ISO 27701 Checklist

Use this ISO 27701 Audit Checklist to assess PIMS compliance, PII controller and processor controls, for an internal audit and gap analysis preparing ISO 27701 certification.

Download as free PDF

Library
ISO Standards
ISO 27701 Checklist

ISO 27701 Checklist

Clause 4 — Context Of The Organization

1. Internal and external issues relevant to the organisation's purpose and that affect its ability to achieve the intended outcomes of its Privacy Information Management System (PIMS) are identified and documented, including climate-related risks where relevant to PII processing infrastructure or service providers.

Photo Comment

Clause 5 — Leadership

Clause 6 — Planning

5. Privacy Impact Assessments (PIAs) or Data Protection Impact Assessments (DPIAs) are conducted for processing activities presenting a high risk to data subjects, including activities involving automated decision-making, AI-related processing, biometric data, health data, or IoT-generated PII.

Photo Comment

8. A Statement of Applicability (SoA) is documented, listing applicable Annex A controls (Tables A.1, A.2, and A.3) with justifications for inclusions and exclusions based on the organisation's role as controller, processor, or both, and the results of the privacy risk assessment.

Photo Comment

Clause 7 — Support

Clause 8 — Operation

Clause 9 — Performance Evaluation

1. The organisation has determined what to monitor and measure for PIMS performance, including privacy risk treatment effectiveness, data subject rights request volumes and outcomes, incident trends, and privacy-specific KPIs aligned to the objectives set under Clause 6.

Photo Comment

Clause 10 — Improvement

Annex A.1 — PII Controller Controls (Table A.1)

Annex A.2 — PII Processor Controls (Table A.2)

Annex A.3 — Shared Information Security Controls (Table A.3)

Checklist by GoAudits.com – Please note that this checklist is intended as an example. We do not guarantee compliance with the laws applicable to your territory or industry. You should seek professional advice to determine how this checklist should be adapted to your workplace or jurisdiction.

Is this sample what you are looking for?
Sign up to use & customize this template, or create your own custom checklist.

NEW! Try generating a custom checklist with our free AI tool:

Easy inspection app for your digital checklists

Conduct inspections anytime, anywhere - even offline
Capture photos as proof of compliance or areas needing attention
Instantly generate and share detailed reports after the inspections
Assign & track follow-up tasks, view historical trends on a centralized dashboard

ISO 27701 Checklist

Use this ISO 27701 Audit Checklist to assess PIMS compliance, PII controller and processor controls, for an internal audit and gap analysis preparing ISO 27701 certification.

2. Internal issues are reviewed and include organisational structure, existing privacy practices, workforce capability, technology systems used to process PII, and existing information security maturity.

3. External issues are reviewed and include applicable privacy laws and regulations, regulatory expectations, market requirements for personal data handling, and geopolitical factors affecting cross-border data transfers.

4. Interested parties relevant to the PIMS are identified, including data subjects, regulators, customers, business partners, third-party processors, and employees.

5. The requirements and expectations of each interested party are documented and reviewed at defined intervals, including any contractual, regulatory, or voluntary privacy obligations.

6. The PIMS scope is documented, defining which PII processing activities, systems, business units, and geographic locations are included.

7. Any PII processing activities excluded from scope are listed with documented justification.

8. The organisation has documented its role as a PII controller, PII processor, or both, and this determination is reflected in the PIMS scope and Annex A control selection.

9. The PIMS scope is available to relevant interested parties.

10. A record of processing activities (RoPA) or equivalent PII processing inventory is maintained, current, and aligned with the documented scope.

11. The processing inventory identifies the categories of PII processed, the purposes of processing, the legal basis, data subjects affected, retention periods, and any cross-border transfers for each activity.

1. Top management has demonstrated commitment to the PIMS through documented resource allocation, governance approvals, and active participation in privacy governance.

2. A privacy policy is documented and approved by top management.

3. The privacy policy includes a commitment to protecting PII in accordance with applicable privacy requirements and to continually improving the PIMS.

4. The privacy policy provides a framework for setting and reviewing privacy objectives.

5. The privacy policy is communicated to all personnel involved in PII processing activities.

6. The privacy policy is made available to data subjects and other relevant external parties in an accessible format.

7. PIMS roles, responsibilities, and authorities are documented and assigned, including accountability for data protection, privacy risk management, and compliance.

8. A Data Protection Officer (DPO) or equivalent privacy lead has been appointed where required by applicable regulation or organisational policy, with sufficient authority and independence.

9. Responsibility for ensuring PIMS conformity and reporting PIMS performance to top management is formally assigned.

10. Evidence that PIMS responsibilities have been communicated to relevant personnel is available.

1. The organisation has established a documented process for identifying and assessing risks to the privacy rights of data subjects arising from PII processing activities.

2. Privacy risk assessments have been completed for all PII processing activities within scope, using a systematic methodology covering risk identification, analysis, and evaluation.

3. Risk assessments are reviewed and updated when processing activities, systems, technologies, or legal obligations change significantly.

4. A privacy risk register is maintained with risk owners, assessed risk levels, and treatment status for each identified risk.

5. Privacy Impact Assessments (PIAs) or Data Protection Impact Assessments (DPIAs) are conducted for processing activities presenting a high risk to data subjects, including activities involving automated decision-making, AI-related processing, biometric data, health data, or IoT-generated PII.

6. DPIA results are retained and used to inform control selection and processing decisions.

7. Risk treatment options have been selected for each identified privacy risk, with documented rationale for the controls chosen.

