7.3 Awareness
Persons doing work under the organization's control shall be aware of the privacy policy, of their contribution to the effectiveness of the privacy information management system including the benefits of improved privacy performance, and of the implications of not conforming with the PIMS requirements. The implications the first edition spelled out are carried into the guidance: consequences to the organization, to the person, and to the PII principal of breaching privacy rules, and awareness of how to report an incident involving PII.
Source: ISO/IEC 27701:2025, 7.3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27701:2025 in the compliance library.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence personnel know the consequences of non-conformity and how to report a PII incident · Document repository
- Awareness checks such as survey or test results · HR system / LMS
governing documentDocuments that govern the control
- Awareness communications and their reach across everyone who handles PII · HR system / LMS
First move
Common gaps auditors find
- Awareness limited to annual e-learning that never mentions PII principals or the reporting route
- Contractors and temporary staff outside the awareness programme
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet