ISO 27701:2019

International

v2019

6 domains

145 controls

Verified

ISO 27701:2019 is a compliance framework from International with 6 domains and 145 controls that map to 138 other frameworks. The largest domains are PIMS-specific guidance related to ISO/IEC 27002, ISO 27701:2019 (50 controls), Additional ISO/IEC 27002 guidance for PII controllers, ISO 27701:2019 (36 controls), PIMS-specific requirements related to ISO/IEC 27001, ISO 27701:2019 (30 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

Additional ISO/IEC 27002 guidance for PII controllers, ISO 27701:2019

36 controls

Controls in the Additional ISO/IEC 27002 guidance for PII controllers, ISO 27701:2019 domain of ISO 27701:2019 — 31 controls
Code	Title	Description
iso-27701-2019::7.2.1	Identify and document purpose	The organization must identify and document the specific purposes for which personal data will be processed, documented...
iso-27701-2019::7.2.2	Identify lawful basis	The organization must determine, document and comply with the lawful basis for each processing activity against its iden...
iso-27701-2019::7.2.3	Determine when and how consent is to be obtained	The organization must determine and document a process by which it can demonstrate whether, when and how consent to proc...
iso-27701-2019::7.2.4	Obtain and record consent	The organization must obtain and record consent according to its documented process, recording it so that on request it...
iso-27701-2019::7.2.5	Privacy impact assessment	The organization must assess whether a privacy impact assessment is needed and carry one out where appropriate whenever...
iso-27701-2019::7.2.6	Contracts with PII processors	The organization must have a written contract with every processor it uses and must ensure those contracts address imple...
iso-27701-2019::7.2.7	Joint PII controller	Where the organization is a joint controller, it must determine the respective roles and responsibilities for processing...
iso-27701-2019::7.2.8	Records related to processing PII	The organization must determine and securely maintain the records that support its obligations for processing, typically...
iso-27701-2019::7.3.1	Determining and fulfilling obligations to PII principals	The organization must determine and document its legal, regulatory and business obligations to the individuals whose dat...
iso-27701-2019::7.3.10	Automated decision making	The organization must identify and address the obligations, including legal obligations, that it owes to individuals ari...
iso-27701-2019::7.3.2	Determining information for PII principals	The organization must determine and document what information is to be provided to individuals about the processing of t...
iso-27701-2019::7.3.3	Providing information to PII principals	The organization must give individuals clear and easily accessible information identifying the controller and describing...
iso-27701-2019::7.3.4	Providing mechanism to modify or withdraw consent	The organization must provide a mechanism for individuals to modify or withdraw consent, inform them of their rights to...
iso-27701-2019::7.3.5	Providing mechanism to object to PII processing	The organization must provide a mechanism for individuals to object to the processing of their data, documenting the leg...
iso-27701-2019::7.3.6	Access, correction and/or erasure	The organization must implement policies, procedures or mechanisms enabling individuals to obtain access to, correct and...
iso-27701-2019::7.3.7	PII controllers' obligations to inform third parties	The organization must inform third parties with whom personal data has been shared of any modification, withdrawal or ob...
iso-27701-2019::7.3.8	Providing copy of PII processed	The organization must be able to provide a copy of the personal data it processes when the individual asks, in a structu...
iso-27701-2019::7.3.9	Handling requests	The organization must define and document policies and procedures for handling and responding to legitimate requests fro...
iso-27701-2019::7.4.1	Limit collection	The organization must limit collection of personal data to the minimum that is adequate, relevant, proportional and nece...
iso-27701-2019::7.4.2	Limit processing	The organization must limit processing of personal data to what is adequate, relevant and necessary for the identified p...
iso-27701-2019::7.4.3	Accuracy and quality	The organization must ensure and document that personal data is as accurate, complete and up to date as the purposes for...
iso-27701-2019::7.4.4	PII minimization objectives	The organization must define and document data minimisation objectives and the mechanisms used to meet them, identifying...
iso-27701-2019::7.4.5	PII de-identification and deletion at the end of processing	The organization must delete personal data, or render it into a form that does not permit identification or re-identific...
iso-27701-2019::7.4.6	Temporary files	The organization must ensure that temporary files created as a result of processing personal data are erased or destroye...
iso-27701-2019::7.4.7	Retention	The organization must not retain personal data longer than the purposes for which it is processed require, developing an...
iso-27701-2019::7.4.8	Disposal	The organization must hold documented policies, procedures or mechanisms for the disposal of personal data, choosing dis...
iso-27701-2019::7.4.9	PII transmission controls	The organization must subject personal data transmitted over a data transmission network to controls designed to ensure...
iso-27701-2019::7.5.1	Identify basis for PII transfer between jurisdictions	The organization must identify and document the basis on which personal data is transferred between jurisdictions, docum...
iso-27701-2019::7.5.2	Countries and international organizations to which PII can be transferred	The organization must specify and document the countries and international organizations to which personal data can poss...
iso-27701-2019::7.5.3	Records of transfer of PII	The organization must record transfers of personal data to and from third parties and ensure cooperation with those part...
iso-27701-2019::7.5.4	Records of PII disclosure to third parties	The organization must record disclosures of personal data to third parties, including what data was disclosed, to whom a...