8. A Statement of Applicability (SoA) is documented, listing applicable Annex A controls (Tables A.1, A.2, and A.3) with justifications for inclusions and exclusions based on the organisation's role as controller, processor, or both, and the results of the privacy risk assessment.

9. A risk treatment plan is documented with assigned owners and target completion dates.

10. Privacy objectives are established, documented, measurable, and consistent with the privacy policy, with privacy-specific KPIs defined to ensure measurability.

11. Plans to achieve privacy objectives include assigned responsibilities, required resources, timelines, and methods for evaluating results.

12. A change management process is in place for planned changes to PII processing activities, systems, or third-party arrangements that could affect PIMS conformity.

1. Resources required to establish, implement, maintain, and continually improve the PIMS are identified and provided.

2. Competence requirements are defined for all roles that affect PII processing, privacy governance, or PIMS performance, including privacy support roles.

3. Evidence of competence is available for personnel in PIMS roles, including training records, qualifications, and assessed performance.

4. Privacy awareness training is conducted for all personnel who process PII or have access to systems containing PII, including awareness of AI-related processing obligations where applicable.

5. Training records are maintained and evidence that training effectiveness has been evaluated is available.

6. Personnel are aware of the privacy policy, the risks relevant to their role, and the consequences of failing to comply with privacy requirements.

7. Internal and external communication requirements for the PIMS are documented, specifying who communicates what, to whom, and through which channel.

8. A document control procedure is in place covering creation, approval, version control, access management, and retention of PIMS documented information.

9. PIMS documents are properly identified, described, and protected from unauthorised changes or accidental deletion.

10. Retention requirements for PIMS documented information are defined and applied.

1. Operational procedures are documented for all PII processing activities within scope, including collection, storage, use, transfer, and disposal.

2. Criteria for controlling PII processing activities are established and consistently applied.

3. Evidence that PII processing activities are executed according to documented procedures is available.

4. Privacy risk assessments are performed before new PII processing activities are initiated or existing activities are substantially changed, including activities involving new technologies such as AI, biometrics, IoT, or health data processing.

5. Consent management procedures are in place where consent is used as the legal basis for processing, including records of consent obtained, withdrawn, and refreshed.

6. Procedures for handling data subject rights requests are documented and cover access, rectification, erasure, restriction, portability, and objection.

7. Data subject rights requests are acknowledged and fulfilled within the timeframes required by applicable privacy regulation.

8. Records of data subject rights requests and their outcomes are maintained.

9. Data breach and privacy incident response procedures are documented, covering detection, containment, notification to regulators, and notification to affected data subjects.

10. Privacy incidents are recorded, investigated, and used to drive corrective action and PIMS improvement.

11. Data minimisation controls are in place to ensure only PII necessary for the stated processing purpose is collected and retained.

12. Retention schedules are defined and enforced for all categories of PII, including secure disposal procedures when retention periods expire.

13. Cross-border transfer controls are in place where PII is transferred to third countries, including documented transfer mechanisms, data localisation requirements, and assessments of adequacy.

14. Operational controls address AI-related processing risks, including automated decision-making, profiling, and the use of AI systems that process PII, with human oversight mechanisms defined where required.

1. The organisation has determined what to monitor and measure for PIMS performance, including privacy risk treatment effectiveness, data subject rights request volumes and outcomes, incident trends, and privacy-specific KPIs aligned to the objectives set under Clause 6.

2. Methods, frequency, and responsibility for monitoring and measurement are documented.

3. Monitoring results are analysed, evaluated, and reported to relevant management at defined intervals.

4. Privacy metrics are tracked over time and used to assess whether privacy objectives are being achieved.

5. An internal audit programme for the PIMS is documented, covering audit scope, criteria, frequency, and auditor selection, structured to reflect the four control themes of the 2025 edition: Organisational, People, Physical, and Technological.

6. Auditor independence from the areas being audited is ensured and documented.

7. At least one complete internal PIMS audit cycle has been completed before the certification audit.

8. Internal audit reports document findings, evidence reviewed, conformities, and nonconformities.

9. Audit findings are communicated to relevant management and tracked to closure.

10. Management reviews of the PIMS are conducted at planned intervals by top management.

11. Management review inputs include PIMS performance data, audit results, privacy risk register status, privacy objective progress, data subject complaint volumes, status of corrective actions, and changes in applicable privacy laws or regulations.

12. Management review outputs include decisions on improvement opportunities, resource needs, and any required changes to the PIMS.

13. Management review minutes are retained as documented evidence.

1. A process for identifying, recording, and managing nonconformities is documented.

2. Nonconformities, including privacy control failures, data breaches, and data subject complaints, are recorded when they occur.

3. Root cause analysis is performed for each nonconformity to identify the underlying cause rather than the symptom.

4. Corrective actions are planned with assigned owners and target completion dates.

5. Corrective actions are verified for effectiveness before the nonconformity is closed.

6. Records of nonconformities, corrective actions, and closure evidence are retained.

7. Lessons learned from privacy incidents and nonconformities are used to update risk assessments, controls, and processing procedures.

8. Evidence of continual improvement of the PIMS is available, demonstrating that privacy controls, risk management practices, and PII protection outcomes improve over time.

1. A lawful basis for processing has been identified and documented for each PII processing activity, including the specific legal basis applied (consent, contract, legal obligation, legitimate interests, or other applicable basis).