ISO/IEC FDIS 27701

Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance

This document specifies requirements for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS). Guidance is provided to assist in the implementation of the controls in this document. This document is intended for PII controllers and PII processors holding responsibility and accountability for PII processing. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations.

Sécurité de l'information, cybersécurité et protection de la vie privée — Systèmes de management de la protection de la vie privée — Exigences et recommandations

Le présent document spécifie les exigences et fournit des recommandations pour la création, la mise en œuvre, le maintien et l'amélioration continue d'un système de management de la protection de la vie privée (PIMS) sous la forme d'une extension de l'ISO/IEC 27001 et l'ISO/IEC 27002 pour le management de la protection de la vie privée dans le contexte de l'organisation. Le présent document spécifie les exigences liées au PIMS et fournit des recommandations destinées aux responsables de traitement de DCP et aux sous-traitants de DCP chargés de et responsables du traitement des DCP. Le présent document s'applique aux organisations de tous types et de toutes tailles, y compris les entreprises publiques et privées, les entités gouvernementales et les organisations à but non lucratif, qui sont des responsables de traitement de DCP et/ou des sous-traitants de DCP qui traitent les DCP à l'aide d'un SMSI.

General Information

• Status: Not Published
• ICS: 35.030 - IT Security
• Technical Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Drafting Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Current Stage: 5020 - FDIS ballot initiated: 2 months. Proof sent to secretariat
• Start Date: 08-May-2025
• Completion Date: 08-May-2025

Relations

• Revises: ISO/IEC 27701:2019 - Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines
• Effective Date: 22-Oct-2022

Standards Content (Sample)

FINAL DRAFT
International
Standard
ISO/IEC FDIS
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection — Privacy
Voting begins on:
information management systems
2025-05-08
— Requirements and guidance
Voting terminates on:
2025-07-03
Sécurité de l'information, cybersécurité et protection de la vie
privée — Systèmes de management de la protection de la vie
privée — Exigences et recommandations
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO­
ISO/CEN PARALLEL PROCESSING LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
Reference number
FINAL DRAFT
International
Standard
ISO/IEC FDIS
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection — Privacy
Voting begins on:
information management systems
— Requirements and guidance
Voting terminates on:
Sécurité de l'information, cybersécurité et protection de la vie
privée — Systèmes de management de la protection de la vie
privée — Exigences et recommandations
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
© ISO/IEC 2025
IN ADDITION TO THEIR EVALUATION AS
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO­
ISO/CEN PARALLEL PROCESSING
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
or ISO’s member body in the country of the requester.
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland Reference number
© ISO/IEC 2025 – All rights reserved
ii
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms, definitions and abbreviations . 1
4 Context of the organization . 4
4.1 Understanding the organization and its context .4
4.2 Understanding the needs and expectations of interested parties .5
4.3 Determining the scope of the privacy information management system .5
4.4 Privacy information management system .6
5 Leadership . 6
5.1 Leadership and commitment .6
5.2 Privacy policy .6
5.3 Roles, responsibilities and authorities .7
6 Planning . 7
6.1 Actions to address risks and opportunities .7
6.1.1 General .7
6.1.2 Privacy risk assessment.7
6.1.3 Privacy risk treatment .8
6.2 Privacy objectives and planning to achieve them .9
6.3 Planning of changes .10
7 Support .10
7.1 Resources .10
7.2 Competence .10
7.3 Awareness .10
7.4 Communication .10
7.5 Documented information .11
7.5.1 General .11
7.5.2 Creating and updating documented information .11
7.5.3 Control of documented information .11
8 Operation .12
8.1 Operational planning and control . 12
8.2 Privacy risk assessment . 12
8.3 Privacy risk treatment. 12
9 Performance evaluation .12
9.1 Monitoring, measurement, analysis and evaluation . . 12
9.2 Internal audit . 13
9.2.1 General . 13
9.2.2 Internal audit programme . 13
9.3 Management review . 13
9.3.1 General . 13
9.3.2 Management review inputs . 13
9.3.3 Management review results .14
10 Improvement . 14
10.1 Continual improvement .14
10.2 Nonconformity and corrective action .14
11 Further information on annexes . 14
Annex A (normative) PIMS reference control objectives and controls for PII controllers and PII
processors .15

© ISO/IEC 2025 – All rights reserved
iii
Annex B (normative) Implementation guidance for PII controllers and PII processors .21
Annex C (informative) Mapping to ISO/IEC 29100 . 51
Annex D (informative) Mapping to the General Data Protection Regulation .53
Annex E (informative) Mapping to ISO/IEC 27018 and ISO/IEC 29151 .56
Annex F (informative) Correspondence with ISO/IEC 27701:2019 .58
Bibliography .64

© ISO/IEC 2025 – All rights reserved
iv
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations,
governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/
IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
ISO and
...

