The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) have developed ISO/IEC 27701 to address the issues organizations face around data privacy. The ISO/IEC 27701, an extension of ISO 27001, which is an international standard that provides specifications for an information security management system (ISMS), details the requirements and provides guidance on establishing, implementing, maintaining, and continually improving a privacy information management system (PIMS).

Information security is a prerequisite for effective privacy information management; the ISO/IEC 27701 augments the existing ISMS with privacy-specific controls to create a PIMS, which preserves the confidentiality, integrity, and availability of data. As a PII controller (entity that collects information from individuals) or a PII processor (entity that processes information on behalf of the controller), you are subject to multiple privacy compliance obligations; however, one of the greatest benefits of implementing a PIMS is that the provisions in the ISO/IEC 27701 map to the requirements of an array of data privacy legislations such as GDPR, CCPA, and others thereby decreasing your compliance burden and costs.

With our data privacy and information security experts, we at GRM Technologies will outline the scope of your PIMS, and conduct a risk-based analysis to determine where your presently fall short and establish the necessary controls to mitigate threats to your data. And all of this with an eye toward reducing compliance complexity and decreasing costs.

At GRM, we firmly believe that privacy is not just about increased obligations. It is about building and earning the trust of your clients and communicating to them that you are earnest about handling their personal information in a safe and responsible manner.