Some Privacy-Related ISO Standards You Might Not Know

There are privacy-related ISO standards, old and new, that can help in developing and improving your organisation’s privacy posture. 

If you haven’t heard of them, ISO Standards are essentially documented best practices for specific products, test methods, codes of practice, or management systems.  There are more than 24,000 published ISO standards, so unsurprisingly, there are multiple relating to privacy and security. Here are some of the ones we find the most useful in privacy practice:

ISO 27701: 2019 – Requirements for Personal Information Management System

This is one you may have heard of … The most ‘holistic’ standard for privacy management is ISO 27701 which specifies the requirements for a privacy management system and closely connected to IS 27001, the information security management standard.  

We’ve covered ISO 27701 already:

ISO 27701 Privacy Management System: How useful is it? – Privacy108 | Australian Data Privacy & Security Consulting

In addition to the management system requirements, the standard provides guidance on the protection of privacy, and contains separate sets of controls for controllers and processors (though not hugely detailed).  Organisations can get certified to ISO 27701 which assists in demonstrating compliance with privacy regulations.  One of the downsides of ISO 27701 is that is an extension to ISO 27001 Information Security Management and ISO/IEC 27002 Security Controls.  So, you need to have your ISO 27001 certification before moving to ISO 27701. 

ISO 29100:2024 – Privacy Framework

ISO 29100:2024 provides a comprehensive framework for establishing a robust privacy management system (PMS) within your organization. The just released 2024 version replaces ISO 29100:2011 this year, and ISO has withdrawn both the 2011 version and the 2018 amendment. 

What it covers

The ISO/IEC 29100 Privacy Framework is intended to help organisations define their privacy safeguarding requirements related to personal information within an ICT environment by:

• specifying a basic privacy terminology, 
• defining roles of different organizations with respect to privacy, 
• describes privacy safeguarding considerations and 
• referencing a list of known privacy principles.

Section 6 of ISO 29100 describes 11 privacy principles to be used in the design, development and implementation of privacy policies and controls:

• Consent and choice.
• Purpose legitimacy and specification.
• Collection limitation.
• Data minimization.
• Use, retention and disclosure limitation.
• Accuracy and quality.
• Openness, transparency and notice.
• Individual participation and access.
• Accountability.
• Information security.
• Privacy compliance.

For all those principles, the Privacy Framework provides further details on how to adhere to them. 

How ISO 29100 helps:

• Comprehensive Framework: Provides a structured approach to establishing, implementing, maintaining, and continually improving a PMS.
• Privacy Principles: This section outlines fundamental principles like fairness, transparency, purpose limitation, and data minimization to guide your practices.
• Policy Development: Assists in creating comprehensive privacy policies that align with legal requirements and stakeholder expectations.
• Privacy Impact Assessments (PIAs): Facilitates the identification and assessment of privacy risks associated with new initiatives or changes to existing processes.
• Incident Response: Establishes procedures for effectively responding to privacy incidents.

In particular it is hoped that the standard will:

• Aid in the design, implementation, operation and maintenance of ICT systems that handle and protect personal information;
• Spur innovative solutions to enable the protection of personal information within ICT systems; and
• Improve organisation’s privacy programs through the use of best practices.

Privacy By Design

The following standards help in implementing a Privacy by Design approach – and providing a standards based methodology for doing Privacy Impact Assessments.

ISO 31700:2023 – Privacy by Design

ISO 31700 empowers organizations to proactively embed privacy into the design of systems, products, and services. This “Privacy by Design” approach not only mitigates risk but also unlocks competitive advantages.

We’ve covered ISO 31700 previously.

Key Benefits For Your Organization

• Proactive Risk Mitigation: By considering privacy from the outset, you can identify and address potential issues before they escalate into costly breaches or compliance failures.
• Enhanced Customer Trust: Demonstrating a commitment to privacy through Privacy by Design builds confidence and loyalty among your customer base.
• Regulatory Compliance: Proactively addressing privacy concerns helps ensure adherence to data protection regulations like GDPR and CCPA.
• Innovation Catalyst: Integrating privacy considerations into the design process can spark new ideas and solutions that prioritize user control and data protection.
• Stronger Reputation: A reputation for respecting user privacy can attract new customers and partners, enhancing your brand value.

How ISO 31700 Helps

Consistently with the principles of ‘privacy by design’ the standard supports the following:

• Guiding Principles: Provides clear principles for embedding privacy into every stage of the design and development process.
• User-Centric Design: Encourages a focus on user needs and expectations regarding privacy, ensuring that your products and services respect their autonomy.
• Proactive Measures: Emphasizes taking proactive steps to minimize data collection, protect personal information, and empower users to control their data.
• Full Functionality: Ensures that privacy enhancements do not compromise the functionality or user experience of your products and services.
• Transparency and Accountability: Promotes clear communication about data practices, giving users visibility into how their information is used and protected.

