ISO 27701 establishes requirements and guidelines for information privacy management within an information security management system (ISMS) based on ISO 27001. The stages for implementing ISO 27701 are similar to those of ISO 27001, with a specific focus on information privacy. The key stages for the implementation of ISO 27701 are described below:

• Commitment of Senior Management:

– Identify the need to implement ISO 27701.

– Obtain the commitment of senior management for the information privacy management project.

• Establish the Scope of the Privacy ISMS:

– Define which information assets and processes of the organization are covered by the privacy ISMS.

– Determine the scope limits of the privacy ISMS.

• Beginning of Privacy Risk Analysis:

– Identify and evaluate risks related to the privacy of information, including personal information.

– Determine threats, vulnerabilities, and potential impact on data privacy.

• Definition of the Information Privacy Policy:

– Develop an information privacy policy that establishes the general principles and objectives of the privacy ISMS.

• Planning Privacy Controls:

– Define and plan the implementation of information privacy controls, such as technical and organizational measures to protect personal data.

• Implementation of Privacy Controls:

– Implement the privacy controls defined in the previous stage.

– Ensure processes and systems are configured to protect information privacy.

• Residual Privacy Risk Assessment:

– Reassess risks after implementing privacy controls.

– Ensure that residual risks are within acceptable limits.

• Internal Privacy Audit:

– Conduct internal audits to evaluate compliance with ISO 27701 and implemented privacy controls.

– Identify areas of improvement.

• Review by the Privacy Directorate:

– Senior management reviews the performance of the privacy ISMS and internal audits.

– Decisions are made to improve the privacy ISMS as necessary.

• External Privacy Certification:

– Hire a third-party certification body to perform an audit and issue a certification if the privacy requirements of ISO 27701 are met.

• Maintenance and Continuous Improvement of Privacy:

– Continue to monitor and improve privacy ISMS over time.

– Respond to changes in privacy risks and requirements.

These stages ensure that an organization can effectively manage information privacy and meet ISO 27701 requirements to protect personal data. The standard is based on the continuous improvement approach, which means that the cycle of implementation and improvement is repeated over time to maintain the effectiveness of the privacy ISMS.

More information about the structure of the ISO 27701 Standard.

ISO 27701 has a similar structure to other ISO standards and is based on the common High-Level Structure (HLS) format that is used to facilitate integration with other management system standards, such as ISO 27001 (security of information) and ISO 9001 (quality management). The structure of ISO 27701 consists of several sections, and an overview of its structure is presented here:

• Introduction:

– This section provides an overview of the standard and its purpose. Describes the context and importance of information privacy management.

• Objective and field of application:

– Defines the objectives of ISO 27701 and specifies its scope of application. It indicates that the standard applies to organizations seeking to manage information privacy and expands the implementation of an ISMS based on ISO 27001.

• Normative references:

– This section lists standards and reference documents related to ISO 27701. It may include other relevant ISO standards, privacy laws and regulations.

• Terms and definitions:

– Defines the key terms and definitions used in the standard. This ensures a common understanding of concepts and terminology related to information privacy.

• Organization context:

– As in ISO 27001, this section requires the organization to identify its context, relevant stakeholders, and their requirements and expectations related to information privacy.

• Leadership and commitment:

– Describes the leadership and commitment requirements of senior management related to information privacy, including the definition of roles and responsibilities.

• Planning:

– This section focuses on planning privacy management processes, including identifying privacy risks and opportunities.

• Support:

– Details requirements related to senior management support, staff competency, and resources needed to implement and maintain the privacy ISMS.

• Operation:

– This section focuses on the implementation of controls and processes to protect the privacy of information.

• Performance evaluation:

– Describes the requirements to evaluate and measure the performance of the privacy ISMS and how internal audits should be carried out.

• Improvement:

– This section addresses continuous improvement of the privacy ISMS, including taking corrective and preventive actions to address nonconformities and identified risks.

The structure of ISO 27701, being aligned with the HLS, facilitates integration with other management system standards, which can simplify the management of information privacy and its integration with information security and other aspects of the business management.

More information about the Integration of ISO 27701 with ISO/IEC 27001.

The PDCA Cycle (Plan, Do, Check, Act) is a continuous improvement approach that can be applied in the implementation and management of management systems, including the ISO 27701 standard for information privacy. Although not explicitly mentioned as a cycle in ISO 27701, PDCA principles can be applied at all stages of the information privacy management process. The following describes how the PDCA cycle relates to ISO 27701:

• Plan (P):

– At this stage, the organization must plan its information privacy management system (IMS) based on ISO 27701. This includes the identification of personal information assets, the assessment of privacy risks and the definition of policies and privacy objectives. This stage is related to the “Planning” phase of the PDCA cycle.

• Do (D):

– Once privacy measures have been planned, the organization must implement them. This includes implementing privacy controls, training staff, and managing processes to protect personal data. This stage relates to the “Do” phase of the PDCA cycle.

• Check (C):

– At this stage, continuous evaluation and monitoring of the SGPI is carried out to ensure that it is working as planned. Internal audits are performed and privacy-related key performance indicators are measured. This stage is related to the “Verify” phase of the PDCA cycle.

• Act (A):

– Based on the results of internal evaluations and audits, the organization takes measures to correct and improve the SGPI according to the findings. This may include implementing corrective and preventive actions to address identified deficiencies or risks. This stage relates to the “Act” phase of the PDCA cycle.

The PDCA approach is repeated continuously over time in information privacy management. Each time the cycle is completed, feedback is given to make additional adjustments and improvements to the SGPI to maintain effectiveness in protecting the privacy of personal data and comply with the requirements of ISO 27701. Continuous improvement is a fundamental aspect in managing information privacy to adapt to changes in technology, regulation and privacy risks.

More information about the General Data Protection Regulation.