ISO/IEC 15944-12:2025

Information technology — Business operational view — Part 12: Privacy protection requirements (PPR) on information life cycle management (ILCM) and EDI of personal information (PI)

This document: — provides method(s) for identifying, in Open-edi modelling technologies and development of scenarios, the additional requirements in business operational view (BOV) specifications for identifying the additional external constraints to be applied to recorded information in business transactions relating to personal information of an individual, as required by legal and regulatory requirements of applicable jurisdictional domains; — integrates existing normative elements in support of privacy and data protection requirements as are already identified in ISO/IEC 14662 and ISO/IEC 15944-1, ISO/IEC 15944-2, ISO/IEC 15944-4, ISO/IEC 15944-5, ISO/IEC 15944-8, ISO/IEC 15944-9 and ISO/IEC 15944-10; — provides overarching, operational ‘best practice’ statements for associated (and not necessarily automated) processes, procedures, practices and governance requirements that act in support of implementing and enforcing technical mechanisms which support the privacy/data protection requirements necessary for implementation in Open-edi transaction environments; — focuses on the life cycle management of personal information, i.e. the contents of SPIs (and their SRIs) related to the business transaction interchanged via EDI as Information Bundles (IBs) and their associated Semantic Components (SCs) among the parties to a business transaction. NOTE Privacy protection requirements (PPR) on information life cycle management (ILCM) and EDI of personal information as stated in this document primarily via enumerated rules which serve as a minimum set of ILCM policy and operational requirements for all recorded information pertaining to a business transaction in particular, as well as ILCM implementation in any organization in general. This document does not specify the technical mechanisms, i.e. functional support services (FSV) which are required to support BOV-identified requirements. Detailed exclusions to the scope of this document are provided in Annex H.

Technologies de l'information — Vue opérationnelle d'affaires — Partie 12: Exigences en matière de protection de la vie privée (PPR) relatives à la gestion du cycle de vie de l’information (ILCM) et de l'EDI des renseignements personnels (PI)

General Information

• Status: Published
• Publication Date: 30-Jun-2025
• ICS: 35.240.63 - IT applications in trade
• Technical Committee: ISO/IEC JTC 1/SC 32 - Data management and interchange
• Drafting Committee: ISO/IEC JTC 1/SC 32 - Data management and interchange
• Current Stage: 6060 - International Standard published
• Start Date: 01-Jul-2025
• Due Date: 22-Mar-2025
• Completion Date: 01-Jul-2025

Relations

• Revises: ISO/IEC 15944-12:2020 - Information technology — Business operational view — Part 12: Privacy protection requirements (PPR) on information life cycle management (ILCM) and EDI of personal information (PI)
• Effective Date: 06-Jun-2022

Standards Content (Sample)

