# ISO/IEC 27701 A.1.2.2 — Identify and document purpose

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_iso27701_a122_1a5b017c14-isoiec-27701-a122-identify-and-document-purpose
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [ISO/IEC 27701 (Privacy Information Management)](https://support.icompaas.com/support/solutions/c_gen_iso27701) › [Conditions for collection and processing](https://support.icompaas.com/support/solutions/folders/f_gen_cgeniso27701_conditionsforcollectionandprocessing)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

ISO/IEC 27701 · Control A.1.2.2 · Priority: high · Component: Conditions for collection and processing

### What this control covers

The organization shall identify and document the specific purposes for which the PII will be processed. Implementation: Document purposes clearly; include in notices and records (purpose registry). Justification: Demonstrates clarity of processing purpose to PII principals; required for consent and lawful basis.

### Why it matters

Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation.

### How to implement

#### AWS

Codify the policy intent as **SCPs, AWS Config conformance packs, and Security Hub standards** so the cloud enforces what the document says.

#### Azure

Codify in **Azure Policy initiatives** (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level.

#### GCP

Use **Cloud KMS** with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. **Sensitive Data Protection** (DLP API) inspects/de-identifies PII at scale.

#### Google Workspace

Enable **client-side encryption** for Drive/Docs and turn on **Drive Labels + DLP** rules to prevent external sharing of regulated data classes.

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policies, procedures, and registers document the safeguard. Focus: Identify and document purpose.

### Quick checklist

-   Identify And Document — Identify And Document Purpose
-   Implement — Identify And Document Purpose
-   Document — Identify And Document Purpose

### Related articles on this site

-   [NIST 800-171 3.1.9 Provide privacy and security notices consistent with applicable CUI rules.](https://support.icompaas.com/support/solutions/articles/62000229233-nist-800-171-3-1-9-provide-privacy-and-security-notices-consistent-with-applicable-cui-rules-)
-   [NIST 800-171 3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.](https://support.icompaas.com/support/solutions/articles/62000229302-nist-800-171-3-6-2-track-document-and-report-incidents-to-designated-officials-and-or-authorities-b)
-   [CMMC 2.0 AC.2.005 Provide privacy and security notices consistent with applicable CUI rules.](https://support.icompaas.com/support/solutions/articles/62000229394-cmmc-2-0-ac-2-005-provide-privacy-and-security-notices-consistent-with-applicable-cui-rules-)
-   [Ensure CloudWatch Log Groups Have a Retention Policy of Specific Days](https://support.icompaas.com/support/solutions/articles/62000233418-ensure-cloudwatch-log-groups-have-a-retention-policy-of-specific-days)