ISO 27701: 2019: Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines
The standard covers privacy information management system (PIMS) and is therefore classified as a management system, expanding the specifications ISO/IEC 27001 and ISO/IEC 27002.
The standard was developed by the WG 5 group of the technical committee, which writes the ISO/IEC JTCI/SC 27: Information security, cybersecurity and privacy protection standard. Delegates from Microsoft, BSI Group, and the French committee for the supervision of private information protection participated in the technical committee.
ISO 27701: 2019 is based on ISO/IEC 29100: 2011: Information technology — Security techniques — Privacy framework; ISO 29151: 2017: Information technology — Security techniques — Code of practice for personally identifiable information protection; ISO/IEC 19944: 2017: Information technology — Cloud computing — Cloud services and devices: Data flow, data categories and data use; and ISO/IEC 29134: 2017: Information technology — Security techniques — Guidelines for privacy impact assessment.
Note the definition of the terms: customer, controller, and processor.
The standard includes chapters on:
- Management systems
- Special controls and interpretations from ISO/IEC 27002
- Expansion on the ISO/IEC 27002 private information guidelines/controller
- Expansion on the ISO/IEC 27002 private information processor
- Annex for processors and controller bodies
- Annex for mapping the requirements of ISO 29100: 2019: Information technology — Security techniques — Privacy framework
- Annex for mapping the requirements of Articles 5 through 49 of the General Data Protection Regulation (GDPR)
- Annex for mapping the requirements of ISO/IEC 27018: 2018:2019: Information technology — Security techniques — Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors and ISO?iEC 29151: 2017: Information technology — Security techniques — Code of practice for personally identifiable information protection
- Examples of implementation
The road to certification
To initiate the process, we recommend purchasing the standard at the Standards Institution of Israel Information Center.
Certification follows the successful implementation an organization's in-house quality management system pursuant to the requirements of the standard. To start this process, it is recommended to purchase the standard at the Standards Institution of Israel Information Center, study the requirements, and participate in appropriate training. It is also possible to consult with the quality management experts and undergo an audit by Standards Institution of Israel to check for shortcomings.
The process ought to be seen as an opportunity for improvement via the organization team which will receive management commitment and involvement. At the end of the process, independent Standards Institution of Israel auditors will perform an audit that confirms that the organization's management system is compatible to the specifications of the standard.
The Standards Institution of Israel – the right choice for you!
- The Standards Institution of Israel has a longstanding reputation for quality and professionalism
- Our people are among the best experts in the quality assurance field, with experience and familiarity of customers' needs
- The Standards Institution of Israel is the country's largest certification body
- The Standards Institution of Israel has accreditation from the largest certification bodies in the world
- The Standards Institution of Israel offers a range of services under one roof: certification (individual and integrated), a range of laboratory tests, and a training center
- The Standards Institution of Israel is member of international standardization committees and has cooperation agreements with top certification bodies in the world.
- The Standards Institution of Israel is a member of IQNet Association - The International Certification Network, which incorporates certification bodies from all over the world. Standards Institution of Israel customers obtain exclusive IQNet certification for free and may also obtain mutual recognition from IQNet members as a marketing tool.