Additional ISO/IEC 27002 guidance for PII processors, ISO 27701:2019

23 controls

Controls in the Additional ISO/IEC 27002 guidance for PII processors, ISO 27701:2019 domain of ISO 27701:2019 — 18 controls
Code	Title	Description
iso-27701-2019::8.2.1	Customer agreement	Where relevant, the contract to process personal data must address the organization's role in assisting the customer wit...
iso-27701-2019::8.2.2	Organization’s purposes	The organization must ensure that personal data processed on behalf of a customer is processed only for the purposes exp...
iso-27701-2019::8.2.3	Marketing and advertising use	The organization must not use personal data processed under a contract for marketing or advertising without establishing...
iso-27701-2019::8.2.4	Infringing instruction	The organization must inform the customer if, in its opinion, a processing instruction infringes applicable legislation...
iso-27701-2019::8.2.5	Customer obligations	The organization must give the customer the information the customer needs to demonstrate compliance with its own obliga...
iso-27701-2019::8.2.6	Records related to processing PII	The organization must determine and maintain the records needed to demonstrate compliance with its obligations under the...
iso-27701-2019::8.3.1	Obligations to PII principals	The organization must provide the customer with the means to comply with its obligations to individuals, recognising tha...
iso-27701-2019::8.4.1	Temporary files	The organization must ensure that temporary files created as a result of processing personal data are erased or destroye...
iso-27701-2019::8.4.2	Return, transfer or disposal of PII	The organization must provide the ability to return, transfer or dispose of personal data securely and must make its pol...
iso-27701-2019::8.4.3	PII transmission controls	The organization must subject personal data transmitted over a data transmission network to controls designed to ensure...
iso-27701-2019::8.5.1	Basis for PII transfer between jurisdictions	The organization must inform the customer in a timely manner of the basis for transfers of personal data between jurisdi...
iso-27701-2019::8.5.2	Countries and international organizations to which PII can be transferred	The organization must specify and document the countries and international organizations to which personal data can poss...
iso-27701-2019::8.5.3	Records of PII disclosure to third parties	The organization must record disclosures of personal data to third parties, including what data was disclosed, to whom a...
iso-27701-2019::8.5.4	Notification of PII disclosure requests	The organization must notify the customer of any legally binding request for disclosure of personal data, notifying with...
iso-27701-2019::8.5.5	Legally binding PII disclosures	The organization must reject requests for disclosure of personal data that are not legally binding, must consult the cor...
iso-27701-2019::8.5.6	Disclosure of subcontractors used to process PII	The organization must disclose to the customer any use of subcontractors to process personal data before that use, with...
iso-27701-2019::8.5.7	Engagement of a subcontractor to process PII	The organization must engage a subcontractor to process personal data only according to the customer contract, obtaining...
iso-27701-2019::8.5.8	Change of subcontractor to process PII	Where it holds a general written authorization, the organization must inform the customer of any intended change involvi...

