ISO 27001 Annex A 5.34 Privacy and protection of PII requires organisations to identify and meet all relevant privacy laws and regulations. Documented rules ensure the lawful handling and strong protection of personally identifiable information.
Table of contents
Key Takeaways
- Protect personal data: Implement technical and organisational controls to safeguard personally identifiable information from loss and theft.
- Store privacy rules centrally: Keep data protection policies, processing logs, and privacy notices in a central document repository.
- Map personal data flows: Identify what personal details your business collects, where files live, and who accesses them.
- Follow privacy principles: Collect only necessary data, keep information accurate, and delete files when no longer needed.
- Fulfil individual rights: Maintain clear processes to handle customer and staff requests to view, correct, or delete personal data.
- Govern supplier data handling: Enforce data processing agreements with third-party vendors who handle personal records.
- Encrypt sensitive information: Use strong encryption for personal data at rest on servers and in transit across networks.
- Meet statutory privacy laws: Ensure day-to-day data handling aligns fully with applicable local and international privacy regulations.
How to Implement ISO 27001 Annex A 5.34
- Draft a data privacy policy: Write a comprehensive privacy policy and publish it in your central document repository.
- Build a data inventory: Create a record of processing activities listing all personal data types, purposes, and storage locations.
- Publish clear privacy notices: Provide transparent public notices explaining how your organisation collects, uses, and protects personal information.
- Apply privacy by design: Assess privacy risks early during new software builds, business projects, and service changes.
- Execute vendor data agreements: Ensure all third-party suppliers sign formal data processing clauses before receiving personal files.
- Establish subject rights steps: Set up a simple workflow to answer data access, rectification, and deletion requests within legal deadlines.
- Define retention limits: Set automatic disposal rules to delete or anonymise personal records once their purpose ends.
- Train staff on privacy duties: Deliver regular data protection training so employees handle personal information safely and lawfully.
- Plan privacy breach responses: Build fast reporting steps to notify authorities and affected individuals if personal data is exposed.
When you’re ready to bring compliance into one place
How to Audit ISO 27001 Annex A 5.34
- Review privacy policies: Inspect written data protection rules to verify alignment with statutory regulations and ISO requirements.
- Audit data processing registers: Sample the record of processing activities to confirm all systems holding personal records are documented.
- Verify subject request handling: Review sample logs of user access and deletion requests to ensure teams answered them on time.
- Check third-party contracts: Inspect vendor agreements to confirm active data processing and confidentiality clauses exist.
- Test access restrictions: Verify that access to customer and employee personal data is limited to authorised staff roles.
- Inspect privacy risk assessments: Check project records to verify teams ran privacy impact assessments for high-risk data activities.
- Verify data retention enforcement: Sample production databases to confirm obsolete personal records were safely erased or anonymised.
- Check staff training logs: Confirm all employees handling personal records completed required annual privacy awareness courses.
Audit Evidence Checklist
- Data protection policy: Maintain a documented privacy policy with full revision history in your central repository.
- Record of processing activities: Keep an active, up-to-date register detailing personal data categories, flows, and retention schedules.
- Public privacy notices: Maintain current copies of website and customer-facing privacy statements and consent collection notices.
- Signed vendor data agreements: Supply signed contracts and data protection addendums for all external processors.
- Subject access request logs: Provide tracking tickets showing the timely completion of user data rights requests.
- Privacy impact assessments: Produce documented risk assessments for sensitive data projects and system changes.
- Staff privacy training logs: Show sign-off sheets proving workers finished annual training on handling personal data.
What to Teach Employees
- Recognise personal data: Teach staff to identify names, email addresses, phone numbers, location data, and identity records.
- Practise data minimisation: Instruct workers to collect only the personal information strictly needed for business tasks.
- Share data securely: Warn employees never to email unencrypted spreadsheets containing personal records outside the company.
- Report leaks immediately: Ensure staff know how to report accidental disclosures or misdirected emails without delay.
- Respect individual rights: Train customer-facing staff on how to escalate data deletion and access requests correctly.
- Follow clean desk habits: Remind workers to lock screens and clear physical workspaces of paper documents holding personal data.
- Avoid unapproved tools: Warn staff against uploading personal client records into unverified third-party software or tools.
Common Implementation Challenges
- Unmapped data stores: Personal files hide in forgotten spreadsheets and local drives. Run discovery checks to update data inventories.
- Indefinite data retention: Teams keep old customer files indefinitely. Set clear retention limits and automate file deletion cycles.
- Unregulated vendor sharing: Staff share personal records with cloud apps without legal terms. Enforce vendor data reviews before sharing files.
- Slow response to requests: Complex internal structures delay subject access responses. Build standardized workflows to retrieve user data fast.
- Excessive internal access: Too many workers can view sensitive customer details. Restrict data access strictly by job role.
- Confusing legal requirements: Differing regional privacy laws create confusion. Standardise controls around high baseline privacy standards.
How to Measure Effectiveness (KPIs)
- Subject request response speed: Measure the average number of days taken to complete user access and deletion requests.
- On-time rights completion rate: Track the percentage of subject access requests resolved within statutory deadlines.
- Personal data breach count: Track the total number of security incidents involving personal information each year.
- Vendor agreement coverage: Measure the proportion of third-party data processors with executed data protection agreements on file.
- Privacy training completion rate: Track the percentage of active employees who finish annual data privacy awareness courses.
- Data inventory accuracy rate: Measure the accuracy of processing records during annual privacy audit spot checks.
- Privacy audit finding count: Monitor the number of non-conformities raised during internal and external data privacy reviews.
Related ISO 27001 Controls
ISO 27001 Control A 5.34 connects to several other ISO 27001 requirements:
- Clause 4.2: Understanding the needs of interested parties.
- Annex A 5.31: Legal and regulatory requirements.
- Annex A 8.10: Information deletion.
- Annex A 8.11: Data masking.