© ISO/IEC 2024 – All rights reserved
Date: 2025-04-17
ISO/IEC JTC1/SC 27/WG 5 N9999
Date: 2024-12-95
ISO/IEC DIS FDIS 27701.2:2024:2025(en)
ISO/IEC JTC1/SC 27/WG 5
Secretariat: DIN
Information security, cybersecurity and privacy protection — Privacy information
management systems — Requirements and guidance
Sécurité de l'information, cybersécurité et protection de la vie privée — Systèmes de
management de la protection de la vie privée – Exigences et lignes directrices
Document type: International Standard
Document subtype:
Document stage: (30) Committee
Document language: E
C:\Users\Alan Shipman\Documents\Alan's Documents\ISO\JTC1SC27\27552\SHIPMAN\ISO-IEC_27552_(E)
WD2 V5.4.doc STD Version 2.1c2

ISO/IEC DIS 27701.2:2024(en)
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no
part of this publication may be reproduced or utilized otherwise in any form or by any means,
electronic or mechanical, including photocopying, or posting on the internet or an intranet, without
prior written permission. Permission can be requested from either ISO at the address below or
ISO's member body in the country of the requester.
ISO Copyright Office
CP 401 • CH-1214 Vernier, Geneva
Phone: + 41 22 749 01 11
Email: [e-mail]
Website: www.iso.org
Published in Switzerland.
© ISO/IEC 2024 – All rights reserved
ii
ISO/IEC DISFDIS 27701.2:2024:2025(en)
Contents Page
Foreword . viiiviii
Introduction . ixix
1 Scope . 11
2 Normative references . 11
3 Terms, definitions and abbreviations . 11
4 Context of the organization . 55
4.1 Understanding the organization and its context . 55
4.2 Understanding the needs and expectations of interested parties .6
4.3 Determining the scope of the privacy information management system . 77
4.4 Privacy information management system . 77
5 Leadership . 77
5.1 Leadership and commitment . 77
5.2 Privacy policy . 88
5.3 Roles, responsibilities and authorities . 88
6 Planning . 88
6.1 Actions to address risks and opportunities . 88
6.1.1 General . 88
6.1.2 Privacy risk assessment . 99
6.1.3 Privacy risk treatment . 99
6.2 Privacy objectives and planning to achieve them . 11
6.3 Planning of changes . 12
7 Support . 12
7.1 Resources . 12
7.2 Competence . 12
7.3 Awareness . 12
7.4 Communication . 12
7.5 Documented information . 13
7.5.1 General . 13
7.5.2 Creating and updating documented information . 13
7.5.3 Control of documented information . 13
8 Operation . 14
8.1 Operational planning and control . 14
8.2 Privacy risk assessment . 14
8.3 Privacy risk treatment . 14
9 Performance evaluation . 15
9.1 Monitoring, measurement, analysis and evaluation . 15
9.2 Internal audit . 15
9.2.1 General . 15
9.2.2 Internal audit programme . 15
9.3 Management review . 16
9.3.1 General . 16
© ISO/IEC 2024 – All rights reserved
iii
© ISO/IEC 2025 – All rights reserved
iii
ISO/IEC DIS 27701.2:2024(en)
9.3.2 Management review inputs . 16
9.3.3 Management review results . 16
10 Improvement . 16
10.1 Continual improvement . 16
10.2 Nonconformity and corrective action . 16
11 Further information on annexes . 1717
Annex A (normative) PIMS reference control objectives and controls for PII controllers and
PII processors . 18
Annex B (normative) Implementation guidance for PII controllers and PII processors . 26
B.1 Implementation guidance for PII controllers . 26
B.1.1 General . 26
B.1.2 Conditions for collection and processing . 26
B.1.2.1 Objective . 26
B.1.2.2 Identify and document purpose . 26
B.1.2.3 Identify lawful basis . 26
B.1.2.4 Determine when and how consent is to be obtained . 27
B.1.2.5 Obtain and record consent . 27
B.1.2.6 Privacy impact assessment . 28
B.1.2.7 Contracts with PII processors . 28
B.1.2.8 Joint PII controller . 29
B.1.2.9 Records related to processing PII . 30
B.1.3 Obligations to PII principals . 31
B.1.3.1 Objective . 31
B.1.3.2 Determining and fulfilling obligations to PII principals . 31
B.1.3.3 Determining information for PII principals . 31
B.1.3.4 Providing information to PII principals . 32
B.1.3.5 Providing mechanism to modify or withdraw consent . 32
B.1.3.6 Providing mechanism to object to PII processing . 33
B.1.3.7 Access, correction or erasure . 33
B.1.3.8 PII controllers' obligations to inform third parties . 34
B.1.3.9 Providing copy of PII processed. 34
B.1.3.10 . Handling
requests . 35
B.1.3.11 . Automated decision
making. 35
B.1.4 Privacy by design and privacy by default . 35
B.1.4.1 Objective . 35
B.1.4.2 Limit collection . 35
© ISO/IEC 2024 – All rights reserved
iv
ISO/IEC DISFDIS 27701.2:2024:2025(en)
B.1.4.3 Limit processing . 36
B.1.4.4 Accuracy and quality . 36
B.1.4.5 PII minimization objectives . 36
B.1.4.6 PII de-identification and deletion at the end of processing . 37
B.1.4.7 Temporary files . 37
B.1.4.8 Retention .
...