Clause 0, ISO 27701:2019

2 controls

General, ISO 27701:2019

4 controls

PIMS-specific guidance related to ISO/IEC 27002, ISO 27701:2019

50 controls

Controls in the PIMS-specific guidance related to ISO/IEC 27002, ISO 27701:2019 domain of ISO 27701:2019 — 36 controls
Code	Title	Description
iso-27701-2019::6.1	General	Every ISO/IEC 27002 guideline that speaks of information security must be read as extending to the protection of privacy...
iso-27701-2019::6.10.1	Network security management	Network controls, security in network services and segregation in networks apply as the base guidance requires, read as...
iso-27701-2019::6.10.2	Information transfer	Information transfer policies and procedures must include procedures ensuring that the rules governing the processing of...
iso-27701-2019::6.11.1	Security requirements of information systems	Security requirements analysis and specification and the protection of application services transactions apply as the ba...
iso-27701-2019::6.11.2	Security in development and support processes	System development and design policies must give guidance on the organization's processing needs based on its obligation...
iso-27701-2019::6.11.3	Test data	Personal data must not be used for testing; false or synthetic data must be used instead, and where using personal data...
iso-27701-2019::6.12.1	Information security in supplier relationships	Supplier agreements must state whether personal data is processed and the minimum technical and organizational measures...
iso-27701-2019::6.12.2	Supplier service delivery management	Monitoring and review of supplier services and management of changes to those services apply as the base guidance requir...
iso-27701-2019::6.13.1	Management of information security incidents and improvements	The organization must establish responsibilities and procedures for identifying and recording breaches of personal data...
iso-27701-2019::6.14.1	Information security continuity	Planning, implementing and then verifying, reviewing and evaluating information security continuity apply as the base gu...
iso-27701-2019::6.14.2	Redundancies	Availability of information processing facilities through redundancy applies as the base guidance requires, read as cove...
iso-27701-2019::6.15.1	Compliance with legal and contractual requirements	Applicable legislation and contractual requirements must be identified, and the organization should identify the potenti...
iso-27701-2019::6.15.2	Information security reviews	Independent review of information security applies, and where the organization is a processor and individual customer au...
iso-27701-2019::6.2.1	Management direction for information security	The organization must state, in separate privacy policies or by augmenting its information security policies, its suppor...
iso-27701-2019::6.3.1	Internal organization	The organization must designate a contact point for the customer on matters of processing and, where it is a controller,...
iso-27701-2019::6.3.2	Mobile devices and teleworking	Mobile device and teleworking arrangements must be set so that using mobile devices does not lead to personal data being...
iso-27701-2019::6.4.1	Prior to employment	Screening and terms and conditions of employment must be applied as the base security guidance requires, read as coverin...
iso-27701-2019::6.4.2	During employment	During employment, management responsibilities, awareness and training, and disciplinary procedures apply, and awareness...
iso-27701-2019::6.4.3	Termination and change of employment	Responsibilities that survive termination or a change of employment must be defined and enforced, read as covering conti...
iso-27701-2019::6.5.1	Responsibility for assets	Assets must be inventoried, owned, used acceptably and returned on exit as the base guidance requires, with those obliga...
iso-27701-2019::6.5.2	Information classification	The information classification scheme must explicitly account for personal data, including its type and any special cate...
iso-27701-2019::6.5.3	Media handling	Removable media use for personal data must be documented, encrypted wherever feasible with compensating controls where i...
iso-27701-2019::6.6.1	Business requirements of access control	The access control policy and the rules for access to networks and network services apply as the base guidance requires,...
iso-27701-2019::6.6.2	User access management	User registration and deregistration for people who administer or operate systems processing personal data must address...
iso-27701-2019::6.6.3	User responsibilities	Users must meet their own responsibilities for protecting authentication information as the base guidance requires, read...
iso-27701-2019::6.6.4	System and application access control	System and application access control must restrict access to information, provide secure log on, manage passwords, cons...
iso-27701-2019::6.7.1	Cryptographic controls	The policy on the use of cryptographic controls must take account of jurisdictions that require cryptography for particu...
iso-27701-2019::6.8.1	Secure areas	Secure area controls covering the security perimeter, entry, offices and facilities, protection against external and env...
iso-27701-2019::6.8.2	Equipment	Equipment controls apply across siting, utilities, cabling, maintenance, removal and off premises use, and additionally...
iso-27701-2019::6.9.1	Operational procedures and responsibilities	Operating procedures must be documented, change managed, capacity managed, and development, test and operational environ...
iso-27701-2019::6.9.2	Protection from malware	Controls against malware apply as the base guidance requires, read as protecting the personal data that a compromise wou...
iso-27701-2019::6.9.3	Backup	The organization must hold a policy covering backup, recovery and restoration of personal data and any further contractu...
iso-27701-2019::6.9.4	Logging and monitoring	Event logs must be reviewed by continuous automated monitoring or by manual review at a documented frequency to find irr...
iso-27701-2019::6.9.5	Control of operational software	Control over the installation of software on operational systems applies as the base guidance requires, read as protecti...
iso-27701-2019::6.9.6	Technical vulnerability management	Technical vulnerability management and restriction on software installation apply as the base guidance requires, read as...
iso-27701-2019::6.9.7	Information systems audit considerations	Information systems audit controls apply as the base guidance requires, so audit activity on operational systems is plan...

