ISO 27701

The controller identifies and records the specific purposes for which personal data is processed.

The controller determines, records and can show the legal basis for each processing purpose.

The controller works out where consent is required and sets a documented way to request it.

Where consent is relied on, the controller obtains it and keeps a record that shows when and how it was given.

Before new or changed processing that could affect people, the controller assesses the privacy impact and records the outcome.

Contracts with processors set out what they may do with personal data and the protections they must apply.

Where processing is shared with another controller, each party's privacy responsibilities are agreed and recorded.

The controller keeps records of its processing activities in enough detail to show accountability.

The controller identifies its legal and contractual obligations to the people whose data it processes, and meets them.

The controller determines what information people must be given about the processing of their data, and when.

People receive clear, accessible information about how their data is processed.

People can change or withdraw their consent as easily as they gave it.

People can object to processing of their data, and objections are handled.

The controller provides ways for people to see, correct or delete their data and acts on requests.

When data is corrected, erased or restricted, the controller tells third parties it shared the data with.

On request, people can receive a copy of their data, in a usable format where required.

Requests from individuals are received, verified, tracked and answered within set timescales.

Where decisions about people are made by automated means, the controller meets its obligations, including human review where required.

Collection of personal data is limited to what is relevant and necessary for the stated purposes.

Processing is limited to what is needed for the identified purposes.

The controller keeps personal data accurate and up to date for its purposes.

The controller sets objectives for minimising data and the methods (such as pseudonymisation) used to meet them.

When personal data is no longer needed for its purpose, it is deleted or made non-identifiable.

Temporary files holding personal data are deleted within a defined period.

Personal data is kept only as long as needed for its purposes.

Documented methods are used to dispose of personal data securely.

Personal data sent over networks is protected so it reaches the intended destination only.

The controller identifies and records the legal basis for moving personal data between jurisdictions.

The controller states which countries and international organisations personal data may go to, and tells people.

Transfers of personal data to or from other parties are recorded.

Disclosures of personal data to third parties are recorded, including what, to whom and when.

The processor's contract with each customer covers how it will help the customer meet its privacy obligations.

The processor uses customer personal data only for the purposes the customer has instructed.

Customer personal data is not used for marketing or advertising without proper consent.

The processor tells the customer if an instruction appears to break privacy law.

The processor gives customers the information they need to show they meet their obligations.

The processor keeps records of the processing it carries out on behalf of each customer.

The processor gives customers the means to meet requests from the people whose data it processes.

Temporary files holding customer personal data are deleted within a defined period.

At the end of a contract, customer personal data is returned, transferred or securely disposed of as agreed.

Customer personal data sent over networks is protected.

The processor tells customers how it moves data between jurisdictions and on what legal basis.

The processor states which countries and organisations customer data may be transferred to.

Disclosures of customer personal data to third parties are recorded.

The processor tells customers about legally binding requests to disclose their data, unless prohibited.

Legally binding disclosure requests are checked and only valid ones are met.

The processor tells customers which sub-processors it uses before they process customer data.

Sub-processors are engaged only with customer authorisation and under a contract with equivalent protections.

Customers are told about changes to sub-processors and can object.

Security policies are approved and published, and address the protection of personal data.

Roles for information security and privacy are defined and allocated, including a privacy lead.

The classification scheme accounts for personal data and its sensitivity.

People handling information can tell when it contains personal data.

Rules and agreements protect personal data when it is shared or transferred.

User identities are managed across their life cycle, including those that can reach personal data.

Access to personal data is granted on need, reviewed and removed when no longer needed.

Supplier agreements include security and privacy terms for personal data.

Incident management planning covers breaches of personal data, including notification duties.

Incidents affecting personal data are responded to and recorded.

Privacy-related legal, regulatory and contractual requirements are identified and kept current.

Records are protected from loss, destruction, falsification and unauthorised access.

The approach to security and privacy is reviewed independently at planned intervals.

Compliance with privacy and security policies is regularly checked.

Staff receive awareness and training that covers handling personal data.

People with access to personal data are bound by confidentiality terms.

Rules prevent personal data being left visible on desks and screens.

Storage media holding personal data are managed, protected and disposed of securely.

Equipment is wiped of personal data before disposal or reuse.

Laptops, phones and other endpoints that hold or reach personal data are protected.

Strong authentication protects access to systems holding personal data.

Backups protect against loss of personal data and are tested.

Logs record access to and processing of personal data and are protected.

Encryption protects personal data where needed, with keys managed.

Secure development includes privacy requirements from the start.

Applications that process personal data have defined security requirements.

System architecture applies security and privacy principles.

Outsourced development that touches personal data is directed and checked.

Personal data is not used for testing unless protected, and masked data is preferred.