Chris Lippert, Director of the Privacy Practice at Schellman, is here to answer the most frequently asked questions surrounding the ISO 27701 standard, including why it’s important, who should adopt it, and how closely it aligns with other compliance frameworks.
What is ISO 27701?
ISO 27701 is a globally recognized standard for establishing a privacy information management system (PIMS), outlining the requirements and supporting controls that should be fulfilled and implemented. Compliance with ISO 27701 indicates that an organization has implemented a system to manage risks related to data privacy and the processing of personal information.
Why is ISO 27701 important?
ISO 27701 helps organizations become aware of data privacy risks and proactively identify and address weaknesses when processing personal information. Implementing a PIMS based on this standard enhances regulatory compliance and operational excellence while promoting a comprehensive approach to data privacy.
Benefits of ISO 27701:
- Increased operational readiness for any incoming privacy inquiries/requests
- Enhanced preparedness of people, processes, and technology to effectively respond to new privacy requirements
- Improved data integrity, confidentiality, and availability
- Centralized framework for protecting personal information across the organization
- Cost savings through increased efficiency and effectiveness
Who should adopt ISO 27701?
The ISO 27701 standard provides guidance for organizations of any size and sector to establish, implement, maintain, and improve a PIMS. In today’s landscape of data theft and cybercrime, all organizations must consider the risks related to the processing of personal information and should strategically assess their privacy needs. While the IT industry has the highest number of ISO 27701-certified companies, the standard’s benefits are recognized across all sectors.
How closely does ISO 27701 align with other compliance initiatives?
ISO 27701 was designed with GDPR in mind, so there is a detailed mapping in the standard that speaks to this alignment. Regarding other compliance frameworks, such as SOC 2, NIST 800-53, or Cross Border Privacy Rules (CBPR), there is overlap in the established core privacy principles as the controls in Annex A/B of ISO 27701 map over very well. We often find that our ISO 27701 clients are particularly well positioned to undergo compliance efforts against these frameworks due to ISO's strict requirements for documentation, such as policies and procedures, which assist organizations in demonstrating compliance.
Moving Forward with ISO 27701 Certification
To promote efficiency across audit processes, Schellman clients often integrate their timing and audit approach of ISO 27701 with other privacy audits, which is further enhanced by Schellman’s cross-trained team members who apply a “test once, apply many” approach to auditing across multiple frameworks.
If you have further questions surrounding the ISO 27701 certification process or requirements, contact us today and we’ll get back to you shortly. In the meantime, discover additional ISO 27701 insights in these helpful resources:
About Chris Lippert
Chris Lippert is a Director and Privacy Technical Lead with Schellman and is based in Atlanta, GA. With more than 10 years of experience in information assurance across numerous industries, regulations, and frameworks, Chris developed a passion for and concentration in data privacy. He is an active member of the International Association of Privacy Professionals (IAPP), holds his Fellow of Information Privacy (FIP) designation, and advocates for privacy by design and the adequate protection of personal data in today’s business world.