The standard provides general guidance on:

• designing capabilities to enable consumers to enforce their privacy rights,
• assigning relevant roles and authorities,
• providing privacy information to consumers,
• conducting privacy risk assessments,
• establishing and documenting requirements for privacy controls,
• how to design privacy controls,
• lifecycle data management, and
• preparing for and managing a data breach.

By embracing ISO 31700, you can shift from reactive privacy measures to a proactive, privacy-first approach. This not only reduces risk but also fuels innovation, enhances customer trust, and positions your organization as a leader in the privacy-conscious marketplace.

ISO 29134:2023: Guidelines for Privacy Impact Assessments

ISO 29134:2023 provides a comprehensive framework for conducting Privacy Impact Assessments (PIAs), empowering organisations to proactively identify and mitigate privacy risks.

Key benefits for your organization

• Risk Mitigation: Systematically identify and evaluate potential privacy risks associated with new initiatives or changes to existing processes.
• Informed Decision-Making: PIAs provide valuable insights to inform decision-makers about the privacy implications of their choices, enabling them to make well-informed choices that protect both individuals and the organization.
• Compliance: Demonstrate a commitment to privacy protection and regulatory compliance by proactively addressing privacy concerns.
• Transparency and Accountability: Build trust with stakeholders by demonstrating a transparent and accountable approach to privacy management.
• Continuous Improvement: Identify opportunities for enhancing privacy practices and building a privacy-by-design culture within the organization.

How ISO 29134 helps

• Structured Methodology: Provides a clear step-by-step process for conducting PIAs, ensuring consistency and thoroughness.
• Risk Assessment Framework: This framework guides the identification, analysis, and evaluation of privacy risks, taking into account the specific context and potential impact on individuals.
• Mitigation Strategies: Offers guidance on developing and implementing effective measures to mitigate identified privacy risks.
• Documentation and Reporting: Facilitates the creation of comprehensive PIA reports, documenting the assessment process, findings, and recommendations.
• Stakeholder Engagement: Encourages the involvement of relevant stakeholders throughout the PIA process, fostering collaboration and ensuring diverse perspectives are considered.

Organisations can use ISO 29134:2023 to proactively address privacy risks, foster a culture of privacy awareness, and build trust with customers, partners, and regulators.

Data de-identification and deletion

The following two standards are more specific – supporting different activities that are common parts of any privacy management program:

ISO 27559:2022 – Privacy Enhancing Data De-Identification Framework

ISO 27559:2022 offers a strategic framework that allows you to balance data use with individual privacy, ensuring compliance, mitigating risk, and fostering trust among your stakeholders.

This standard facilitates the following: 

• Mitigation of Legal and Reputational Risk: By adhering to this globally recognised standard, you demonstrate a proactive approach to data protection, reducing the risk of costly data breaches, regulatory fines, and reputational damage.
• Unlocking the full potential of the data you collect: ISO 27559 empowers your organization to harness the power of data for innovation, research, and strategic decision-making while ensuring sensitive personal information remains confidential.
• Building Stakeholder Trust: Demonstrating a commitment to robust privacy practices through ISO 27559 can enhance your brand image, build customer loyalty, and strengthen relationships with partners and investors.
• Streamlined Compliance: The standard provides a clear roadmap for navigating complex privacy regulations, such as GDPR and CCPA, simplifying compliance efforts and reducing legal overhead.
• Building Competitive Advantage: By adopting best practices in data de-identification, your company can differentiate itself in the market and attract privacy-conscious customers and partners.

Helpfully, ISO 27559 provides a step-by-step process for implementing de-identification practices, from initial risk assessment to ongoing monitoring and review.

It is applicable to any organisation that controls personally identifiable information. 

ISO 27555: Guidelines on PII Deletion

ISO 27555 offers a comprehensive framework for the secure and effective deletion of Personally Identifiable Information (PII), a critical aspect of data privacy and risk management.

Key benefits for your organisation:

• Reduce risk: Mitigate the risk of data breaches, unauthorized access, and costly legal penalties.
• Build trust: Demonstrate commitment to responsible data handling and privacy protection.
• Streamline compliance: Ensure adherence to data protection regulations and best practices.
• Optimise operations: Simplify data management processes and reduce storage costs.
• Enhance reputation: Position your company as a leader in data privacy and security.

How ISO 27555 helps:

• Clear roadmap: Provides a step-by-step approach for managing the lifecycle of personal data, and developing clear retention and deletion rules that are relatively easy to implement.
• Secure disposal: Outlines methods for the safe and irreversible deletion of PII.
• Verification procedures: Ensures the effectiveness of deletion processes.
• Guidance for various media: Addresses the specific challenges of different storage types.

By embracing ISO 27555, organisations can proactively address PII deletion, safeguard individual privacy, protect their assets, and foster a more trustworthy data landscape.

Key Takeaways

ISO has developed and will continue to work on a comprehensive suite of privacy-related standards that can both inform the design of your privacy management program and provide invaluable guidance on assembling its building blocks.

The Privacy 108 team has worked with many organisations on developing and implementing privacy policies, processes, and standards to boost organisational privacy posture. If your organisation needs help, reach out. Our privacy consultants would love to help.