PIMS-specific requirements related to ISO/IEC 27001, ISO 27701:2019

30 controls

Controls in the PIMS-specific requirements related to ISO/IEC 27001, ISO 27701:2019 domain of ISO 27701:2019 — 23 controls
Code	Title	Description
iso-27701-2019::5.1	General	Every requirement of ISO/IEC 27001 that speaks of information security must be read as extending to the protection of pr...
iso-27701-2019::5.2.1	Understanding the organization and its context	The organization must determine its role as a controller, joint controller or processor, and must determine the external...
iso-27701-2019::5.2.2	Understanding the needs and expectations of interested parties	The interested parties of the management system must be extended to include everyone with an interest or responsibility...
iso-27701-2019::5.2.3	Determining the scope of the information security management system	When determining the scope of the PIMS, the organization must bring the processing of personally identifiable informatio...
iso-27701-2019::5.2.4	Information security management system	The organization must establish, implement, maintain and continually improve a privacy information management system tha...
iso-27701-2019::5.3.1	Leadership and commitment	Top management must demonstrate the leadership and commitment ISO/IEC 27001 requires, with every reference to informatio...
iso-27701-2019::5.3.2	Policy	The policy requirements of ISO/IEC 27001 apply to the PIMS, meaning the policy set must commit the organization on priva...
iso-27701-2019::5.3.3	Organizational roles, responsibilities and authorities	Organizational roles, responsibilities and authorities must be assigned and communicated as ISO/IEC 27001 requires, now...
iso-27701-2019::5.4.1	Actions to address risks and opportunities	The actions to address risks and opportunities gain PIMS refinements: the risk assessment must identify privacy risks ar...
iso-27701-2019::5.4.2	Information security objectives and planning to achieve them	The requirements of ISO/IEC 27001 for setting information security objectives and planning to achieve them apply to the...
iso-27701-2019::5.5.1	Resources	The organization must determine and provide the resources needed to establish, implement, maintain and improve the PIMS,...
iso-27701-2019::5.5.2	Competence	The competence requirements of ISO/IEC 27001 apply to the PIMS, so the organization must determine, ensure, act on and e...
iso-27701-2019::5.5.3	Awareness	The awareness requirements of ISO/IEC 27001 apply to the PIMS, so people working under the organization's control must b...
iso-27701-2019::5.5.4	Communication	The communication requirements of ISO/IEC 27001 apply to the PIMS, so the organization must determine what privacy relev...
iso-27701-2019::5.5.5	Documented information	The documented information requirements of ISO/IEC 27001 apply to the PIMS across creation, updating and control, so pri...
iso-27701-2019::5.6.1	Operational planning and control	The operational planning and control requirements of ISO/IEC 27001 apply to the PIMS, so the processes that deliver priv...
iso-27701-2019::5.6.2	Information security risk assessment	The requirement of ISO/IEC 27001 to perform risk assessments at planned intervals or on significant change applies to th...
iso-27701-2019::5.6.3	Information security risk treatment	The requirement of ISO/IEC 27001 to implement the risk treatment plan applies to the PIMS, so the privacy controls chose...
iso-27701-2019::5.7.1	Monitoring, measurement, analysis and evaluation	The monitoring, measurement, analysis and evaluation requirements of ISO/IEC 27001 apply to the PIMS, so the organizatio...
iso-27701-2019::5.7.2	Internal audit	The internal audit requirements of ISO/IEC 27001 apply to the PIMS, so internal audit must test conformity and effective...
iso-27701-2019::5.7.3	Management review	The management review requirements of ISO/IEC 27001 apply to the PIMS, so top management must review the privacy extensi...
iso-27701-2019::5.8.1	Nonconformity and corrective action	The nonconformity and corrective action requirements of ISO/IEC 27001 apply to the PIMS, so a privacy nonconformity must...
iso-27701-2019::5.8.2	Continual improvement	The continual improvement requirement of ISO/IEC 27001 applies to the PIMS, so the organization must keep improving the...

