# Privacy Policy - Source: https://support.icompaas.com/compliance/policy-docs/privacy-policy - Section: [Compliance](https://support.icompaas.com/compliance) › [Policy Documents](https://support.icompaas.com/compliance/policy-docs) › All policy documents - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Policy Document**·36 mapped controls ## What this policy is The customer- / data-subject-facing statement of how personal data is collected, used, shared, retained, and protected — covering lawful basis, data-subject rights, and contact for privacy inquiries. ## Why every organization needs one Privacy laws (GDPR, CCPA, DPDP) require a published privacy notice as a baseline obligation. This is also the document customer counsel reads before signing a DPA. ## What a competent Privacy Policy typically contains - Purpose and scope - Roles and responsibilities - Definitions - Categories of personal data collected - Purposes and lawful basis per category - Data-subject rights + how to exercise them - Retention + cross-border transfer disclosures - Review cadence (typically annual) and version control - Approval, sign-off and effective date ## How iCompaas tracks this policy The icompaas policy-doc producer manages this document through an 8-state lifecycle: `draft` → `generated` → `internal_qa` → `customer_review` → `in_review` → `approved` → `signed` (with `rejected` as a terminal side-state). The producer publishes a `policy_doc_privacy_policy_signed` compliance finding once at least one document of this kind reaches the `signed` state for the account being assessed; the finding then rolls up into every compliance framework that references this policy (see the table below). ## Compliance frameworks that reference this policy The icompaas [compliance controls library](https://support.icompaas.com/compliance) links every policy document to the controls in each framework that require, evidence, or otherwise rely on it. Below: every control across every framework in the iCompaas catalogue that names this policy as part of its evidence base. Each control links to its own dedicated page with auditor-view content + implementation guidance. | Framework | Control | Title | Component | | --- | --- | --- | --- | | ISO/IEC 27001:2022 | [A.5.34](https://support.icompaas.com/compliance/iso-27001-2022/a-5-34-privacy-and-protection-of-personal-identifiable-information-pii) | [Privacy and protection of personal identifiable information (PII)](https://support.icompaas.com/compliance/iso-27001-2022/a-5-34-privacy-and-protection-of-personal-identifiable-information-pii) | Organizational controls | | ISO/IEC 27701:2025 | [A.1.2.2](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-2-identify-and-document-purpose) | [Identify and document purpose](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-2-identify-and-document-purpose) | Conditions for collection and processing | | ISO/IEC 27701:2025 | [A.1.2.3](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-3-identify-lawful-basis) | [Identify lawful basis](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-3-identify-lawful-basis) | Conditions for collection and processing | | ISO/IEC 27701:2025 | [A.1.2.4](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-4-determine-when-how-consent-obtained) | [Determine when/how consent obtained](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-4-determine-when-how-consent-obtained) | Conditions for collection and processing | | ISO/IEC 27701:2025 | [A.1.2.5](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-5-obtain-record-consent) | [Obtain & record consent](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-5-obtain-record-consent) | Conditions for collection and processing | | ISO/IEC 27701:2025 | [A.1.2.7](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-7-contracts-with-pii-processors) | [Contracts with PII processors](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-7-contracts-with-pii-processors) | Conditions for collection and processing | | ISO/IEC 27701:2025 | [A.1.2.9](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-9-records-related-to-processing-pii) | [Records related to processing PII](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-9-records-related-to-processing-pii) | Conditions for collection