6.1.2 Privacy risk assessment
The organization shall set and apply a privacy risk assessment process that: sets and keeps up privacy risk criteria, covering both when a risk is acceptable and when assessments are carried out; makes sure that assessments repeated over time give results that are consistent, valid and can be compared; identifies the privacy risks arising from PII processing inside the PIMS scope, covering risks to the organization and risks to PII principals, and names who owns each risk; analyses each risk by weighing its possible consequences and how likely it realistically is, and fixing its level; and evaluates the risks by setting the analysis against the criteria and ranking them for treatment. Where the organization also carries out an information security risk assessment, it shall manage the link between information security and PII protection throughout. The organization shall keep documented information on the process. The first edition's twin assessment, security risk plus privacy risk inside an ISMS, becomes a standalone privacy risk assessment; the transition documents note that the guidance leans on ISO/IEC 27557.
Source: ISO/IEC 27701:2025, 6.1.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27701:2025 in the compliance library.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Analysis showing consequence, likelihood and level per risk · Document repository
- Evidence of consistency between repeated assessments · Document repository
governing documentDocuments that govern the control
- Privacy risk assessment methodology with criteria, acceptance levels and assessment triggers · Policy repository / GRC workspace
- Risk register identifying risks to PII principals separately from risks to the organization, with owners · Policy repository / GRC workspace
First move
Common gaps auditors find
- Risk register that holds security risks only, with no risk to individuals recorded
- Consequence assessed for the organization alone, ignoring harm to PII principals
- Risk owners unassigned, so treatment is nobody's decision
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet