{"id":2735,"date":"2019-09-07T07:44:22","date_gmt":"2019-09-07T12:44:22","guid":{"rendered":"https:\/\/kuma.pro\/?p=2735"},"modified":"2019-09-07T07:44:22","modified_gmt":"2019-09-07T12:44:22","slug":"what-iso-iec-277012019-means-for-your-pii-data","status":"publish","type":"post","link":"https:\/\/kuma.pro\/what-iso-iec-277012019-means-for-your-pii-data\/","title":{"rendered":"What ISO\/IEC 27701:2019 Means for Your PII Data"},"content":{"rendered":"

Those\u00a0of us who collect and store Personally Identifiable Information (PII) and associated private information are guardians of very valuable data \u2013 data that creates vulnerability for its owner when breached, and data that is highly sought after by people and organizations who leverage that data to commit fraud or to cause harm to the victims. As guardians, we must remain vigilant and up-to-date on the latest best practices that are aimed at protecting private data and the people who own it. If you are not already working towards the new ISO\/IEC 27701<\/a> guidelines, you are likely not doing everything you can to protect this valuable data.\u00a0 It is vitally important to establish a project charter and begin upgrading your privacy practice to adhere to the much-anticipated\u00a0ISO\/IEC 27701 guidance, which includes approaches for\u00a0the protection of privacy affected by the collection and processing of personal information including protocols in order to establish, implement, maintain and continually improve a Privacy Information Management System (PIMS). The standard outlines a framework for Personally Identifiable Information (PII) controllers and PII processors to manage privacy controls so that risk to individual privacy rights is minimized.<\/p>\n

 <\/p>\n

ISO\/IEC 27001<\/a> offers you a way to demonstrate your organizational commitment to privacy and data protection in a way previously hard to achieve.\u00a0 Now, similarly to the wide array of security standards in the market, certification of 27001 can be used as a business enabler to facilitate agreements with business partners, to assist in relationships with other stakeholders, and provide independent verification of your organization\u2019s protection of privacy. Organizations planning to seek an ISO\/IEC 27701 certification will also need an ISO\/IEC 27001 certification. This demonstrates a commitment to both information security and privacy management.<\/p>\n

 <\/p>\n

The hallmark of 27701 is the recognition of the evolution of PII within contemporary organizations.\u00a0 We all know that the tide of PII truly ebbs and flows within our ever-increasing connected networks and ecosystems, leaving the days of static data flows behind.\u00a0 ISO\/IEC 27701 defines processes and provides guidance for protecting PII on an ongoing, ever-evolving basis. Because it is a management system, 27701 defines processes for continuous improvement on data protection, particularly important in a world where technology-related risk management is a moving target.<\/p>\n

 <\/p>\n

This new international standard is officially called ISO\/IEC 27701 (Security techniques- Extension to ISO\/IEC 27001 and ISO\/IEC 27002 for privacy information management- Requirements and guidelines). Similar to the other ISO Standards, the ISO 27701 provides a documented holistic basis, following a Recognized International standard, in order to assess the design and effectiveness of controls carried out internally to an organization.\u00a0 Organizations planning to seek an ISO\/IEC 27701 certification will also need an ISO\/IEC 27001 certification. This demonstrates a commitment to both information security and privacy management.<\/p>\n

 <\/p>\n

Notably, 27701 provides delineation between and specific controls for two increasingly common categories in which your organization will find itself: data processor and data controller.\u00a0 In recognition of the prevalence of data protection regulations, and increased overlap between standards one organization may need to abide by, 27701 further provides references and crosswalks between\u00a0 ISO 27701 and GDPR, ISO 27018 (Public Cloud Privacy) and ISO 29151 (Privacy Code of Practice).<\/p>\n

 <\/p>\n

Given this integrated and forward-looking perspective, you can use 27701 as a vehicle to<\/p>\n