and processing | | ISO/IEC 27701:2025 | [A.1.3.3](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-3-information-for-pii-principals) | [Information for PII principals](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-3-information-for-pii-principals) | Obligations to PII principals | | ISO/IEC 27701:2025 | [A.1.3.4](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-4-providing-info-to-pii-principals) | [Providing info to PII principals](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-4-providing-info-to-pii-principals) | Obligations to PII principals | | ISO/IEC 27701:2025 | [A.1.3.5](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-5-modify-withdraw-consent) | [Modify/withdraw consent](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-5-modify-withdraw-consent) | Obligations to PII principals | | ISO/IEC 27701:2025 | [A.1.3.6](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-6-mechanism-to-object) | [Mechanism to object](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-6-mechanism-to-object) | Obligations to PII principals | | ISO/IEC 27701:2025 | [A.1.3.7](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-7-access-correction-erasure) | [Access / correction / erasure](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-7-access-correction-erasure) | Obligations to PII principals | | ISO/IEC 27701:2025 | [A.1.3.10](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-10-handling-requests) | [Handling requests](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-10-handling-requests) | Obligations to PII principals | | ISO/IEC 27701:2025 | [A.1.4.4](https://support.icompaas.com/compliance/iso-27701-2025/a-1-4-4-accuracy-quality) | [Accuracy & quality](https://support.icompaas.com/compliance/iso-27701-2025/a-1-4-4-accuracy-quality) | Privacy by design / default | | ISO/IEC 27701:2025 | [A.1.4.5](https://support.icompaas.com/compliance/iso-27701-2025/a-1-4-5-pii-minimization-objectives) | [PII minimization objectives](https://support.icompaas.com/compliance/iso-27701-2025/a-1-4-5-pii-minimization-objectives) | Privacy by design / default | | ISO/IEC 27701:2025 | [A.1.4.10](https://support.icompaas.com/compliance/iso-27701-2025/a-1-4-10-pii-transmission-controls) | [PII transmission controls](https://support.icompaas.com/compliance/iso-27701-2025/a-1-4-10-pii-transmission-controls) | Privacy by design / default | | ISO/IEC 27701:2025 | [A.1.5.3](https://support.icompaas.com/compliance/iso-27701-2025/a-1-5-3-countries-to-which-pii-transferred) | [Countries to which PII transferred](https://support.icompaas.com/compliance/iso-27701-2025/a-1-5-3-countries-to-which-pii-transferred) | PII sharing, transfer & disclosure | | ISO/IEC 27701:2025 | [A.1.5.5](https://support.icompaas.com/compliance/iso-27701-2025/a-1-5-5-records-of-disclosures) | [Records of disclosures](https://support.icompaas.com/compliance/iso-27701-2025/a-1-5-5-records-of-disclosures) | PII sharing, transfer & disclosure | | ISO/IEC 27701:2025 | [A.2.2.3](https://support.icompaas.com/compliance/iso-27701-2025/a-2-2-3-organization-s-purposes) | [Organization's purposes](https://support.icompaas.com/compliance/iso-27701-2025/a-2-2-3-organization-s-purposes) | Conditions for collection and processing (processors) | | ISO/IEC 27701:2025 | [A.2.2.4](https://support.icompaas.com/compliance/iso-27701-2025/a-2-2-4-marketing-advertising-use) | [Marketing & advertising use](https://support.icompaas.com/compliance/iso-27701-2025/a-2-2-4-marketing-advertising-use) | Conditions for collection and processing (processors) | | ISO/IEC 27701:2025 | [A.2.4.4](https://support.icompaas.com/compliance/iso-27701-2025/a-2-4-4-pii-transmission-controls) | [PII transmission controls](https://support.icompaas.com/compliance/iso-27701-2025/a-2-4-4-pii-transmission-controls) | Privacy by design / default (processors) | | ISO/IEC 27701:2025 | [A.2.5.3](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-3-countries-to-which-pii-transferred) | [Countries to which PII transferred](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-3-countries-to-which-pii-transferred) | PII sharing, transfer & disclosure (processors) | | ISO/IEC 27701:2025 | [A.2.5.4](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-4-records-of-pii-disclosures) | [Records