Your Compliance Coverage

If you comply with ISO 27701:2019, you already cover:

SOC 2

97%

105 controls mapped

Compare →

NIST SP 800-53 Rev 5

95%

103 controls mapped

Compare →

ISO 27001:2022

93%

100 controls mapped

Compare →

+ 135 more: ISO 27002:2022 (89%), Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 (78%)

See all 138 mapped frameworks ↓

Maps to 138 other frameworks

108 total controls

SOC 2

105 source controls mapped|59 target controls covered

97%

NIST SP 800-53 Rev 5

103 source controls mapped|181 target controls covered

95%

ISO 27001:2022

100 source controls mapped|82 target controls covered

93%

ISO 27002:2022

96 source controls mapped|75 target controls covered

89%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

84 source controls mapped|106 target controls covered

78%

NIST Cybersecurity Framework 2.0

80 source controls mapped|94 target controls covered

74%

PCI DSS 4.0

71 source controls mapped|206 target controls covered

66%

C5 (Germany)

69 source controls mapped|75 target controls covered

64%

FedRAMP Moderate

66 source controls mapped|90 target controls covered

61%

NIST SP 800-161 Rev 1

66 source controls mapped|72 target controls covered

61%

FedRAMP High

65 source controls mapped|89 target controls covered

60%

GDPR

65 source controls mapped|36 target controls covered

60%

CMMC 2.0

64 source controls mapped|80 target controls covered

59%

NIST SP 800-53 Rev 5 MODERATE

63 source controls mapped|81 target controls covered

58%

NIST SP 800-53 Revision 5.1 HIGH

63 source controls mapped|82 target controls covered

58%

NIST SP 800-53 Rev 5 LOW

60 source controls mapped|58 target controls covered

56%

Australia Consumer Data Right - Banking (CDR)

59 source controls mapped|23 target controls covered

55%

CIS Controls v8

57 source controls mapped|119 target controls covered

53%

HIPAA Security Rule

48 source controls mapped|59 target controls covered

44%

NIST SP 800-171 Rev 3

45 source controls mapped|44 target controls covered

42%

NIST SP 800-66 Rev 2

42 source controls mapped|48 target controls covered

39%

APEC Cross-Border Privacy Rules (CBPR) System

39 source controls mapped|54 target controls covered

36%

APPI

35 source controls mapped|24 target controls covered

32%

AWS Well-Architected Security Pillar

34 source controls mapped|31 target controls covered

31%

CCPA/CPRA

31 source controls mapped|21 target controls covered

29%

Azure Security Benchmark

30 source controls mapped|57 target controls covered

28%

ISO 9001:2015

30 source controls mapped|32 target controls covered

28%

ISO 27017:2015

29 source controls mapped|29 target controls covered

27%

ISO 22000:2018

26 source controls mapped|28 target controls covered

24%

Australian Privacy Principles (APPs)

