Privacy and protection of personal identifiable information (PII)

What the requirement asks

The organization is to identify, and then satisfy, the requirements for preserving privacy and protecting personally identifiable information that arise from applicable laws, regulations and contracts. Purpose: comply with the legal, regulatory and contractual requirements concerning the security aspects of PII protection. Guidance: set a topic-specific policy covering privacy and the protection of PII and communicate it to relevant parties; develop and implement privacy and PII protection procedures and make them known to everyone involved in processing PII. Meeting these procedures and the relevant laws requires suitable roles, responsibilities and controls, usually best achieved by appointing someone such as a privacy officer who guides staff, service providers and others on their individual responsibilities and the procedures to follow. Responsibility for handling PII is assigned with regard to the relevant laws, and appropriate technical and organizational measures are put in place to protect it. Other information: many countries regulate how PII is gathered, processed, sent and erased, may impose duties on those who collect and share it, and may restrict transfers abroad; ISO/IEC 29100 gives a high-level framework, ISO/IEC 27701 covers privacy information management, ISO/IEC 27018 covers public cloud PII processors, and ISO/IEC 29134 gives guidance on privacy impact assessment for identifying and reducing privacy risks. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Privacy and PII need a data map and a lawful basis. The guidance asks for the categories, the purpose, the retention, the recipients and the request route.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep the topic-specific privacy and PII protection policy and its communication to relevant parties and one live sample together.

Evidence an assessor asks for

• Privacy governanceThe topic-specific privacy and PII protection policy and its communication to relevant parties
• Privacy governancePrivacy procedures communicated to everyone who processes PII
• Privacy governanceAppointment of a privacy officer or equivalent with documented responsibilities
• Privacy governanceA record of processing or PII inventory that records which laws apply to each processing activity
• Privacy governancePrivacy impact assessments for high-risk processing and the resulting mitigations
• Privacy governanceEvidence of technical and organizational measures protecting PII, such as access restrictions, encryption and cross-border transfer safeguards

The question an assessor will ask

An assessor will ask for the topic-specific privacy and PII protection policy and its communication to relevant parties, then trace it to the system it protects. For A.5.34 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Privacy is treated as a legal matter only, with no link to security controls
• No one is formally responsible for guiding staff and providers on PII handling
• Cross-border transfers of PII occur without checking applicable restrictions
• Privacy impact assessments are not performed for new processing

Before the next audit

Before the next audit, check one live sample for this gap: privacy is treated as a legal matter only, with no link to security controls.