oSIST prEN ISO/IEC 27701:2024

Information security, cybersecurity and privacy protection - Privacy information management systems - Requirements and guidance (ISO/IEC DIS 27701:2024)

This document specifies requirements for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS).
Guidance is provided to assist in the implementation of the controls in this document.
This document is intended for PII controllers and PII processors holding responsibility and accountability for PII processing.
This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations.

Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre - Datenschutz-Informationsmanagementsysteme - Anforderungen und Leitlinien (ISO/IEC DIS 27701:2024)

Dieses Dokument legt Anforderungen für die Einrichtung, Umsetzung, Aufrechterhaltung und fortlaufende Verbesserung eines Managementsystems für Datenschutzinformationen (PIMS) fest.
Es wird eine Anleitung bereitgestellt, um die Umsetzung der Anforderungen in diesem Dokument zu unterstützen.
Dieses Dokument ist für verantwortliche Stellen und Auftragsverarbeiter gedacht, die für die Verarbeitung von personenbezogenen Daten verantwortlich und rechenschaftspflichtig sind.
Dieses Dokument ist für alle Arten und Größen von Organisationen, einschließlich öffentlicher und privater Unternehmen, öffentlicher Stellen und gemeinnütziger Organisationen anwendbar.

Titre manque

Le présent document spécifie les exigences et fournit des recommandations pour la création, la mise en œuvre, le maintien et l'amélioration continue d'un système de management de la protection de la vie privée (PIMS) sous la forme d'une extension de l'ISO/IEC 27001 et l'ISO/IEC 27002 pour le management de la protection de la vie privée dans le contexte de l'organisation.
Le présent document spécifie les exigences liées au PIMS et fournit des recommandations destinées aux responsables de traitement de DCP et aux sous-traitants de DCP chargés de et responsables du traitement des DCP.
Le présent document s'applique aux organisations de tous types et de toutes tailles, y compris les entreprises publiques et privées, les entités gouvernementales et les organisations à but non lucratif, qui sont des responsables de traitement de DCP et/ou des sous-traitants de DCP qui traitent les DCP à l'aide d'un SMSI.

Informacijska varnost, kibernetska varnost in varovanje zasebnosti - Sistem upravljanje informacij o zasebnosti - Zahteve in smernice (ISO/IEC DIS 27701:2024)

General Information

• Status: Not Published
• Public Enquiry End Date: 09-Sep-2024
• ICS: 35.030 - IT Security
• Technical Committee: ITC - Information technology
• Current Stage: 4020 - Public enquire (PE) (Adopted Project)
• Start Date: 10-Jul-2024
• Due Date: 27-Nov-2024
• Ref Project: prEN ISO/IEC 27701 - Information security, cybersecurity and privacy protection - Privacy information management systems - Requirements and guidance (ISO/IEC DIS 27701:2024)

Relations

• Revises: SIST EN ISO/IEC 27701:2021 - Security techniques - Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management - Requirements and guidelines (ISO/IEC 27701:2019)
• Effective Date: 19-Jun-2024

Standards Content (Sample)

SLOVENSKI STANDARD
01-september-2024
Informacijska varnost, kibernetska varnost in varovanje zasebnosti - Sistem
upravljanje informacij o zasebnosti - Zahteve in smernice (ISO/IEC DIS 27701:2024)
Information security, cybersecurity and privacy protection - Privacy information
management systems - Requirements and guidance (ISO/IEC DIS 27701:2024)
Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre - Datenschutz-
Informationsmanagementsysteme - Anforderungen und Leitlinien (ISO/IEC DIS
27701:2024)
Titre manque
Ta slovenski standard je istoveten z: prEN ISO/IEC 27701
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

