ISO/IEC 27701

ISO/IEC 27701
Standard	ISO/IEC 27701
Title	Privacy Information Management — Extension to ISO/IEC 27001 and ISO/IEC 27002
Status	Published
Published	2019
Organizations	ISO; IEC; JTC 1; SC 27
Domain	Information security; Privacy; Data protection

ISO/IEC 27701

ISO/IEC 27701 is an international extension standard providing guidance for Privacy Information Management Systems (PIMS) that augments information security management frameworks; it was published by International Organization for Standardization and International Electrotechnical Commission and developed within JTC 1 Subcommittee 27. The standard maps privacy-specific requirements to existing controls from ISO/IEC 27001 and ISO/IEC 27002 and has been referenced by regulators and industry bodies such as European Commission, UK Information Commissioner's Office, National Institute of Standards and Technology, and APEC. It serves as a bridge between compliance regimes like the General Data Protection Regulation and industry practices advocated by organizations including International Association of Privacy Professionals and IEEE.

Overview

ISO/IEC 27701 defines requirements and guidance for establishing, implementing, maintaining, and continually improving a PIMS aligned with an information security management system such as ISO/IEC 27001, and it is intended for organizations acting as data controllers or data processors under instruments like the General Data Protection Regulation and laws such as the California Consumer Privacy Act. The development process involved technical committees and working groups with contributors from standards bodies including British Standards Institution, Association Française de Normalisation, Deutsches Institut für Normung, and national delegations from countries such as United States, France, Germany, India, and Japan. The publication attracted attention from multinational corporations, professional firms like PricewaterhouseCoopers, Deloitte, KPMG, and Ernst & Young, and privacy advocacy organizations including Electronic Frontier Foundation and Privacy International.

Scope and Structure

The scope covers extension requirements to an existing ISO/IEC 27001 management system enabling privacy controls for personally identifiable information and metadata, applicable to controllers and processors in sectors represented by bodies like International Chamber of Commerce, World Health Organization, Financial Stability Board, and International Air Transport Association. Structurally, the standard provides normative requirements and informative guidance organized around control objectives, roles, and lifecycle processes familiar to members of Internet Engineering Task Force, World Wide Web Consortium, and Organisation for Economic Co-operation and Development committees. Annexes map to legal frameworks such as the European Convention on Human Rights protections and procedural architectures referenced by Council of Europe instruments and national supervisory authorities such as CNIL and Data Protection Commission (Ireland).

Relationship to ISO/IEC 27001 and 27002

ISO/IEC 27701 is explicitly an extension to recognized information security standards and complements the risk-based approach of ISO/IEC 27001 while aligning control guidance with the code of practice in ISO/IEC 27002. It interoperates with sector-specific standards and frameworks used by organizations like Payment Card Industry Security Standards Council, Health Level Seven International, International Organization for Standardization Technical Committee 292, and standards referenced by European Banking Authority. The mapping facilitates integration with governance, risk, and compliance tools used by enterprises such as SAP, Oracle, Microsoft, and consulting frameworks from Gartner and Forrester Research.

Requirements and Controls

The standard specifies additional PIMS requirements including privacy policy, information lifecycle management, data subject rights, consent management, and processor agreements, which are operationalized through controls analogous to those in ISO/IEC 27002 and influenced by best practices from NIST Special Publication 800-53, COBIT, and ITIL. Controls address topics relevant to sectors represented by World Trade Organization, United Nations, International Monetary Fund, and World Bank stakeholders, and reference implementation considerations used by technology providers such as AWS, Google Cloud, IBM, and Cisco. The controls distinguish obligations for controllers and processors and include guidance for breach notification aligned with precedents set by regulators like European Data Protection Board and national authorities in Canada, Australia, and Brazil.

Implementation and Certification

Organizations typically adopt ISO/IEC 27701 by extending an existing ISO/IEC 27001 certified management system, engaging accredited certification bodies such as International Accreditation Forum signatories and national accreditation bodies like United Kingdom Accreditation Service and Deutsche Akkreditierungsstelle. Implementation often involves stakeholders including chief privacy officers from firms like Facebook, Apple, Amazon, and Twitter as well as legal teams versed in statutes such as the Health Insurance Portability and Accountability Act and judicial interpretations from courts like the Court of Justice of the European Union. Certification execution follows auditing practices developed by auditing standard setters including International Auditing and Assurance Standards Board and training programs run by ISACA and IAPP.

Privacy Information Management Principles and Roles

ISO/IEC 27701 codifies principles such as lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability—concepts central to instruments like the General Data Protection Regulation, OECD Privacy Guidelines, and national acts such as the Data Protection Act 2018 (UK). The standard defines roles and responsibilities for data protection officers, controllers, and processors similar to functions found in corporate governance frameworks from entities like OECD, World Economic Forum, and International Finance Corporation. It also addresses cross-border data transfer mechanisms referenced in agreements like the EU-US Privacy Shield framework history and contractual mechanisms used in Standard Contractual Clauses.

Adoption, Impact, and Criticism

Adoption has been broad among multinational firms, financial institutions, healthcare providers, and technology companies that participate in consortia such as Global Privacy Assembly and International Telecommunications Union studies; standard proponents include national authorities like Information Commissioner's Office (UK) and business groups such as BusinessEurope. Impact assessments point to improved alignment with regulatory requirements and vendor risk management practices promoted by Basel Committee on Banking Supervision and Financial Action Task Force, while critics from advocacy groups like Electronic Frontier Foundation and some privacy academics affiliated with Harvard University, Stanford University, and University of Oxford argue the standard may encourage checkbox compliance, lacks prescriptive enforcement mechanisms, and requires interpretation alongside legal obligations exemplified by rulings from the European Court of Human Rights and Court of Justice of the European Union.

Category:Information privacy standards