ISO/IEC 27557:2022 - Organisational Privacy Risk Management 5.4.3: 5.4.3 Assigning organizational roles, authorities, responsibilities and accountabilities

ISO 31000:2018 5.4.3 applies, plus three privacy duties for top management and oversight bodies: make clear that managing the risk of PII processing is a central responsibility, not a side task; name the people who hold both the accountability and the authority to manage the risks that PII processing creates; and name the people who hold accountability and authority for privacy events whose consequences land on the organization itself, even where no PII principal, employee or other stakeholder is affected.