DRAFT
International
Standard
ISO/IEC
DIS
27701.2
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection — Privacy
Voting begins on:
information management systems
2024-07-02
— Requirements and guidance
Voting terminates on:
ICS: 35.030
2024-08-27
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENTS AND APPROVAL. IT
IS THEREFORE SUBJECT TO CHANGE
AND MAY NOT BE REFERRED TO AS AN
INTERNATIONAL STANDARD UNTIL
PUBLISHED AS SUCH.
This document is circulated as received from the committee secretariat.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
STANDARDS MAY ON OCCASION HAVE TO
ISO/CEN PARALLEL PROCESSING
BE CONSIDERED IN THE LIGHT OF THEIR
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
NATIONAL REGULATIONS.
IMPORTANT — Please use this updated version dated 2024-06-19, and
RECIPIENTS OF THIS DRAFT ARE INVITED
TO SUBMIT, WITH THEIR COMMENTS,
discard any previous version of this DIS as VA relation has been added.
NOTIFICATION OF ANY RELEVANT PATENT
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION.
Reference number
© ISO/IEC 2024
ISO/IEC DIS 27701.2:2024(en)
DRAFT
ISO/IEC DIS 27701.2:2024(en)
International
Standard
ISO/IEC
DIS
27701.2
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection — Privacy
Voting begins on:
information management systems
2024-07-02
— Requirements and guidance
Voting terminates on:
ICS: 35.030 2024-08-27
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENTS AND APPROVAL. IT
IS THEREFORE SUBJECT TO CHANGE
AND MAY NOT BE REFERRED TO AS AN
INTERNATIONAL STANDARD UNTIL
PUBLISHED AS SUCH.
This document is circulated as received from the committee secretariat.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
© ISO/IEC 2024
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
STANDARDS MAY ON OCCASION HAVE TO
ISO/CEN PARALLEL PROCESSING
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
BE CONSIDERED IN THE LIGHT OF THEIR
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
or ISO’s member body in the country of the requester.
NATIONAL REGULATIONS.
ISO copyright office
RECIPIENTS OF THIS DRAFT ARE INVITED
CP 401 • Ch. de Blandonnet 8
TO SUBMIT, WITH THEIR COMMENTS,
CH-1214 Vernier, Geneva
NOTIFICATION OF ANY RELEVANT PATENT
Phone: [phone]
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION.
Email: [e-mail]
Website: www.iso.org
Published in Switzerland Reference number
© ISO/IEC 2024
ISO/IEC DIS 27701.2:2024(en)
© ISO/IEC 2024 – All rights reserved
ii
ISO/IEC DIS 27701.2:2024(en)
Contents Page
Foreword . viii
Introduction . ix
1 Scope . 1
2 Normative references . 1
3 Terms, definitions and abbreviations . 1
4 Context of the organization . 5
4.1 Understanding the organization and its context . 5
4.2 Understanding the needs and expectations of interested parties . 5
4.3 Determining the scope of the privacy information management system . 6
4.4 Privacy information management system . 6
5 Leadership . 7
5.1 Leadership and commitment . 7
5.2 Privacy Policy . 7
5.3 Roles, responsibilities and authorities . 7
6 Planning . 8
6.1 Actions to address risks and opportunities . 8
6.1.1 General . 8
6.1.2 Privacy risk assessment . 8
6.1.3 Privacy risk treatment . 9
6.2 Privacy objectives and planning to achieve them . 10
6.3 Planning of changes . 10
7 Support . 10
7.1 Resources . 10
7.2 Competence . 10
7.3 Awareness . 11
7.4 Communication . 11
7.5 Documented information . 11
7.5.1 General . 11
7.5.2 Creating and updating documented information . 11
7.5.3 Control of documented information . 12
8 Operation . 12
8.1 Operational planning and control . 12
8.2 Privacy risk assessment . 12
8.3 Privacy risk treatment . 13
9 Performance evaluation . 13
9.1 Monitoring, measurement, analysis and evaluation . 13
9.2 Internal audit . 13
9.2.1 General . 13
9.2.2 Internal audit programme . 13
9.3 Management review . 14
9.3.1 General . 14
9.3.2 Management review inputs . 14
© ISO/IEC 2024 – All rights reserved
iii
ISO/IEC DIS 27701.2:2024(en)
9.3.3 Management review results . 14
10 Improvement . 14
10.1 Continual improvement . 14
10.2 Nonconformity and corrective action . 14
11 Further information on Annexes . 15
Annex A (normative) PIMS reference control objectives and controls for PII Controllers and
PII Processors . 16
Annex B (normative) Implementation guidance for PII Controllers and PII processors . 23
B.1 Implementation guidance for PII controllers . 23
B.1.1 General . 23
B.1.2 Conditions for collection and processing . 23
B.1.2.1 Objective . 23
B.1.2.2 Identify and document purpose . 23
B.1.2.3 Identify lawful basis . 23
B.1.2.4 Determine when and how consent is to be obtained . 24
B.1.2.5 Obtain and record consent . 24
B.1.2.6 Privacy impact assessment . 25
B.1.2.7 Contracts with PII processors . 25
B.1.2.8 Joint PII controller . 26
B.1.2.9 Records related to processing PII . 26
B.1.3 Obligations to PII principals . 27
B.1.3.1 Objective . 27
B.1.3.2 Determining and fulfilling obligations to PII principals . 27
B.1.3.3 Determining information for PII principals . 27
B.1.3.4 Providing information to PII principals . 28
B.1.3.5 Providing mechanism to modify or withdraw consent .
...