ISO 27701 Checklist

Internal and external issues relevant to the organisation's purpose and that affect its ability to achieve the intended outcomes of its Privacy Information Management System (PIMS) are identified and documented, including climate-related risks where relevant to PII processing infrastructure or service providers.

Internal issues are reviewed and include organisational structure, existing privacy practices, workforce capability, technology systems used to process PII, and existing information security maturity.

External issues are reviewed and include applicable privacy laws and regulations, regulatory expectations, market requirements for personal data handling, and geopolitical factors affecting cross-border data transfers.

Interested parties relevant to the PIMS are identified, including data subjects, regulators, customers, business partners, third-party processors, and employees.

The requirements and expectations of each interested party are documented and reviewed at defined intervals, including any contractual, regulatory, or voluntary privacy obligations.

The PIMS scope is documented, defining which PII processing activities, systems, business units, and geographic locations are included.

Any PII processing activities excluded from scope are listed with documented justification.

The organisation has documented its role as a PII controller, PII processor, or both, and this determination is reflected in the PIMS scope and Annex A control selection.

The PIMS scope is available to relevant interested parties.

A record of processing activities (RoPA) or equivalent PII processing inventory is maintained, current, and aligned with the documented scope.

The processing inventory identifies the categories of PII processed, the purposes of processing, the legal basis, data subjects affected, retention periods, and any cross-border transfers for each activity.

Top management has demonstrated commitment to the PIMS through documented resource allocation, governance approvals, and active participation in privacy governance.

A privacy policy is documented and approved by top management.

The privacy policy includes a commitment to protecting PII in accordance with applicable privacy requirements and to continually improving the PIMS.

The privacy policy provides a framework for setting and reviewing privacy objectives.

The privacy policy is communicated to all personnel involved in PII processing activities.

The privacy policy is made available to data subjects and other relevant external parties in an accessible format.

PIMS roles, responsibilities, and authorities are documented and assigned, including accountability for data protection, privacy risk management, and compliance.

A Data Protection Officer (DPO) or equivalent privacy lead has been appointed where required by applicable regulation or organisational policy, with sufficient authority and independence.

Responsibility for ensuring PIMS conformity and reporting PIMS performance to top management is formally assigned.

Evidence that PIMS responsibilities have been communicated to relevant personnel is available.

The organisation has established a documented process for identifying and assessing risks to the privacy rights of data subjects arising from PII processing activities.

Privacy risk assessments have been completed for all PII processing activities within scope, using a systematic methodology covering risk identification, analysis, and evaluation.

Risk assessments are reviewed and updated when processing activities, systems, technologies, or legal obligations change significantly.

A privacy risk register is maintained with risk owners, assessed risk levels, and treatment status for each identified risk.

Privacy Impact Assessments (PIAs) or Data Protection Impact Assessments (DPIAs) are conducted for processing activities presenting a high risk to data subjects, including activities involving automated decision-making, AI-related processing, biometric data, health data, or IoT-generated PII.

DPIA results are retained and used to inform control selection and processing decisions.

Risk treatment options have been selected for each identified privacy risk, with documented rationale for the controls chosen.

A Statement of Applicability (SoA) is documented, listing applicable Annex A controls (Tables A.1, A.2, and A.3) with justifications for inclusions and exclusions based on the organisation's role as controller, processor, or both, and the results of the privacy risk assessment.

A risk treatment plan is documented with assigned owners and target completion dates.

Privacy objectives are established, documented, measurable, and consistent with the privacy policy, with privacy-specific KPIs defined to ensure measurability.

Plans to achieve privacy objectives include assigned responsibilities, required resources, timelines, and methods for evaluating results.

A change management process is in place for planned changes to PII processing activities, systems, or third-party arrangements that could affect PIMS conformity.

Resources required to establish, implement, maintain, and continually improve the PIMS are identified and provided.

Competence requirements are defined for all roles that affect PII processing, privacy governance, or PIMS performance, including privacy support roles.

Evidence of competence is available for personnel in PIMS roles, including training records, qualifications, and assessed performance.

Privacy awareness training is conducted for all personnel who process PII or have access to systems containing PII, including awareness of AI-related processing obligations where applicable.

Training records are maintained and evidence that training effectiveness has been evaluated is available.

Personnel are aware of the privacy policy, the risks relevant to their role, and the consequences of failing to comply with privacy requirements.

Internal and external communication requirements for the PIMS are documented, specifying who communicates what, to whom, and through which channel.

A document control procedure is in place covering creation, approval, version control, access management, and retention of PIMS documented information.

PIMS documents are properly identified, described, and protected from unauthorised changes or accidental deletion.

Retention requirements for PIMS documented information are defined and applied.

Operational procedures are documented for all PII processing activities within scope, including collection, storage, use, transfer, and disposal.

Criteria for controlling PII processing activities are established and consistently applied.

Evidence that PII processing activities are executed according to documented procedures is available.

Privacy risk assessments are performed before new PII processing activities are initiated or existing activities are substantially changed, including activities involving new technologies such as AI, biometrics, IoT, or health data processing.

Consent management procedures are in place where consent is used as the legal basis for processing, including records of consent obtained, withdrawn, and refreshed.

