ISO 27001 A.5.34 - Privacy and Protection of PII

Requirement

“The organization shall identify and meet the requirements regarding the preservation of privacy and protection of PII according to applicable laws and regulations and contractual requirements.”

Plain-language meaning

The organization must identify privacy and PII protection requirements that apply to the personal information it collects, stores, processes, transmits, shares, or retains, then implement controls to meet those requirements.

Why this matters

PII mishandling can trigger regulatory penalties, breach notification duties, contract breaches, customer harm, reputational damage, and loss of trust. Privacy is not just confidentiality; it also involves lawful purpose, minimization, access, retention, rights, transfer, processing changes, and accountability.

Implementation guidance

1. Create and maintain a PII inventory that identifies where PII is located, what categories are held, purposes of use, legal/contractual basis or justification, retention, transfers, access roles, systems, suppliers, and jurisdictions.
2. Identify applicable laws, regulations, and contractual requirements for collection, processing, access, protection, transfer, retention, breach notification, and disposal of PII.
3. Assign senior accountability for privacy/PII compliance and operational responsibility for handling PII in systems and processes.
4. Define and communicate privacy/PII policies and procedures, including collection limits, purpose limitation, access control, transmission, retention, disposal, breach reporting, and change approval.
5. Train staff who handle PII and verify they understand specific controls and reporting obligations.
6. Manage changes in PII use through approval and inventory updates, especially new purposes, new systems, new suppliers, new transfers, or new jurisdictions.
7. Review PII holdings at least annually and verify compliance against applicable legal, regulatory, and contractual requirements.
8. Maintain a matrix that maps PII protections back to source requirements so changes in law or contract can update controls quickly.

Audit guidance

Auditors should verify that the organization knows where PII is located, understands applicable legal/regulatory/contractual requirements, has implemented policies and controls, trains relevant staff, controls access and transfer, reviews PII holdings, and monitors changing requirements. Auditors should avoid relying only on policy statements and should sample actual systems, roles, transfers, suppliers, and records.

Evidence examples

Strong evidence

• PII inventory lists data categories, location, purpose, justification, retention, access roles, transfers, systems, suppliers, and jurisdictions.
• Privacy requirements matrix maps laws, regulations, contracts, and client requirements to implemented controls and evidence.
• Senior privacy accountability and operational responsibilities are assigned and understood.
• Staff handling PII receive role-specific training and can explain responsibilities.
• Access to PII is role-based, reviewed, and limited to job need.
• Annual PII review verifies holdings, purpose, retention, access, transfers, and compliance with current requirements.
• Breach notification obligations and procedures are documented and tested or exercised where appropriate.

Weak evidence

• PII is discussed generally but no inventory exists.
• The organization knows main customer databases but ignores spreadsheets, exports, logs, support tickets, backups, or supplier platforms.
• Privacy policy exists but does not map to laws, contracts, systems, or controls.
• Access to PII is broad or not reviewed.
• Staff handling PII receive only generic security awareness.
• New PII use cases are launched without approval or inventory updates.
• Breach notification requirements are unclear.

Common failures

Exam traps

• A.5.34 is about identifying and meeting privacy/PII requirements from laws, regulations, and contracts.
• A PII inventory should include purpose, justification, retention, location, access, transfers, systems, suppliers, and jurisdiction context.
• A senior role should be accountable for privacy/PII compliance.
• Staff handling PII need specific awareness of responsibilities and controls.
• PII use changes should be approved, recorded, and reflected in the asset/PII inventory.
• Privacy requirements can change quickly; monitoring and timely implementation matter.

Related controls and concepts

• A.5.31 Legal, Statutory, Regulatory and Contractual Requirements
• A.5.33 Protection of Records
• Information and Associated Asset Inventory
• Risk Assessment
• Internal Audit
• Management Review
• Legal and Contractual Requirements Register
• Evidence Request List

KB-ready summary

A.5.34 requires practical protection of legally or operationally important information. The audit question is whether the organization can show what must be protected, why, where it is, who owns it, how long it is retained, who can access it, and how protection remains effective over time.

Templates and checklists

• PII Inventory and Privacy Requirements Matrix
• PII Handling and Access Review Checklist
• Privacy Breach Notification Readiness Checklist
• A.5.34 Audit Checklist