ISO/IEC 27701:2025: the evidence behind each requirement

108 requirements. For each, the artefacts auditors commonly ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

Context of the organization

4.1Understanding the organization and its context moderate 4.2Understanding the needs and expectations of interested parties hard 4.3Determining the scope of the privacy information management system hard 4.4Privacy information management system hard

Leadership

5.1Leadership and commitment hard 5.2Privacy policy hard 5.3Roles, responsibilities and authorities hard

Planning

6.1.1General hard 6.1.2Privacy risk assessment hard 6.1.3Privacy risk treatment hard 6.2Privacy objectives and planning to achieve them hard 6.3Planning of changes moderate

Support

7.1Resources hard 7.2Competence hard 7.3Awareness hard 7.4Communication hard 7.5.1General hard 7.5.2Creating and updating documented information hard 7.5.3Control of documented information hard

Operation

8.1Operational planning and control hard 8.2Privacy risk assessment hard 8.3Privacy risk treatment hard

Performance evaluation

9.1Monitoring, measurement, analysis and evaluation hard 9.2.1General hard 9.2.2Internal audit programme hard 9.3.1General hard 9.3.2Management review inputs hard 9.3.3Management review results easy

Improvement

10.1Continual improvement hard 10.2Nonconformity and corrective action hard

Annex A Table A.1 PIMS controls for PII controllers

A.1.2.2Identify and document purpose hard A.1.2.3Identify lawful basis hard A.1.2.4Determine when and how consent is to be obtained hard A.1.2.5Obtain and record consent hard A.1.2.6Privacy impact assessment hard A.1.2.7Contracts with PII processors hard A.1.2.8Joint PII controller hard A.1.2.9Records related to processing PII hard A.1.3.2Determining and fulfilling obligations to PII principals hard A.1.3.3Determining information for PII principals hard A.1.3.4Providing information to PII principals hard A.1.3.5Providing mechanism to modify or withdraw consent hard A.1.3.6Providing mechanism to object to PII processing hard A.1.3.7Access, correction or erasure hard A.1.3.8PII controllers' obligations to inform third parties hard A.1.3.9Providing copy of PII processed moderate A.1.3.10Handling requests hard A.1.3.11Automated decision making hard A.1.4.2Limit collection hard A.1.4.3Limit processing hard A.1.4.4Accuracy and quality hard A.1.4.5PII minimization objectives hard A.1.4.6PII de-identification and deletion at the end of processing hard A.1.4.7Temporary files moderate A.1.4.8Retention hard A.1.4.9Disposal hard A.1.4.10PII transmission controls moderate A.1.5.2Identify basis for PII transfer between jurisdictions moderate A.1.5.3Countries and international organizations to which PII can be transferred hard A.1.5.4Records of transfer of PII moderate A.1.5.5Records of PII disclosures to third parties easy

Annex A Table A.2 PIMS controls for PII processors

A.2.2.2Customer agreement hard A.2.2.3Organization’s purposes hard A.2.2.4Marketing and advertising use hard A.2.2.5Infringing instruction hard A.2.2.6Customer obligations hard A.2.2.7Records related to processing PII hard A.2.3.2Comply with obligations to PII principals hard A.2.4.2Temporary files hard A.2.4.3Return, transfer or disposal of PII hard A.2.4.4PII transmission controls hard A.2.5.2Basis for PII transfer between jurisdictions hard A.2.5.3Countries and international organizations to which PII can be transferred hard A.2.5.4Records of PII disclosures to third parties easy A.2.5.5Notification of PII disclosure requests hard A.2.5.6Legally binding PII disclosures moderate A.2.5.7Disclosure of subcontractors used to process PII hard A.2.5.8Engagement of a subcontractor to process PII hard A.2.5.9Change of subcontractor to process PII hard

Annex A Table A.3 information security controls with PII-specific guidance

A.3.3Policies for information security hard A.3.4Information security roles and responsibilities hard A.3.5Classification of information hard A.3.6Labelling of information hard A.3.7Information transfer easy A.3.8Identity management hard A.3.9Access rights hard A.3.10Addressing information security within supplier agreements hard A.3.11Information security incident management planning and preparation hard A.3.12Response to information security incidents hard A.3.13Legal, statutory, regulatory and contractual requirements hard A.3.14Protection of records hard A.3.15Independent review of information security hard A.3.16Compliance with policies, rules and standards for information security easy A.3.17Information security awareness, education and training hard A.3.18Confidentiality or non-disclosure agreements hard A.3.19Clear desk and clear screen hard A.3.20Storage media moderate A.3.21Secure disposal or re-use of equipment hard A.3.22User endpoint devices hard A.3.23Secure authentication moderate A.3.24Information backup easy A.3.25Logging hard A.3.26Use of cryptography hard A.3.27Secure development life cycle moderate A.3.28Application security requirements moderate A.3.29Secure system architecture and engineering principles hard A.3.30Outsourced development hard A.3.31Test information moderate