Privacy risk assessment (6.1.2)
Risk is measured against the people whose data are processed, not just against the company: a leak of health data weighs very differently from that of a sales directory. The method is up to you, but it must produce consistent, comparable results when repeated.
Treatment and statement of applicability (6.1.3)
Controls are chosen for each risk, checked against Annex A, and a statement of applicability records which ones apply and why the rest are excluded. A processor that never collects data from data subjects can justify excluding controls designed for the controller.
Objectives and changes (6.2 and 6.3)
Privacy objectives must be measurable —for instance, the percentage of requests answered on time— and have a plan, an owner and a date. Changes to the system are planned, not improvised.
What an auditor usually asks for
- A documented privacy risk assessment methodology
- Assessment results with an owner for each risk
- A statement of applicability with exclusions justified
- Privacy objectives with an indicator and a plan
How to cover planning in Kimobox
- 1Run the risk assessment in the risk matrix, with an owner and a treatment.
- 2Keep the statement of applicability as a controlled document linked to the risks.
- 3Measure objectives with indicators drawn from the records themselves.
The statement of applicability can be shared with the ISO 27001 one when both systems coexist.
ISO 27701 templates and records in this chapter
- ISO 27701 privacy risk assessment template · Mandatory record
- ISO 27701 statement of applicability template · Mandatory document