ISO/IEC 27701:2025·Annex A A.3.12·critical·Component: Security considerations

What this control requires

Respond to incidents related to PII according to documented procedures. Implementation: Implement response steps, notification templates and forensic logging. Justification: Proper response includes notification, mitigation and recordkeeping.
— ISO/IEC 27701:2025, Annex A A.3.12

In plain English

Respond to incidents related to PII according to documented procedures. In practice, this means you can prove you implement response to incidents-level controls on a defined cadence.

Why it matters

ISO 27701 is the international way to evidence the GDPR principle of accountability: certified PIMS controls translate directly into the records, contracts and rights-handling that supervisory authorities want, and into the privacy-engineering evidence SOC 2 + Privacy auditors and enterprise procurement teams ask for.

This control is rated critical in the source catalogue. Treat gaps here as production incidents in the risk register, not housekeeping.

What an auditor looks for

PIMS auditors expect ISO 27001 to be implemented first and then the 27701-additional controls tested. For PII controllers they look at lawful-basis and rights-handling evidence; for PII processors they look at customer-instructions, sub-processor controls and return/transfer/disposal evidence.

Within Security considerations, the assessor will trace your implementation back to the catalogue reference (Annex A A.3.12) and look for objective evidence on the latest two assessment cycles.

How to implement

Incident Response

Runbook. Maintain a runbook keyed by incident type with named roles (IC, comms, scribe), an out-of-band comms channel, and a 72-hour timeline for external notification.

Tabletop. Run a quarterly tabletop exercise (ransomware, insider, supply-chain) and feed gaps back into the runbook.

Operational checklist

  • Implement. Document the trigger, the owner and the cadence.
  • Document. Document the trigger, the owner and the cadence.
  • Log. Document the trigger, the owner and the cadence.
  • Scope: response to incidents.

Evidence to collect

  • Ticketing Workflow. ticketing_workflow evidence
  • Policy Document. A signed and version-controlled policy / standard / procedure document.

Signed policies, procedures, and registers document the safeguard. Service management or request-handling tickets prove timely handling. Focus: Response to incidents.

Common pitfalls

  • Runbooks that name a role but no person, or list a paging channel that no longer exists.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

Related controls in ISO/IEC 27701:2025

References

Topics: incident responsedata protectionevent alert