ISO 27701

ISO 27001 is focused on establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It provides a framework for managing security risks and protecting information assets.

ISO 27701 provides guidelines for establishing a Privacy Information Management System (PIMS), focusing on managing personal data privacy. ISO 27701 aims to enhance the data privacy controls within an ISMS and support compliance with global privacy regulations.

ISO 27001 is not a legal requirement, but it is widely recognised as a best practice for information security management.

Organisations choose ISO 27001 certification to show their commitment to information security, build trust with clients, and meet contractual or regulatory obligations.

While not mandatory, achieving ISO 27001 can help organisations implement robust security measures and can be crucial for accessing certain markets or industries where strong data protection is essential.

ISO 27701 provides guidelines for establishing a privacy information management system (PIMS), while GDPR is a legal framework within the European Union that mandates how personal data must be handled.

ISO 27701 sets out best practices for managing privacy and data protection risks, complementing existing data protection laws like GDPR.

While ISO 27701 offers a structured approach to helping businesses achieve compliance, GDPR imposes legal obligations with specific penalties for non-compliance.

Implementing ISO 27701 can benefit organisations of all sizes and industries, especially those that handle personal data, including staff data. Companies in sectors such as healthcare, finance, and e-commerce, where data privacy is critical, will find ISO 27701 particularly useful.

By adhering to ISO 27701, organisations can enhance their data protection practices, help businesses comply with privacy regulations, build trust with customers and stakeholders, and mitigate the risks associated with data breaches.

The specific documents required will depend on your organisation’s context and risk assessment.

Typical documents used to help organisations achieve ISO 27701 certification include the following:

• Scope of the Privacy Information Management System (PIMS)
• Privacy risk assessment and treatment process
• Privacy policy
• Records of training and awareness programs
• Documented roles and responsibilities
• Records of data processing activities
• Third-party privacy agreements
• Records of incidents or breaches

These documents help to verify that the organisation has a comprehensive approach to managing personal data privacy and can demonstrate compliance with privacy regulations.

ISO 27701 doesn’t prescribe specific data classification categories, so organisations must establish their own classification methodology. Four common data classification categories typically include:

• Public – Information that can be freely shared with the public without any adverse consequences.
• Internal – Data meant for use within the organisation only.
• Confidential – Data that requires protection due to its sensitive nature, and access to which is restricted to authorised personnel.
• Restricted – Highly sensitive information that requires the highest level of security and access control to prevent unauthorised disclosure.