It’s essential that, before implementing a PIMS, organisations obtain a clear picture of what their specific privacy protection/PII objectives are, at all levels of their information security operation.
Risk assessment should be a key element of all organisation-wide privacy protection protocols, including an understanding of how to assess and analyse risks, and ‘risk treatment’ – the process of modifying risk through a series of technical measures.
ISO 27701 5.4 deals with the steps organisations need to take when planning a PIMS or privacy protection policy.
ISO 27701 5.4 draws on guidance from ISO 27001 6.1 (Actions to address risks and opportunities), and contains further guidance across four main sub-clauses:
Two sub-clauses (5.4.1.2 and 5.4.1.3) both contain guidance that relates directly to Article 32 of GDPR, more specifically, sections (1)(b), (2).
Please note that GDPR citations are for indicative purposes only. Organisations should scrutinise the legislation and make their own judgement on what parts of the law applies to them.
In general terms, organisations need to adopt a risk-specific approach to planning a PIMS that:
When drafting a plan, organisations need to:
The guidance contained within ISO 27701 5.4.1.1 is closely linked to an organisation’s ability to understand its requirements, and the expectations of internal and external staff and PII subjects whose data the organisation holds.
Organisations should map out and implement a privacy protection risk assessment process that:
Organisations should focus risk assessment activities that not only address information security, but complement the implementation of a PIMS, and to the processing and storage of PII.
Organisations should keep in mind the consequences not just for the company itself, but for any PII principals, should and issues occur.
Organisations should draft and implement a privacy protection/PII ‘risk treatment process’ that:
Organisational privacy protection objectives should:
Throughout the planning process, organisations need to establish the following:
| ISO 27701 Clause Identifier | ISO 27701 Clause Name | ISO 27001 Requirement | Associated GDPR Articles |
|---|---|---|---|
| 5.4.1.1 | General | 6.1.1 – General Aspects in Planning Around Risk for ISO 27001 | None |
| 5.4.1.2 | Information Security Risk Assessment | 6.1.2 – Information Security Risk Assessment for ISO 27001 | Article (32) |
| 5.4.1.3 | Information Security Risk Treatment | 6.1.3 – Information Security Risk Treatment for ISO 27001 | Article (32) |
| 5.4.2 | Information Security Objectives and Planning to Achieve Them | 6.2 – Information Security Objectives and Planning to Achieve Them for ISO 27001 | None |
You must create a Privacy Information Management System (PIMS) in order to meet ISO 27701. With our prebuilt Privacy Information Management System (PIMS), you can quickly and efficiently organise and handle customer, supplier, and employee information to satisfy ISO 27701 requirements.
Privacy assessments can be set up and run with ease, ranging from data protection impact assessments to regulatory or compliance readiness ones.
See our full range of features by booking a demo.
Book a tailored hands-on session
based on your needs and goals
Book your demo
