With recent attention being paid to data privacy concerns, you may be considering ISO 27701 certification. If so, you’ve come to the right place! We’ll explain what ISO 27701 is, how it relates to ISO 27001, and how to get started on the ISO 27701 certification journey.
ISO 27701 is a branch standard that stems from the ISO 27001 standard, which focuses on the Information Security Management System (ISMS). The ISO 27701 standard is a great addition to the ISMS and key for any organization looking to create a strong integration between security and privacy controls.
The ISO 27701 standard also supports other compliance frameworks like GDPR and SOC 2.
In summary, ISO 27001 addresses the organization’s information security controls and ISO 27701 addresses the organization’s privacy controls.
The controls that make up the Privacy Information Management System (PIMS) relate to the way an organization collects personal data and prevents unauthorized use or disclosure. The controls are listed in Annex A of the ISO 27001 standard, which is 114 security controls. ISO 27701 then expands on the clauses of ISO 27001 and the controls in Annex A that relate specifically to data privacy. It also provides two additional sets of controls, specific to data controllers and data processors. Annex A will be used for data controllers and Annex B will be used for data processors.
The ISMS and PIMS work side by side, so the organization must first achieve compliance with ISO 27001 before it can address its privacy requirements. It is recommended that organizations first start to implement controls from the ISO 27001 standard and then expand from there to include the controls specific to ISO 27701. To comply with ISO 27701, the organization must design, build and implement a PIMS in accordance with both the ISO 27701 standard and relevant national and international regulations, such as the GDPR.
ISO 27701 is ideal for any organization that wants to show its stakeholders and the industry they operate in, that they are serious about protecting their consumer’s personal information.
These benefits are as follows, but are not limited to:
The ISO 27701 certification cost is generally calculated by the number of employees in the organization and the number of days the audit will take. The cost will also be dependent on whether the organization is a data controller or a data processor. Organizations can reduce these costs when they use compliance automation software, like Scytale.
In today’s ever-growing technology and connected world, organizations generate massive volumes of customer data each day. It is important to understand that organizations need robust data processes and effective controls in place. Implementing the ISO 27701 PIMS will allow the organization to demonstrate accountability for managing PII, instill trust, build strong business relationships with various stakeholders, and more importantly, build trust with their existing and future customers.
