5.34 Privacy and protection of PII
The organization is to identify, and then satisfy, the requirements for preserving privacy and protecting personally identifiable information that arise from applicable laws, regulations and contracts. Purpose: comply with the legal, regulatory and contractual requirements concerning the security aspects of PII protection. Guidance: set a topic-specific policy covering privacy and the protection of PII and communicate it to relevant parties; develop and implement privacy and PII protection procedures and make them known to everyone involved in processing PII. Meeting these procedures and the relevant laws requires suitable roles, responsibilities and controls, usually best achieved by appointing someone such as a privacy officer who guides staff, service providers and others on their individual responsibilities and the procedures to follow. Responsibility for handling PII is assigned with regard to the relevant laws, and appropriate technical and organizational measures are put in place to protect it. Other information: many countries regulate how PII is gathered, processed, sent and erased, may impose duties on those who collect and share it, and may restrict transfers abroad; ISO/IEC 29100 gives a high-level framework, ISO/IEC 27701 covers privacy information management, ISO/IEC 27018 covers public cloud PII processors, and ISO/IEC 29134 gives guidance on privacy impact assessment for identifying and reducing privacy risks.
Source: ISO/IEC 27002:2022, 5.34. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- A record of processing or PII inventory mapping which laws apply to each processing activity · Data governance / DLP tooling
- Privacy impact assessments for high-risk processing and the resulting mitigations · Data governance / DLP tooling
- Evidence of technical and organizational measures protecting PII, such as access restrictions, encryption and cross-border transfer safeguards · Data governance / DLP tooling
governing documentDocuments that govern the control
- The topic-specific privacy and PII protection policy and its communication to relevant parties · Policy repository / GRC workspace
- Privacy procedures communicated to everyone who processes PII · Policy repository / GRC workspace
- Appointment of a privacy officer or equivalent with documented responsibilities · Policy repository / GRC workspace
First move
Common gaps auditors find
- Privacy is treated as a legal matter only, with no link to security controls
- No one is formally responsible for guiding staff and providers on PII handling
- Cross-border transfers of PII occur without checking applicable restrictions
- Privacy impact assessments are not performed for new processing
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.33 Protection of records · 5.35 Independent review of information security