# ISO/IEC 27701 A.2.2.3 — Organization's purposes

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_iso27701_a223_234fca2515-isoiec-27701-a223-organizations-purposes
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [ISO/IEC 27701 (Privacy Information Management)](https://support.icompaas.com/support/solutions/c_gen_iso27701) › [Conditions for collection and processing (processors)](https://support.icompaas.com/support/solutions/folders/f_gen_cgeniso27701_conditionsforcollectionandprocessingproce)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

ISO/IEC 27701 · Control A.2.2.3 · Priority: high · Component: Conditions for collection and processing (processors)

### What this control covers

Ensure PII processed on behalf of customer are only for purposes expressed in customer's instructions. Implementation: Process design to accept documented instructions; verifiability for customer. Justification: Prevents unauthorized use of customer PII.

### Why it matters

Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation.

### How to implement

#### AWS

Codify the policy intent as **SCPs, AWS Config conformance packs, and Security Hub standards** so the cloud enforces what the document says.

#### Azure

Codify in **Azure Policy initiatives** (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level.

#### GCP

Use **Cloud KMS** with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. **Sensitive Data Protection** (DLP API) inspects/de-identifies PII at scale.

#### Google Workspace

Enable **client-side encryption** for Drive/Docs and turn on **Drive Labels + DLP** rules to prevent external sharing of regulated data classes.

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.
-   `vendor_risk_management` — See the iCompaas Evidence library for the canonical source for this evidence type.

Signed policies, procedures, and registers document the safeguard. Processor due diligence, contracts, and disclosure registers evidence third-party controls. Focus: Organization's purposes.

### Quick checklist

-   Implement — Organization'S Purposes
-   Document — Organization'S Purposes
-   Ensure — Organization'S Purposes

### Related articles on this site

-   [Ensure IAM policies are attached only to groups or roles](https://support.icompaas.com/support/solutions/articles/62000081037-ensure-iam-policies-are-attached-only-to-groups-or-roles)
-   [Ensure a log metric filter and alarm exist for Management Console sign-in without MFA](https://support.icompaas.com/support/solutions/articles/62000083605-ensure-a-log-metric-filter-and-alarm-exist-for-management-console-sign-in-without-mfa)
-   [Ensure rotation for customer created CMKs is enabled](https://support.icompaas.com/support/solutions/articles/62000083984-ensure-rotation-for-customer-created-cmks-is-enabled)
-   [Ensure a log metric filter and alarm exist for AWS Management Console Authentication failures](https://support.icompaas.com/support/solutions/articles/62000084023-ensure-a-log-metric-filter-and-alarm-exist-for-aws-management-console-authentication-failures)