International
Standard
ISO/IEC 15944-12
Second edition
Information technology — Business
2025-07
operational view —
Part 12:
Privacy protection requirements
(PPR) on information life cycle
management (ILCM) and EDI of
personal information (PI)
Technologies de l'information — Vue opérationnelle d'affaires —
Partie 12: Exigences en matière de protection de la vie privée
(PPR) relatives à la gestion du cycle de vie de l’information
(ILCM) et de l'EDI des renseignements personnels (PI)
Reference number
© ISO/IEC 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2025 – All rights reserved
ii
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 2
4 Abbreviated terms .29
5 Fundamental privacy protection principles .31
5.1 Overview .31
5.2 Primary sources of privacy protection principles .32
5.3 Key eleven (11) privacy protection principles .32
5.4 Link to “consumer protection” and “individual accessibility” requirements . 33
5.5 Privacy protection principles in the context of ILCM requirements . 34
5.6 Requirement for tagging (or labelling) sets of personal information (SPIs) in support of
privacy protection requirements (PPR) . 34
5.7 Requirements for making all personal information (PI) available to the buyer where
the buyer is an individual . 35
5.8 Rules governing ILCM aspects of personal information profiles (PIPs) . 35
6 Integrated set of information life cycle management (ILCM) principles in support of
information law and privacy protection requirements (PPR) .37
6.1 Primary purpose.37
6.2 Information life cycle management (ILCM) principles that support privacy protection
requirements (PPR) . 38
6.2.1 conformance with privacy protection requirements (PPR) and associated
information law requirements . 38
6.2.2 Direct relevance, informed consent and openness . 39
6.2.3 Ensuring that personal information is “under the control of” the organization
throughout its ILCM . 40
6.2.4 Limiting use, disclosure and retention .41
6.2.5 Timely, accurate, relevant .43
6.2.6 Data integrity and quality .45
6.2.7 Safeguards for non-authorized disclosure requirements .45
6.2.8 Back-up, retention and archiving . 46
6.2.9 Disposition and expungement .47
6.2.10 Organizational archiving .47
6.2.11 Historical, statistical and/or research value .47
6.3 Requirement for tagging (or labelling) data elements in support of privacy protection
requirements (PPR) . 48
7 Rules governing ensuring accountability for and control of personal information (PI) .49
7.1 Purpose . 49
7.2 Key aspects of Open-edi requirements . 49
7.3 Key aspects of “under the control of” . 49
7.4 “under the control of” in support of PPR and in an ILCM context . 50
7.5 Implementing “under the control of” and accountability .51
8 Rules governing the specification of ILCM aspects of personal information .56
8.1 Overview . 56
8.2 Rules governing establishing ILCM responsibilities for personal information (PI).57
8.3 Rules governing establishing specifications for retention of personal information
(PI) — applicable “SRI retention triggers” .59
8.4 Rules governing identification and specification of state changes of personal
information (PI) .62
8.4.1 General requirements .62
8.4.2 Specification of state changes allowed to personal information (PI) . 63

© ISO/IEC 2025 – All rights reserved
iii
8.4.3 Specification of store change type . 65
8.4.4 Rules governing specification of source of state changes .67
8.5 Rules governing disposition of personal information (PI). 68
8.6 Rules governing the establishment and maintenance of record retention and disposal
schedules (RRDS) for sets of personal information (SPIs) .71
9 Data conversion, data migration and data synchronization .73
9.1 Purpose . 73
9.2 Rules governing data conversion of set(s) of personal information (SPI) . 73
9.3 Rules governing requirements for data synchronization of sets of personal information
(SPI) .74
10 Rules governing the EDI of personal information (PI) between a primary ILCM Person
and its agent, third party and/or regulator . 76
10.1 General requirements .76
10.2 ILCM rules pertaining to use of an “agent” by a Person . 77
10.3 ILCM rules pertaining to use of a “third party” by a Person . 77
10.4 ILCM rules pertaining to the use of a “regulator” by a Person . 78
11 Conformance statement .79
11.1 Overview . 79
11.2 Conformance to the ISO/IEC 14662 Open-edi reference model and the ISO/
IEC 15944series . 79
11.3 Conformance to ISO/IEC 15944-12 . 79
11.4 Conformance by agents and third parties to ISO/IEC 15944-12 . 80
Annex A (normative) Consolidated controlled vocabulary definitions and associated terms,
as human interface equivalents (HIEs), with cultural adaptability: English and French
language equivalency in an IT standardization context .81
Annex B (normative) Consolidated set of rules in the ISO/IEC 15944 series of particular
relevance to privacy protection requirements (PPR) as external constraints on business
transactions which apply to personal information (PI) in an ILCM requirements context .85
Annex C (informative) Business transaction model (BTM): Classes of constraints .101
Annex D (normative) Linking ILCM rules to process phases rules of a business transaction .104
Annex E (normative) Generic approach to ILCM decisions in a PPR context — ILCM conformance
decision tree and associated rules .106
Annex F (informative) Generic approach to identification of properties and behaviours of
personal information (PI) as transitory records and their disposition/expungement .109
Annex G (informative) Notes on referential integrity and privacy protection transactional
integrity (PPTI) in Open-edi among IT systems .
...

