ISO 27701

Identify project stakeholders and key contacts and develop a communication plan. Define program priorities and system scope and applicability. Establish and define what success looks like. Determine the organization’s role as either a Controller, Processor, or both.

Conduct a communication program to suppliers and other stakeholders. Define roles and responsibilities. Identify applicable privacy legislation. Appoint representative(s) in other countries and a Data Protection Officer (if required). Conduct a competence and training needs assessment. Perform privacy-related training, information security awareness training, and familiarization.

Conduct an initial PII information gathering exercise and perform an audit of PII by business area. Identify the lawful basis for processing PII in each case. Conduct legitimate interest assessments where required.

Create and implement PII principal request procedures and define a PII retention and protection policy. Create or amend existing privacy notices. Develop and implement PIMS extensions to the existing ISMS. Review and amend consent methods and procedures. Update contracts with controllers to be compliant. Address employee confidentiality requirements.

Define the privacy impact assessment process and perform an initial PIA. Identify international transfers of PII. Assess the legality of existing international transfers.

Create an information security incident management and PII breach notification procedure. Conduct information security incident management training. Test incident management and breach notification procedures.

Resolve any nonconformities identified during the audit and achieve certification. Ensure planning and adherence to all recurring requirements for Year 2 and Year 3. Work alongside staff to continue providing ongoing guidance, direction, and support in the above capacities through each surveillance audit.