ISO/IEC 27701:2025 PIMS Controls

ISO/IEC 27701:2025 PIMS Controls

• ISO/IEC 27701:2025 A.3.4 — Information security roles & responsibilities
• ISO/IEC 27701:2025 A.3.5 — Classification of information
• ISO/IEC 27701:2025 A.3.6 — Labelling of information
• ISO/IEC 27701:2025 A.3.7 — Information transfer
• ISO/IEC 27701:2025 A.3.8 — Identity management

ISO/IEC 27701:2025 PIMS Controls

• ISO/IEC 27701:2025 A.1.3.2 — Comply with obligations
• ISO/IEC 27701:2025 A.1.3.3 — Information for PII principals
• ISO/IEC 27701:2025 A.1.3.4 — Providing info to PII principals
• ISO/IEC 27701:2025 A.1.3.5 — Modify/withdraw consent
• ISO/IEC 27701:2025 A.1.3.6 — Mechanism to object

ISO/IEC 27701:2025 PIMS Controls

• ISO/IEC 27701:2025 A.1.4.2 — Limit collection
• ISO/IEC 27701:2025 A.1.4.3 — Limit processing
• ISO/IEC 27701:2025 A.1.4.4 — Accuracy & quality
• ISO/IEC 27701:2025 A.1.4.5 — PII minimization objectives
• ISO/IEC 27701:2025 A.1.4.6 — De-identification / deletion

ISO/IEC 27701:2025 PIMS Controls

• ISO/IEC 27701:2025 A.1.2.2 — Identify and document purpose
• ISO/IEC 27701:2025 A.1.2.3 — Identify lawful basis
• ISO/IEC 27701:2025 A.1.2.4 — Determine when/how consent obtained
• ISO/IEC 27701:2025 A.1.2.5 — Obtain & record consent
• ISO/IEC 27701:2025 A.1.2.6 — Privacy impact assessment

ISO/IEC 27701:2025 PIMS Controls

• ISO/IEC 27701:2025 A.2.5.2 — Basis for transfer
• ISO/IEC 27701:2025 A.2.5.3 — Countries to which PII transferred
• ISO/IEC 27701:2025 A.2.5.4 — Records of PII disclosures
• ISO/IEC 27701:2025 A.2.5.5 — Notification of requests
• ISO/IEC 27701:2025 A.2.5.6 — Legally binding disclosures

ISO/IEC 27701:2025 PIMS Controls

• ISO/IEC 27701:2025 A.2.2.2 — Customer agreement
• ISO/IEC 27701:2025 A.2.2.3 — Organization's purposes
• ISO/IEC 27701:2025 A.2.2.4 — Marketing & advertising use
• ISO/IEC 27701:2025 A.2.2.5 — Infringing instruction
• ISO/IEC 27701:2025 A.2.2.6 — Customer obligations

ISO/IEC 27701:2025 PIMS Controls

• ISO/IEC 27701:2025 A.1.5.2 — Basis for transfer
• ISO/IEC 27701:2025 A.1.5.3 — Countries to which PII transferred
• ISO/IEC 27701:2025 A.1.5.4 — Records of transfer
• ISO/IEC 27701:2025 A.1.5.5 — Records of disclosures

ISO/IEC 27701:2025 PIMS Controls

• ISO/IEC 27701:2025 A.2.4.2 — Temporary files disposal
• ISO/IEC 27701:2025 A.2.4.3 — Return/transfer/disposal
• ISO/IEC 27701:2025 A.2.4.4 — PII transmission controls

ISO/IEC 27701:2025 PIMS Controls

• ISO/IEC 27701:2025 A.2.3.2 — Comply with obligations

ISO/IEC 27701:2025 PIMS Controls

• ISO/IEC 27701:2025 A.3.3 — Information security policies