FINAL DRAFT
International
Standard
ISO/IEC
FDIS
15944-12
ISO/IEC JTC 1/SC 32
Information technology — Business
Secretariat: ANSI
operational view —
Voting begins on:
Part 12:
Privacy protection requirements
Voting terminates on:
(PPR) on information life cycle
management (ILCM) and EDI of
personal information (PI)
Technologies de l'information — Vue opérationnelle d'affaires —
Partie 12: Exigences en matière de protection de la vie privée
(PPR) relatives à la gestion du cycle de vie de l’information
(ILCM) et de l'EDI des renseignements personnels (PI)
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO­
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
Reference number
ISO/IEC FDIS 15944­12:2025(en) © ISO/IEC 2025

FINAL DRAFT
ISO/IEC FDIS 15944-12:2025(en)
International
Standard
ISO/IEC
FDIS
15944-12
ISO/IEC JTC 1/SC 32
Information technology — Business
Secretariat: ANSI
operational view —
Voting begins on:
Part 12:
Privacy protection requirements
Voting terminates on:
(PPR) on information life cycle
management (ILCM) and EDI of
personal information (PI)
Technologies de l'information — Vue opérationnelle d'affaires —
Partie 12: Exigences en matière de protection de la vie privée
(PPR) relatives à la gestion du cycle de vie de l’information
(ILCM) et de l'EDI des renseignements personnels (PI)
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
© ISO/IEC 2025
IN ADDITION TO THEIR EVALUATION AS
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO­
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
or ISO’s member body in the country of the requester.
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland Reference number
ISO/IEC FDIS 15944­12:2025(en) © ISO/IEC 2025

© ISO/IEC 2025 – All rights reserved
ii
ISO/IEC FDIS 15944-12:2025(en)
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 2
4 Abbreviated terms .29
5 Fundamental privacy protection principles .31
5.1 Overview .31
5.2 Primary sources of privacy protection principles .32
5.3 Key eleven (11) privacy protection principles .32
5.4 Link to “consumer protection” and “individual accessibility” requirements (see ISO/
IEC 15944-8:—, 6.3) . 33
5.5 Privacy protection principles in the context of ILCM requirements . 34
5.6 Requirement for tagging (or labelling) sets of personal information (SPIs) in support of
privacy protection requirements (PPR) . 34
5.7 Requirements for making all personal information (PI) available to the buyer where
the buyer is an individual . 35
5.8 Rules governing ILCM aspects of personal information profiles (PIPs) . 35
6 Integrated set of information life cycle management (ILCM) principles in support of
information law and privacy protection requirements (PPR) .37
6.1 Primary purpose.37
6.2 Information life cycle management (ILCM) principles that support privacy protection
requirements (PPR) . 38
6.2.1 conformance with privacy protection requirements (PPR) and associated
information law requirements . 38
6.2.2 Direct relevance, informed consent and openness . 39
6.2.3 Ensuring that personal information is “under the control of” the organization
throughout its ILCM . 40
6.2.4 Limiting use, disclosure and retention .41
6.2.5 Timely, accurate, relevant . 44
6.2.6 Data integrity and quality .45
6.2.7 Safeguards for non-authorized disclosure requirements .45
6.2.8 Back-up, retention and archiving . 46
6.2.9 Disposition and expungement .47
6.2.10 Organizational archiving .47
6.2.11 Historical, statistical and/or research value .47
6.3 Requirement for tagging (or labelling) data elements in support of privacy protection
requirements (PPR) . 48
7 Rules governing ensuring accountability for and control of personal information (PI) .49
7.1 Purpose . 49
7.2 Key aspects of Open-edi requirements . 49
7.3 Key aspects of “under the control of” . 49
7.4 “under the control of” in support of PPR and in an ILCM context . 50
7.5 Implementing “under the control of” and accountability .51
8 Rules governing the specification of ILCM aspects of personal information .56
8.1 Overview . 56
8.2 Rules governing establishing ILCM responsibilities for personal information (PI).57
8.3 Rules governing establishing specifications for retention of personal information
(PI) — applicable “SRI retention triggers” .59
8.4 Rules governing identification and specification of state changes of personal
information (PI) .62
8.4.1 General requirements .62

