modification, unauthorized disclosure, unlawful processing, excessive data collection, failure to honor data subject rights, cross-border transfer without safeguards
3. Assesses the likelihood and impact of each risk from the perspective of the PII principal
4. Determines risk levels using a privacy-specific risk matrix

5.4.1.3 Privacy Risk Treatment

The risk treatment process shall select controls from:

• ISO/IEC 27001 Annex A (information security controls)
• ISO/IEC 27701 Annex A (PII controller controls) — when acting as controller
• ISO/IEC 27701 Annex B (PII processor controls) — when acting as processor
• Additional controls from other sources as needed

The Statement of Applicability (SoA) must be extended to include applicable Annex A and/or Annex B controls with justification for inclusion or exclusion of each control.

5.5 Support (extends ISO 27001 Clause 7)

5.5.1 Competence

Personnel performing privacy-related functions must demonstrate competence through:

• Formal privacy training (CIPP/E, CIPM, CIPT, ISO 27701 Lead Implementer, ISO 27701 Lead Auditor)
• Knowledge of applicable privacy legislation
• Understanding of PII processing operations within their scope
• Competence records maintained as documented information

5.5.2 Awareness

All persons doing work under the organization's control must be aware of:

• The privacy policy
• Their contribution to the effectiveness of the PIMS
• The implications of not conforming with PIMS requirements
• The potential consequences (including sanctions) of privacy violations

Annex A: PII Controller Controls

A.7 — Conditions for Collection and Processing

A.7.3 — Obligations to PII Principals

A.7.4 — Privacy by Design and Privacy by Default

A.7.5 — PII Sharing, Transfer, and Disclosure

Annex B: PII Processor Controls

B.8.2 — Conditions for Collection and Processing

B.8.3 — Obligations to PII Principals

B.8.4 — Privacy by Design and Default

B.8.5 — PII Sharing, Transfer, and Disclosure

Gap Assessment Methodology

Phase 1: Prerequisite Assessment (Weeks 1-2)

Before ISO 27701 implementation, verify that a functioning ISO 27001 ISMS is in place:

1. ISO 27001 Certification Status: Confirm valid ISO 27001:2022 certification or at minimum a fully implemented ISMS with completed internal audit cycle
2. Scope Alignment: Determine whether the PIMS scope aligns with the existing ISMS scope or requires expansion
3. Documentation Baseline: Inventory existing ISMS policies, procedures, and records that will be extended

Phase 2: Clause 5 Gap Analysis (Weeks 2-4)

For each sub-clause of Clause 5, assess:

Specific gap analysis checklist:

• Context analysis includes privacy-specific external and internal issues (5.2.1)
• Interested parties include PII principals and supervisory authorities (5.2.2)
• PIMS scope defines controller/processor roles per processing activity (5.2.3)
• Privacy risk assessment addresses risks to PII principals (5.4.1.2)
• Statement of Applicability includes Annex A/B controls (5.4.1.3)
• Privacy-specific competence requirements are defined and tracked (5.5.1)
• Privacy awareness program covers all persons under organizational control (5.5.2)
• Internal audit scope includes PIMS-specific requirements (5.6)
• Management review includes privacy performance indicators (5.7)

Phase 3: Annex A/B Control Gap Analysis (Weeks 4-8)

For organizations acting as PII controllers, assess all 31 Annex A controls. For PII processors, assess all 18 Annex B controls. For organizations acting in both roles, assess both annexes.

Gap Assessment Template:

Control ID: A.7.2.1
Control Title: Identify and document purpose
Current State: Purposes documented in privacy notice but not in processing register
Gap Description: Processing register lacks specific purpose documentation per activity
Risk Rating: Medium
Remediation Action: Update processing register template, populate for all activities
Owner: Data Protection Officer
Target Date: [date]

Phase 4: Clause 6 Gap Analysis (Weeks 4-8, parallel with Phase 3)

Assess the 34 privacy-specific modifications to ISO 27002 controls in Clause 6:

Certification Path

Step 1: Readiness (Months 1-3)

1. Complete gap assessment (Phases 1-4 above)
2. Develop remediation roadmap with prioritized actions
3. Secure management commitment and budget
4. Assign PIMS implementation team

Step 2: Implementation (Months 3-9)

1. Extend ISMS documentation with PIMS-specific policies and procedures
2. Implement Annex A/B controls per the remediation roadmap
3. Conduct privacy risk assessments for all in-scope processing activities
4. Update Statement of Applicability to include Annex A/B controls
5. Deliver privacy-specific training to all personnel

Step 3: Internal Audit and Management Review (Months 9-10)

1. Conduct PIMS-specific internal audit covering Clauses 5-8 and applicable Annex controls
2. Document nonconformities and corrective actions
3. Conduct management review with privacy-specific agenda items
4. Verify closure of all major nonconformities

Step 4: Certification Audit (Months 10-12)

1. Stage 1 Audit: Documentation review, scope confirmation, readiness assessment. The certification body reviews PIMS documentation, SoA, risk assessment, and policy framework. Typically 1-2 days on-site.
2. Stage 2 Audit: Implementation verification, evidence sampling, interviews with key personnel. The auditor verifies that controls are not just documented but implemented and effective. Typically 3-5 days on-site depending on scope.
3. Finding Resolution: Address any nonconformities identified during Stage 2. Major nonconformities must be resolved before certification; minor nonconformities must have accepted corrective action plans.

Step 5: Surveillance and Recertification

• Surveillance Audits: Conducted annually (Year 1 and Year 2) to verify continued conformity
• Recertification Audit: Full audit in Year 3 before certificate expiry
• Scope Changes: Notify the certification body if significant changes affect the PIMS scope

Certification Bodies

Accredited certification bodies for ISO 27701 include BSI, SGS, TUV, Bureau Veritas, DNV, LRQA, and Schellman. The certification body must hold accreditation from a national accreditation body (e.g., UKAS, ANAB, DAkkS) specifically for ISO 27701 audits.

GDPR Alignment via Annex D

Annex D (informative) provides a detailed mapping between ISO 27701 controls and GDPR articles. Key mappings:

Implementation at Sentinel Compliance Group

Sentinel Compliance Group extended its existing ISO 27001:2022 certified ISMS to ISO 27701 over a 12-month period:

• Scope: All customer data processing operations across EU and APAC regions, covering 47 processing activities as both PII controller (23 activities) and PII processor (24 activities)
• Gap Assessment Results: 22 of 31 Annex A controls partially implemented; 14 of 18 Annex B controls partially implemented; 7 Clause 5 gaps identified
• Key Remediation Items: Privacy risk assessment methodology (5.4.1.2), data subject rights response procedures (A.7.3), sub-processor change management (B.8.5.7-B.8.5.8)
• Certification Outcome: Achieved dual ISO 27001 + ISO 27701 certification via BSI, with zero major nonconformities at Stage 2 audit
• Ongoing: Annual surveillance audits, quarterly privacy risk reviews, continuous improvement through corrective action tracking