BrowseToolsGuidesComparePricingStacksPlaybooksBlogSearch
ComplianceReadiness checkISO 27001ISO 42001SOC 2PCI DSSPolicy templatesControl mapCompliance softwareFramework compare
A.5.34A.5 Organizational controls

Privacy and protection of PII

A.5EVIDENCEA.6EVIDENCEA.7EVIDENCEA.8EVIDENCECONTROL MAPA.5.34 Evidence MapPOLICY / CONTROL / EVIDENCE / REVIEW

Purpose

Identify and meet the requirements for preserving privacy and protecting PII under applicable laws, regulations and contracts.

How to meet this control

In short: Identify and meet requirements for the protection of personal data.

  1. Step 01Publish a privacy and PII protection policy and appoint a responsible person such as a privacy officer
  2. Step 02Map where PII lives across systems and SaaS and align handling with the Privacy Act and Australian Privacy Principles (and GDPR where relevant)
  3. Step 03Implement technical and organisational measures (access control, encryption, minimisation) to protect PII
  4. Step 04Document procedures for data subject rights, consent and breach notification
  5. Step 05Account for legal restrictions on collecting, processing, transferring and deleting PII, including cross-border transfer

Tip: Map where PII lives and align with your privacy law (e.g. the Privacy Act / GDPR).

What ISO 27002 says to cover

Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.

  • ›Establish and communicate a topic-specific policy on privacy and PII protection
  • ›Develop procedures for preserving privacy and share them with everyone involved in processing PII
  • ›Appoint a responsible person, such as a privacy officer, to guide staff and partners
  • ›Define responsibilities for handling PII in light of relevant legislation
  • ›Implement appropriate technical and organisational measures to protect PII
  • ›Account for national laws that restrict collecting, processing, transferring or deleting PII
  • ›Consider restrictions on transferring PII to other countries

Audit evidence to keep

  • - Privacy policy and a named privacy officer or accountable person
  • - Data map or PII inventory showing where personal data is held
  • - Procedures for data subject requests, consent and breach notification
  • - Evidence of technical measures protecting PII (access controls, encryption)

Common mistakes

  • - Classifying data once and never reviewing it
  • - Allowing sensitive data into test or AI tools without approval
  • - Keeping data after the business or legal need has expired

Owner, cadence, and proof

Assign one accountable owner for A.5.34. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.

Policy templates for this control

Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.

Data breach response policyUse for ISO 27001 A.5.24 to A.5.28, SOC 2 incident handling, privacy notification, and PCI DSS requirement 12.10.Information classification and handling policyUse for ISO 27001 A.5.12, A.5.13, A.5.14, privacy, SOC 2 Confidentiality, and data handling controls.Email and communications security policyUse for ISO 27001 A.5.14 and A.8.24, information transfer, encryption in transit, phishing response, and SOC 2 communication controls.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.
Open the control-to-policy map
← A.5.33 Protection of recordsA.5.35 Independent review of information security →
Back to all organizational controls or see the requirements (clauses 4 to 10). To run this control with automation, read how AI manages controls.