© ISO/IEC 2025 – All rights reserved
iii
ISO/IEC FDIS 15944-12:2025(en)
8.4.2 Specification of state changes allowed to personal information (PI) . 63
8.4.3 Specification of store change type . 65
8.4.4 Rules governing specification of source of state changes .67
8.5 Rules governing disposition of personal information (PI). 68
8.6 Rules governing the establishment and maintenance of record retention and disposal
schedules (RRDS) for sets of personal information (SPIs) .71
9 Data conversion, data migration and data synchronization .73
9.1 Purpose . 73
9.2 Rules governing data conversion of set(s) of personal information (SPI) . 73
9.3 Rules governing requirements for data synchronization of sets of personal information
(SPI) .74
10 Rules governing the EDI of personal information (PI) between a primary ILCM Person
and its agent, third party and/or regulator . 76
10.1 General requirements .76
10.2 ILCM rules pertaining to use of an “agent” by a Person . 77
10.3 ILCM rules pertaining to use of a “third party” by a Person . 77
10.4 ILCM rules pertaining to the use of a “regulator” by a Person . 78
11 Conformance statement .79
11.1 Overview . 79
11.2 Conformance to the ISO/IEC 14662 Open-edi reference model and the ISO/
IEC 15944series .
...

Date: 2025-02-20
nd
Reference number of document: ISO/IEC FDIS 15944--12:2025(E) 2 edition
Committee identification: ISO/IEC JTC 001 1/SC 32/WG 01
Secretariat: ISO/IEC JTC1/SC32 ANSI
Date: 2025-03-28
Information technology — Business Operational View — operational
view —
Part 12:
Privacy protection requirements (PPR) on information life cycle
management (ILCM) and EDI of personal information (PI)
Technologies de l'information — Vue opérationnelle d'affaires —
Partie 12: Exigences en matière de protection de la vie privée (PPR) relatives à la gestion du cycle de vie de
l’information (ILCM) et de l'EDI des renseignements personnels (PI)
FDIS stage
ISO/IEC PRF FDIS 15944--12:2020(E2025(en)
© ISO/IEC 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication
may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying,
or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO
at the address below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: + 41 22 749 01 11
EmailE-mail: [e-mail]
Website: www.iso.orgwww.iso.org
Published in Switzerland
ii © ISO/IEC 2020 – All rights reserved
© ISO/IEC 2025 – All rights reserved
ii
ISO/IEC FDIS 15944--12:2025(Een)
Contents
Foreword . ix
Introduction . x
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 2
4 Abbreviated terms . 33
5 Fundamental privacy protection principles . 35
6 Integrated set of information life cycle management (ILCM) principles in support of
information law and privacy protection requirements (PPR) . 44
7 Rules governing ensuring accountability for and control of personal information (PI) . 58
8 Rules governing the specification of ILCM aspects of personal information . 68
9 Data conversion, data migration and data synchronization . 87
10 Rules governing the EDI of personal information (PI) between a primary ILCM Person
and its agent, third party and/or regulator . 91
11 Conformance statement . 94
Annex A (normative) Consolidated controlled vocabulary definitions and associated terms, as
human interface equivalents (HIEs), with cultural adaptability: English and French
language equivalency in an IT standardization context . 97
Annex B (normative) Consolidated set of rules in the ISO/IEC 15944 series of particular
relevance to privacy protection requirements (PPR) as external constraints on business
transactions which apply to personal information (PI) in an ILCM requirements context102
Annex C (informative) Business transaction model (BTM): Classes of constraints . 121
Annex D (normative) Linking ILCM rules to process phases rules of a business transaction . 126
Annex E (normative) Generic approach to ILCM decisions in a PPR context — ILCM conformance
decision tree and associated rules . 130
Annex F (informative) Generic approach to identification of properties and behaviours of
personal information (PI) as transitory records and their disposition/expungement . 135
Annex G (informative) Notes on referential integrity and privacy protection transactional
integrity (PPTI) in Open-edi among IT systems . 137
Annex H (informative) Exclusions to the scope of ISO/IEC 15944-12 . 139
Annex I (informative) Aspects not currently addressed in this document . 142
Bibliography . 151

