5.5.5 Documented information
The documented information requirements of ISO/IEC 27001 apply to the PIMS across creation, updating and control, so privacy records fall under the same identification, approval, availability, protection and retention di
3
artefacts
1
held by a system
1
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Document register covering privacy records such as processing inventories, consent records and transfer logs · SIEM / log platform
periodic reviewEvidence produced at each review
- Creation, update and approval route applied to those records · Document repository
governing documentDocuments that govern the control
- Access, retention and disposition rules applied to them · Policy repository / GRC workspace
First move
Start with the 1 of 3 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Privacy records held outside document control, most often consent evidence in a marketing system
- Retention rules applied to documents but not to the personal data inside them
- Records of external origin such as processor contracts left uncontrolled
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.5.4 Communication · 5.6.1 Operational planning and control