ISO/IEC 27562:2024
(Main)Information technology — Security techniques — Privacy guidelines for fintech services
Information technology — Security techniques — Privacy guidelines for fintech services
This document provides guidelines on privacy for fintech services. It identifies all relevant business models and roles in consumer-to-business relations and business-to-business relations, as well as privacy risks and privacy requirements, which are related to fintech services. It provides specific privacy controls for fintech services to address privacy risks. This document is based on the principles from ISO/IEC 29100, ISO/IEC 27701, and ISO/IEC 29184, the privacy impact assessment framework described in ISO/IEC 29134, and the risk management guideline described in ISO 31000. It also provides guidelines focusing on a set of privacy requirements for each stakeholder. This document can be applicable to all kinds of organizations such as regulators, institutions, service providers and product providers in the fintech service environment.
Technologies de l'information — Techniques de sécurité — Lignes directrices relatives à la protection de la vie privée pour les services fintech
General Information
Standards Content (Sample)
International
Standard
ISO/IEC 27562
First edition
Information technology — Security
2024-12
techniques — Privacy guidelines for
fintech services
Technologies de l'information — Techniques de sécurité — Lignes
directrices relatives à la protection de la vie privée pour les
services fintech
Reference number
© ISO/IEC 2024
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2024 – All rights reserved
ii
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 4
5 Stakeholders and general considerations for fintech services . 5
5.1 Stakeholders and business models for fintech services .5
5.2 General considerations.6
5.2.1 General .6
5.2.2 Consumers .6
5.2.3 Regulators .6
5.2.4 Service providers .6
5.2.5 Financial company .7
6 General principles applicable to fintech services . 7
7 Actors in fintech services . 7
7.1 Service providers as a PII controller .7
7.1.1 General .7
7.1.2 Adherence to the privacy principles .7
7.2 Service providers as a PII processor .8
7.3 Customer as a PII principal .8
7.4 Financial company as a PII controller .8
7.5 Regulators .8
8 Privacy risks to actors . 8
8.1 General privacy threats .8
8.2 Privacy risks to service providers as PII controllers .9
8.3 Privacy risks to service providers as PII processors .11
8.4 Privacy risks to customers as PII principals.11
8.5 Privacy risks to financial companies as PII controllers . 12
9 Privacy controls for actors .12
9.1 General . 12
9.2 Privacy controls applicable to service providers as PII controllers . 13
9.2.1 General . 13
9.2.2 Policies to ensure compliance with data protection regulations — Control . 13
9.2.3 Request for permission and consent . 13
9.2.4 Legitimate purpose — Control . 13
9.2.5 Authentication mechanisms — Control.14
9.2.6 Automated decision making — Control.14
9.2.7 De-identification method — Control .14
9.2.8 Risk management and governance arrangements — Control .14
9.2.9 Preventing algorithmic discrimination — Control .14
9.2.10 Policy of encryption — Control .14
9.2.11 PII transfers between jurisdictions — Control .14
9.2.12 Malware infection — Control . 15
9.2.13 Data breach notification to the supervisory authority — Control . 15
9.2.14 Security logging and monitoring policy — Control . 15
9.2.15 Recovery procedures — Control . 15
9.2.16 Backup policy — Control . 15
9.2.17 Data provenance and traceability — Control . 15
9.2.18 Explainable and analysable automatic decision — Control . 15
9.3 Privacy controls applicable to service providers as PII processors . 15
© ISO/IEC 2024 – All rights reserved
iii
9.3.1 General . 15
9.3.2 Contract agreement — Control . 15
9.3.3 Non-disclosure — Control .16
9.3.4 Improper data disclosure — Control .16
9.3.5 Risk assessment — Control .16
9.3.6 Personal data breach management — Control .16
9.3.7 Privacy Impact Assessment (PIA) — Control .16
9.4 Privacy controls by fintech service providers for customers as PII principals .16
9.4.1 General .16
9.4.2 Rights of PII principals — Control .16
9.4.3 Due diligence — Control .16
9.4.4 PII management— Control .16
9.4.5 Re-identification and anonymization — Control .17
9.4.6 Discrimination — Control .17
9.4.7 Surveillance — Control .17
9.4.8 Systematic and extensive profiling — Control .17
9.4.9 Accessible information — Control .17
9.4.10 PII processing after log-in — Control .17
9.5 Privacy controls applicable to financial companies as PII controllers .17
9.5.1 General .17
9.5.2 Processing limitation — Control.17
9.5.3 PII disclosure limitation — Control.17
9.5.4 PII transfer management — Control .17
10 Privacy guidelines for actors .18
10.1 Privacy risk treatment.
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.