Foreword . v
iii
Introduction . ix
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 2
© ISO/IEC 2025 – All rights reserved
iiiiii
ISO/IEC PRF FDIS 15944--12:2020(E2025(en)
4 Abbreviated terms . 33
5 Fundamental privacy protection principles . 35
5.1 Overview . 35
5.2 Primary sources of privacy protection principles . 36
5.3 Key eleven (11) privacy protection principles . 37
5.4 Link to “consumer protection” and “individual accessibility” requirements (see
ISO/IEC 15944-8:2025, 6.3) . 38
5.5 Privacy protection principles in the context of ILCM requirements . 39
5.6 Requirement for tagging (or labelling) sets of personal information (SPIs) in support of
privacy protection requirements (PPR) in accordance with ISO/IEC 15944-8:2025, 5.4 . 40
5.7 Requirements for making all personal information (PI) available to the buyer where the
buyer is an individual . 40
5.8 Rules governing ILCM aspects of personal information profiles (PIPs) . 40
6 Integrated set of information life cycle management (ILCM) principles in support of
information law and privacy protection requirements (PPR) . 42
6.1 Primary purpose of Clause 6 . 42
6.2 Information life cycle management (ILCM) principles that support privacy protection
requirements (PPR) . 44
6.2.1 Compliance with privacy protection requirements (PPR) and associated information law
requirements . 44
6.2.2 Direct relevance, informed consent and openness . 44
6.2.3 Ensuring that personal information is “under the control of” the organization
throughout its ILCM . 46
6.2.4 Limiting use, disclosure and retention . 47
6.2.5 Timely, accurate, relevant . 50
6.2.6 Data integrity and quality . 51
6.2.7 Safeguards for non-authorized disclosure requirements . 51
6.2.8 Back-up, retention and archiving . 52
6.2.9 Disposition and expungement . 53
6.2.10 Organizational archiving . 53
6.2.11 Historical, statistical and/or research value . 54
6.3 Requirement for tagging (or labelling) data elements in support of privacy protection
requirements (PPR) . 55
7 Rules governing ensuring accountability for and control of personal information (PI) . 55
7.1 Purpose . 55
7.2 Key aspects of Open-edi requirements . 55
7.3 Key aspects of “under the control of” . 56
iv © ISO/IEC 2020 – All rights reserved
© ISO/IEC 2025 – All rights reserved
iv
ISO/IEC FDIS 15944--12:2025(Een)
7.4 “under the control of” in support of PPR and in an ILCM context . 56
7.5 Implementing “under the control of” and accountability . 58
8 Rules governing the specification of ILCM aspects of personal information . 62
8.1 Overview . 62
8.2 Rules governing establishing ILCM responsibilities for personal information (PI) . 64
8.3 Rules governing establishing specifications for retention of personal information (PI) —
applicable “SRI retention triggers” . 66
8.4 Rules governing identification and specification of state changes of personal information
(PI) . 69
8.4.1 General requirements . 69
8.4.2 Specification of state changes allowed to personal information (PI) . 70
8.4.3 Specification of store change type . 73
8.4.4 Rules governing specification of source of state changes . 74
8.5 Rules governing disposition of personal information (PI) . 75
8.6 Rules governing the establishment and maintenance of record retention and disposal
schedules (RRDS) for sets of personal information (SPIs) . 79
9 Data conversion, data migration and data synchronization . 81
9.1 Purpose . 81
9.2 Rules governing data conversion of set(s) of personal information (SPI) . 82
9.3 Rules governing requirements for data synchronization of sets of personal information
(SPI) . 82
10 Rules governing the EDI of personal information (PI) between a primary ILCM Person
and its agent, third party, and/or regulator . 84
10.1 General requirements . 84
10.2 ILCM rules pertaining to use of an “agent”by a Person . 85
10.3 ILCM rules pertaining to use of a “third party”by a Person . 86
10.4 ILCM rules pertaining to use of a “regulator”by a Person .
...