Controls for controllers and processors

An annex of controls in its own right

In the 2019 edition the controls built on those of ISO/IEC 27002 with privacy additions. In the 2025 edition Annex A stands alone: it groups the controls according to whether they apply to the controller, the processor or both, and it brings in the security controls that have a direct impact on privacy.

What they cover

For the controller: conditions for collection and processing —purpose, lawful basis, consent, impact assessment—, obligations towards data subjects, privacy by design and transfers. For the processor: agreements with the customer, processing only on its instructions, sub-processors and disclosures to third parties.

Annex B and the statement of applicability

Annex B is the implementation guidance for each control. Every Annex A control is either applied or excluded with a justification in the statement of applicability (6.1.3): no auditor expects a processor to apply the controller’s controls, but they do expect it to explain why.

What an auditor usually asks for

• The organisation’s role defined for each processing activity
• A statement of applicability that covers the whole of Annex A
• Evidence of implementation for each applied control
• A justification for every exclusion

How to cover the controls in Kimobox

1. 1Load the Annex A controls into the statement of applicability with their status.
2. 2Link each control to the record that evidences it: processing activities, rights, contracts.
3. 3Assign an owner and a review date to each applied control.

ISO 27701 templates and records in this chapter

• ISO 27701 record of processing activities template · Mandatory document
• ISO 27701 privacy impact assessment template · Mandatory record
• ISO 27701 consent record template · Mandatory record
• ISO 27701 data subject request log template · Mandatory record
• ISO 27701 personal data breach log template · Mandatory record
• ISO 27701 data processing agreement template · Mandatory document