Procedures for handling data subject rights requests are documented and cover access, rectification, erasure, restriction, portability, and objection.

Data subject rights requests are acknowledged and fulfilled within the timeframes required by applicable privacy regulation.

Records of data subject rights requests and their outcomes are maintained.

Data breach and privacy incident response procedures are documented, covering detection, containment, notification to regulators, and notification to affected data subjects.

Privacy incidents are recorded, investigated, and used to drive corrective action and PIMS improvement.

Data minimisation controls are in place to ensure only PII necessary for the stated processing purpose is collected and retained.

Retention schedules are defined and enforced for all categories of PII, including secure disposal procedures when retention periods expire.

Cross-border transfer controls are in place where PII is transferred to third countries, including documented transfer mechanisms, data localisation requirements, and assessments of adequacy.

Operational controls address AI-related processing risks, including automated decision-making, profiling, and the use of AI systems that process PII, with human oversight mechanisms defined where required.

The organisation has determined what to monitor and measure for PIMS performance, including privacy risk treatment effectiveness, data subject rights request volumes and outcomes, incident trends, and privacy-specific KPIs aligned to the objectives set under Clause 6.

Methods, frequency, and responsibility for monitoring and measurement are documented.

Monitoring results are analysed, evaluated, and reported to relevant management at defined intervals.

Privacy metrics are tracked over time and used to assess whether privacy objectives are being achieved.

An internal audit programme for the PIMS is documented, covering audit scope, criteria, frequency, and auditor selection, structured to reflect the four control themes of the 2025 edition: Organisational, People, Physical, and Technological.

Auditor independence from the areas being audited is ensured and documented.

At least one complete internal PIMS audit cycle has been completed before the certification audit.

Internal audit reports document findings, evidence reviewed, conformities, and nonconformities.

Audit findings are communicated to relevant management and tracked to closure.

Management reviews of the PIMS are conducted at planned intervals by top management.

Management review inputs include PIMS performance data, audit results, privacy risk register status, privacy objective progress, data subject complaint volumes, status of corrective actions, and changes in applicable privacy laws or regulations.

Management review outputs include decisions on improvement opportunities, resource needs, and any required changes to the PIMS.

Management review minutes are retained as documented evidence.

A process for identifying, recording, and managing nonconformities is documented.

Nonconformities, including privacy control failures, data breaches, and data subject complaints, are recorded when they occur.

Root cause analysis is performed for each nonconformity to identify the underlying cause rather than the symptom.

Corrective actions are planned with assigned owners and target completion dates.

Corrective actions are verified for effectiveness before the nonconformity is closed.

Records of nonconformities, corrective actions, and closure evidence are retained.

Lessons learned from privacy incidents and nonconformities are used to update risk assessments, controls, and processing procedures.

Evidence of continual improvement of the PIMS is available, demonstrating that privacy controls, risk management practices, and PII protection outcomes improve over time.

A lawful basis for processing has been identified and documented for each PII processing activity, including the specific legal basis applied (consent, contract, legal obligation, legitimate interests, or other applicable basis).

Where legitimate interests are relied upon as the legal basis, a legitimate interests assessment has been completed and documented.

Privacy notices are provided to data subjects at the point of collection, covering the identity of the controller, the purposes of processing, the legal basis, recipients of PII, retention periods, and data subject rights.

Privacy notices are written in plain language accessible to the intended audience, kept current, and available in accessible formats.

Consent is obtained through a clear affirmative action where consent is the stated legal basis, and records of consent are maintained including the date, mechanism, and scope of consent.

Processes are in place to honour consent withdrawal promptly and to cease processing based on that consent once withdrawn.

Procedures are in place to respond to data subject access requests, including identity verification, collation of data held, and delivery within required timeframes.

Procedures are in place to correct inaccurate PII upon request from the data subject.

Procedures are in place to erase PII upon request where the legal basis for erasure is met, and to communicate erasure to third parties where PII has been shared.

Procedures are in place to restrict processing where requested by a data subject pending verification or dispute resolution.

Where data portability applies, procedures exist to provide PII to data subjects in a structured, commonly used, machine-readable format.

Procedures are in place to allow data subjects to object to processing, including objection to profiling and automated decision-making, and to action objections within required timeframes.

Privacy by design and privacy by default principles are applied when developing or procuring new systems or processes that process PII, with privacy risk assessment conducted before deployment.

Data minimisation controls ensure that only the minimum PII necessary for each specific processing purpose is collected and processed by default.

Contracts or data processing agreements are in place with all third-party processors, specifying the scope, purpose, and obligations of processing.

A register of third-party processors is maintained and reviewed at defined intervals.

Due diligence is performed on third-party processors before engagement, covering their privacy and security controls.

Where PII is transferred internationally, the transfer mechanism is documented, legally valid, and reviewed periodically.

Records of international transfer mechanisms are maintained and updated when transfer arrangements change.

Controls are in place for automated decision-making and profiling activities, including mechanisms for human review of significant decisions made solely on the basis of automated processing.

A documented agreement or contract is in place with the PII controller specifying the scope, purpose, and permitted processing activities.

PII is processed only on documented instructions from the controller, and any instruction considered to conflict with applicable privacy law is flagged to the controller before processing proceeds.