26 source controls mapped|10 target controls covered

24%

ISO 19011:2018

25 source controls mapped|31 target controls covered

23%

ISO 22301:2019

23 source controls mapped|21 target controls covered

21%

ISO 27018:2019

22 source controls mapped|24 target controls covered

20%

ISO 45001:2018

21 source controls mapped|21 target controls covered

19%

ISO 14001:2015

21 source controls mapped|20 target controls covered

19%

ISO 37301:2021

20 source controls mapped|21 target controls covered

19%

ISO/IEC 27701:2019

20 source controls mapped|17 target controls covered

19%

ISO 37001:2016

19 source controls mapped|18 target controls covered

18%

ISO 50001:2018 - Energy Management Systems

16 source controls mapped|25 target controls covered

15%

ISO/IEC 27003:2017

15 source controls mapped|28 target controls covered

14%

ISO 39001:2012 - Road Traffic Safety Management

13 source controls mapped|23 target controls covered

12%

ISO 55001:2014

12 source controls mapped|11 target controls covered

11%

ISO 14004:2016

12 source controls mapped|11 target controls covered

11%

ISO 22313:2020 - Guidance on Business Continuity Management Systems

12 source controls mapped|14 target controls covered

11%

ISO 37301

12 source controls mapped|15 target controls covered

11%

ISO 9001

12 source controls mapped|15 target controls covered

11%

ISO 41001:2018 - Facility Management Systems

12 source controls mapped|24 target controls covered

11%

ISO 56002

12 source controls mapped|23 target controls covered

11%

ISO/IEC 27018:2019

11 source controls mapped|6 target controls covered

10%

ISO 22000

11 source controls mapped|11 target controls covered

10%

ISO 37002:2021 - Whistleblowing Management Systems

11 source controls mapped|20 target controls covered

10%

ISO 55001

11 source controls mapped|14 target controls covered

10%

AS9100D - Aerospace Quality Management System

11 source controls mapped|11 target controls covered

10%

ISO 30401

10 source controls mapped|14 target controls covered

ISO 27018

9 source controls mapped|4 target controls covered

ISO 27043

8 source controls mapped|8 target controls covered

ISO/SAE 21434

8 source controls mapped|8 target controls covered

ASIS SPC.1-2009 - Organizational Resilience Standard

8 source controls mapped|8 target controls covered

ISO 45001

8 source controls mapped|8 target controls covered

ISO/IEC 29100:2024

6 source controls mapped|4 target controls covered

ISO 31000:2018

6 source controls mapped|5 target controls covered

AS9100D:2016 - Quality Management Systems for Aviation, Space, and Defence

6 source controls mapped|6 target controls covered

ISO 27005:2022

6 source controls mapped|8 target controls covered

ISO 37001

6 source controls mapped|8 target controls covered

ISO/IEC 27010:2015

5 source controls mapped|5 target controls covered

CFTC System Safeguards (17 CFR 37, 38, 39, 49)

5 source controls mapped|1 target controls covered

ISO 19011

5 source controls mapped|5 target controls covered

ISO 28001:2007 Supply Chain Security Management

5 source controls mapped|5 target controls covered

ISO/IEC 23894:2023

5 source controls mapped|11 target controls covered

EASA Part-IS - Information Security in Aviation

4 source controls mapped|11 target controls covered

ISO 13485:2016

4 source controls mapped|3 target controls covered

ISO/IEC 27031:2011

4 source controls mapped|4 target controls covered

ISO/IEC 38500:2024

3 source controls mapped|3 target controls covered

ISO/IEC TR 24028:2020

3 source controls mapped|2 target controls covered

ITIL 4

3 source controls mapped|2 target controls covered

ISO/IEC 27557:2022 - Organisational Privacy Risk Management

3 source controls mapped|3 target controls covered

ISO 22320:2018

3 source controls mapped|4 target controls covered

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

2 source controls mapped|3 target controls covered

API 1164

2 source controls mapped|2 target controls covered

ISO 20000-1

2 source controls mapped|1 target controls covered

UK Gambling Commission - Cyber Resilience Requirements

2 source controls mapped|1 target controls covered

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM)

2 source controls mapped|1 target controls covered

ISO 10006:2003

2 source controls mapped|2 target controls covered

BS 65000:2014 - Guidance on Organizational Resilience

2 source controls mapped|2 target controls covered

ISO 31000

2 source controls mapped|2 target controls covered

ISO 27019