Context and interested parties (4.1 and 4.2)
On top of the usual factors, the standard asks you to consider applicable privacy legislation, the decisions of supervisory authorities and contractual commitments with customers that set conditions on the data. Data subjects themselves —customers, employees, patients— are interested parties too, not just the regulators.
Your role in each processing activity
The same company is often the controller for its own staff payroll and the processor for the data its customers entrust to it. That distinction decides which Annex A controls apply and must be settled before risks are assessed.
Scope of the system (4.3)
The scope sets out the processing activities, sites, systems and processes included, along with their interfaces with third parties. A scope that leaves out precisely the riskiest processing undermines the credibility of the certificate.
What an auditor usually asks for
- An inventory of processing activities with the organisation’s role in each
- A list of laws, authority decisions and contracts affecting the data
- Interested parties with their privacy expectations
- A documented PIMS scope statement
How to cover context in Kimobox
- 1Document the context of the privacy system as one more versioned record.
- 2Register interested parties and their requirements in a table with an annual review.
- 3Start from the record of processing activities to define the scope.
The scope rests on the record of processing activities, not on a separate list that quietly goes out of date.
ISO 27701 templates and records in this chapter
- ISO 27701 personal data inventory template · Good practice