ISO/IEC 27701:2019

Requirements for Privacy Information Management Systems

Standard ISO/IEC 27701 provides guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS) as an extension to ISO/IEC 27001 (Information security management systems requirements) and ISO/IEC 27002 (Information security controls) for privacy management within the context of the organization.

This standard specifies PIMS-related requirements and provides a framework for personal identifiable information (PII) controllers and PII processors that hold responsibility for PII processing.

This standard is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, which are PII controllers and/or PII processors processing PII from within an information security management system (ISMS).

Comparison with other standards

ISO/IEC 27701 offers a structured, certifiable approach to privacy management as an extension of ISO/IEC 27001 (Information Security Management). Here's how it compares to other prominent privacy frameworks:

ISO/IEC 27701 vs. GDPR

• Focus: ISO/IEC 27701 provides a practical framework for implementing privacy controls and can serve as evidence of compliance with GDPR.
• Scope: GDPR is a legal regulation specific to the EU and emphasizes accountability and consent management. ISO/IEC 27701, being international, applies broadly to any organization seeking to manage PII responsibly.
• Certification: GDPR compliance cannot be certified, but ISO/IEC 27701 certification demonstrates alignment with its principles.

ISO/IEC 27701 vs. NIST Privacy Framework

• Approach: The NIST Privacy Framework is a flexible, risk-based tool for managing privacy risks, whereas ISO/IEC 27701 establishes a certifiable system tied to ISMS.
• Customization: NIST emphasizes adaptability to any organizational context, while ISO/IEC 27701 builds on specific ISMS practices and structures.
• Integration: Organizations can align NIST’s privacy risk management practices with ISO/IEC 27701 to cover both operational and strategic privacy needs.

ISO/IEC 27701 vs. CCPA

• Applicability: CCPA focuses on consumer privacy rights in California, emphasizing opt-out mechanisms and data transparency. ISO/IEC 27701 supports these goals through systematic privacy controls but is not limited to specific jurisdictions.
• Demonstration of Compliance: ISO/IEC 27701 helps businesses establish processes that indirectly support CCPA compliance through structured privacy management.