Additional ISO/IEC 27002 guidance for PII controllers, ISO 27701:2019
ISO 27701:2019 7.3.3: Providing information to PII principals
The organization must give individuals clear and easily accessible information identifying the controller and describing the processing of their data, delivered in a timely, concise, complete, transparent, intelligible and easily accessible form using clear and plain language suited to the audience, given at the time of collection where appropriate and permanently accessible thereafter.
What else in your programme already covers this
This control maps to 29 controls across 12 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST800-AC-8 System Use Notification. Display [organization-defined] to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and state that:
NIST800-PM-20 Dissemination of Privacy Program Information. Maintain a central resource webpage on the organization's principal public website that serves as a central source of information about the organization's privacy program and that: Ensures that the
NIST800-PT-3 Personally Identifiable Information Processing Purposes. Identify and document the [organization-defined] for processing personally identifiable information; Describe the purpose(s) in the public privacy notices and policies of the organization; Restrict the [organization-defined] of personally identifiable
NIST800-PT-4 Consent. Implement [organization-defined] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals' informed decision-making
NIST800-PT-5 Privacy Notice. Provide notice to individuals about the processing of personally identifiable information that: Is available to individuals upon first interacting with an organization, and subsequently at [organization-defined]; Is clear and easy-to-understand, expressing information
NIST800-SC-42 Sensor Capability and Data. Prohibit [organization-defined] ; and Provide an explicit indication of sensor use to [organization-defined]
SOC2-P1.1 Privacy notice provides clear notice about privacy practices
SOC2-P2.1 Consent is obtained for the collection, use, and disclosure of personal information
SOC2-P3.1 Personal information is collected consistent with privacy commitments
SOC2-P6.6 Provides notification of breaches and incidents to affected data subjects, regulators, and others to meet the entity's objectives related to privacy
SOC2-P6.7 Provides data subjects with an accounting of the personal information held and disclosure of the data subjects' personal information, upon the data subjects' request, to meet the entity's objectives related to privacy
SOC2-P8.1 Inquiries, complaints, and disputes regarding personal information are addressed
You are reading one control. How much of ISO 27701:2019 have you already done?
ISO 27701:2019 7.3.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.