ISO 27001:2022 · Organizational controls
ISO 27001:2022 5.34: Privacy and protection of personal identifiable information (PII)
ISO 27001:2022 5.34 covers Privacy and protection of personal identifiable information (PII). The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.5.34, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Privacy is treated as a legal matter only, with no link to security controls.
The organization is to identify, and then satisfy, the requirements for preserving privacy and protecting personally identifiable information that arise from applicable laws, regulations and contracts. Purpose (stated in ISO/IEC 27002:2022): ensures compliance with requirements on the information security aspects of protecting PII. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.34.
What evidence supports 5.34?
- Annex A organizational controlStatement of Applicability entry for control A.5.34, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A organizational controlThe topic-specific privacy and PII protection policy and its communication to relevant parties
- Annex A organizational controlPrivacy procedures communicated to everyone who processes PII
- Annex A organizational controlAppointment of a privacy officer or equivalent with documented responsibilities
- Annex A organizational controlA record of processing or PII inventory mapping which laws apply to each processing activity
Where this requirement comes from
This is our own statement of ISO 27001:2022 5.34, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Privacy is treated as a legal matter only, with no link to security controls
- No one is formally responsible for guiding staff and providers on PII handling
- Cross-border transfers of PII occur without checking applicable restrictions
- Privacy impact assessments are not performed for new processing
How it maps to SOC 2
- P5.1 high Privacy and protection of PII requires access to personal data be controlled.
- P6.1 high PII protection requirements govern disclosure of personal data to third parties.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.