A.3.12 Response to information security incidents

For a PII controller, any incident touching PII shall prompt an assessment of whether a PII breach calling for action has happened; a mere event does not by itself prompt that assessment. Where a breach is established, the organization's reply shall include the required notices and records. Jurisdictions set the conditions for informing the supervisory authority and the PII principals. The organization shall keep a record detailed enough to support regulatory or forensic reporting, covering: what happened; over what period; the effects; who reported it and to whom; the steps taken to resolve it and any data restored; whether PII became unavailable, was lost, disclosed or changed; which PII was affected; and the notices sent. For a PII processor, the customer contract shall address: how breaches are notified; how the organization will give the customer what it needs to inform authorities; that breaches for which the customer or the PII principal is to blame, or which arise in parts of the system those parties are responsible for, are excluded; and the anticipated and legally imposed deadlines for notification. Some jurisdictions oblige a processor to tell the controller promptly, and some oblige it to inform a regulator directly.

Source: ISO/IEC 27701:2025, A.3.12. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27701:2025 in the compliance library.