of PII disclosures](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-4-records-of-pii-disclosures) | PII sharing, transfer & disclosure (processors) | | ISO/IEC 27701:2025 | [A.2.5.5](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-5-notification-of-requests) | [Notification of requests](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-5-notification-of-requests) | PII sharing, transfer & disclosure (processors) | | ISO/IEC 27701:2025 | [A.2.5.7](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-7-disclosure-of-subcontractors) | [Disclosure of subcontractors](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-7-disclosure-of-subcontractors) | PII sharing, transfer & disclosure (processors) | | ISO/IEC 27701:2025 | [A.3.3](https://support.icompaas.com/compliance/iso-27701-2025/a-3-3-information-security-policies) | [Information security policies](https://support.icompaas.com/compliance/iso-27701-2025/a-3-3-information-security-policies) | Security considerations (controllers/processors) | | ISO/IEC 27701:2025 | [A.3.7](https://support.icompaas.com/compliance/iso-27701-2025/a-3-7-information-transfer) | [Information transfer](https://support.icompaas.com/compliance/iso-27701-2025/a-3-7-information-transfer) | Security considerations | | ISO/IEC 27701:2025 | [A.3.9](https://support.icompaas.com/compliance/iso-27701-2025/a-3-9-access-rights) | [Access rights](https://support.icompaas.com/compliance/iso-27701-2025/a-3-9-access-rights) | Security considerations | | ISO/IEC 27701:2025 | [A.3.14](https://support.icompaas.com/compliance/iso-27701-2025/a-3-14-protection-of-records) | [Protection of records](https://support.icompaas.com/compliance/iso-27701-2025/a-3-14-protection-of-records) | Security considerations | | ISO/IEC 27701:2025 | [A.3.22](https://support.icompaas.com/compliance/iso-27701-2025/a-3-22-user-endpoint-devices) | [User endpoint devices](https://support.icompaas.com/compliance/iso-27701-2025/a-3-22-user-endpoint-devices) | Security considerations | | ISO/IEC 27701:2025 | [A.3.24](https://support.icompaas.com/compliance/iso-27701-2025/a-3-24-information-backup) | [Information backup](https://support.icompaas.com/compliance/iso-27701-2025/a-3-24-information-backup) | Security considerations | | ISO/IEC 27701:2025 | [A.3.25](https://support.icompaas.com/compliance/iso-27701-2025/a-3-25-logging) | [Logging](https://support.icompaas.com/compliance/iso-27701-2025/a-3-25-logging) | Security considerations | | ISO/IEC 27701:2025 | [A.3.26](https://support.icompaas.com/compliance/iso-27701-2025/a-3-26-use-of-cryptography) | [Use of cryptography](https://support.icompaas.com/compliance/iso-27701-2025/a-3-26-use-of-cryptography) | Security considerations | | ISO/IEC 27701:2025 | [A.3.29](https://support.icompaas.com/compliance/iso-27701-2025/a-3-29-secure-system-architecture) | [Secure system architecture](https://support.icompaas.com/compliance/iso-27701-2025/a-3-29-secure-system-architecture) | Security considerations | | ISO/IEC 27701:2025 | [A.3.30](https://support.icompaas.com/compliance/iso-27701-2025/a-3-30-outsourced-development) | [Outsourced development](https://support.icompaas.com/compliance/iso-27701-2025/a-3-30-outsourced-development) | Security considerations | | ISO/IEC 27701:2025 | [A.3.31](https://support.icompaas.com/compliance/iso-27701-2025/a-3-31-test-information) | [Test information](https://support.icompaas.com/compliance/iso-27701-2025/a-3-31-test-information) | Security considerations | 36 controls across 2 frameworks reference this policy. ## About this page This article is part of the iCompaas [Policy Documents](https://support.icompaas.com/compliance/policy-docs) library — one page per signed-document type the icompaas policy-doc producer tracks for customer accounts. The article is intentionally framework-agnostic: a customer signing a policy of this kind gets the same regulatory benefit across every framework that references it. ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): SOC 2 auditors test that policies like this one exist, are approved, and are reviewed on schedule; the guide lists the full set. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 clause 5.2 and Annex A.5.1 require a documented, approved policy set; the guide shows how it fits the ISMS.