What evidence do auditors commonly ask for on A.1.4.5 PII minimization objectives?

Documented minimisation objectives, expressed measurably; Description of the mechanisms and techniques used, including technical configurations; Justification where processing requires data that is not de-identified; Assessment of the residual re-identification risk of the techniques chosen; Evidence the mechanisms operate on a timely basis rather than on request.

What is the most common gap auditors find on A.1.4.5?

Minimisation objectives stated as principles with no measure, so achievement cannot be shown

ISO/IEC 27701:2025 · Annex A Table A.1 PIMS controls for PII controllers

`A.1.4.5` PII minimization objectives

The organization must set and document objectives for minimising data, and the mechanisms that achieve them. It must show how both the particular data items and the volume gathered and handled are kept in proportion to the identified purposes. Where a purpose truly needs data that has not been de-identified, it must describe that processing; where it does not, it must document how far the data needs to stay linked to the individual and which mechanisms and techniques, generalisation or randomisation for example, are meant to deliver the de-identification or minimisation objectives promptly.

Source: ISO/IEC 27701:2025, A.1.4.5. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27701:2025 in the compliance library.

artefacts

held by a system

at each review

hard

to go live

Document repository

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

Assessment of the residual re-identification risk of the techniques chosen · Document repository
Evidence the mechanisms operate on a timely basis rather than on request · Document repository

governing documentDocuments that govern the control

Documented minimisation objectives, expressed measurably · Policy repository / GRC workspace
Description of the mechanisms and techniques used, including technical configurations · Document repository
Justification where processing requires data that is not de-identified · Document repository

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

Minimisation objectives stated as principles with no measure, so achievement cannot be shown
De-identification claimed on the basis of removing direct identifiers alone, leaving a readily re-identifiable dataset
Technique chosen without assessing whether it withstands linkage against other holdings
Objectives defined and the mechanisms never implemented, so nothing changes in practice
Timeliness unaddressed, so identifiable data persists long after de-identification became possible

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

A.1.4.4 Accuracy and quality · A.1.4.6 PII de-identification and deletion at the end of processing