ISO 27001 A.5.34: Put Privacy and PII Protection into Practice
ISO 27001 A.5.34 addresses identifying and meeting applicable requirements for privacy and protection of personally identifiable information, commonly called PII. The organisation needs to understand which requirements apply to its activities and translate them into suitable technical and organisational measures. A privacy notice alone cannot perform that work.
What A.5.34 requires in practice
Control A.5.34 asks the organisation to identify and meet the requirements for preserving privacy and protecting personally identifiable information, known as PII, in line with applicable laws, regulations and contractual obligations. PII means information that can identify a person, such as names, contact details, identification numbers or online identifiers.
In practice the control has three parts: finding out what privacy requirements apply, depending on the countries and people involved; working out where PII is held and how it is used; and putting arrangements in place that satisfy those requirements. It works alongside the legal-requirements control. The standard does not turn this into a full privacy programme and does not name a particular law. How far to go depends on the PII you handle and the rules that bind you.
Understand how personal information actually moves
Identify the activities that collect, use, store, share and dispose of personal information. Include ordinary operational pathways such as support tickets, recruitment records and spreadsheet exports. A formal application inventory may miss copies created in routine work or information sent through a new integration.
For a representative activity, identify whose information is involved, why it is needed, who receives it and which systems or suppliers handle it. Determine the applicable requirements through competent assessment. Avoid assuming that one global consent statement or contract clause answers every processing question.
Review proposed changes before information moves. A new purpose, recipient, service or location can alter the requirements and risks. Security and privacy considerations should reach project and procurement decisions early enough to influence the design, rather than appearing only in a final sign-off checklist.
Assign responsibilities that reach operations
Determine who coordinates privacy requirements, who owns the activity and who implements the relevant safeguards. ISO 27002 discusses an accountable privacy role, but A.5.34 does not universally require every organisation to use a particular job title. Applicable law may impose specific role requirements, which need separate assessment.
Provide usable instructions to personnel and service providers. Staff handling a request or unexpected disclosure need to know the authorised route and their limits. A specialist privacy contact is valuable only if operational teams can reach it and understand when consultation is required.
Why privacy and PII protection matter to the business
Personal data errors are among the most visible failures a business can have. Individuals complain, regulators investigate and clients ask hard questions about how their customers' data was handled. Many contracts also push privacy obligations onto service providers. Organisations that know what PII they hold, why and who can see it respond faster to requests and incidents and make fewer unforced mistakes. Meeting privacy requirements also builds trust with customers who increasingly choose providers on this basis. For auditors, this control tests whether general security measures reach the data that matters most to individuals.
How to implement A.5.34
Start with knowing what you hold and which rules apply. A practical route is outlined below. Privacy work succeeds when it is anchored in knowing where personal information actually sits. Walk through how a customer or employee record moves through the business, from collection to deletion, and note every system and supplier that touches it. Involve legal advice for the rules that apply in each country. Keep the notes current as new tools are adopted, since new services are the usual way personal information spreads without anyone deciding it should.
- Identify the privacy laws and contract terms that apply to your operations and clients.
- Map where PII is collected, stored, shared and deleted.
- Assign responsibility for privacy within the organisation.
- Set rules for collecting only what is needed and using it for stated purposes.
- Apply security measures proportionate to the sensitivity of the PII.
- Establish how requests from individuals and incidents involving PII are handled.
- Review as services, suppliers or laws change.
Illustrative BPO example: training material contains customer details
A hypothetical BPO team copies real customer interactions into a training pack to make examples realistic. The material includes identifiers and circumstances unnecessary for the learning objective. The team assumes that internal use is automatically covered by its ordinary service arrangements.
The activity owner reviews the intended use with appropriate privacy expertise and uses suitable synthetic or carefully prepared material where appropriate. Access and retention are also considered. The example shows why the purpose and content of a secondary use need attention, even when the source system is well protected.
Illustrative software example: a cloud integration changes the flow
A hypothetical software company connects its support platform to a cloud analysis tool. The connector sends complete ticket content, including personal information, although the business only needs aggregate service trends. The original support-platform assessment did not cover this new recipient or purpose.
The owner maps the actual transfer, assesses applicable requirements and determines whether the integration can be narrowed or redesigned. Configuration is tested against the decision. The organisation does not treat approval of the original platform as blanket approval for every connected cloud service.
Choose measures that fit the information and activity
Consider reducing unnecessary collection and copying, limiting access, protecting transfers and establishing appropriate retention and deletion. These are practical design considerations; their exact legal basis and required form depend on the activity. Avoid presenting one technique as sufficient for all privacy obligations.
Connect the measures with access rights and cloud-service governance. A technically secure repository can still contain information that should not have been collected or used for that purpose. Privacy therefore needs business decisions as well as security configuration.
Test the operating process
Follow a representative record through collection, normal use, sharing and disposition. Check whether the actual flow matches the approved understanding. Test relevant request and incident routes with suitable synthetic scenarios so that staff can demonstrate how they would escalate and act.
Review supplier responsibilities and assurance where personal information is handled externally. The organisation needs to know what the supplier has agreed and what it must still do itself. Avoid assuming that a provider’s security certificate settles every privacy question about the intended service.
Evidence and common gaps
Useful evidence includes applicability decisions, accountable roles, communicated procedures, information-flow understanding, implemented measures and checks of operation. A.5.34 does not prescribe one universal privacy-register format. Evidence should be proportionate and protected because the assessment itself may reveal sensitive information.
Common gaps include policies detached from actual processing, retention rules not implemented in exports and secondary uses introduced without review. Another is assuming that replacing names with identifiers necessarily removes every privacy concern. Assess the information and context rather than relying on a label such as “anonymous.”
Frequently asked questions
Does ISO 27001 certification establish privacy-law compliance?
No. It can support systematic information security management, but applicable privacy obligations require their own competent assessment and implementation. Certification does not provide universal legal clearance.
Must every organisation appoint a data protection officer?
A.5.34 does not universally prescribe that job title. Determine any specific legal appointment requirement and establish clear responsibilities appropriate to your activities.
Are internal uses of personal information always acceptable?
No blanket assumption is safe. The purpose, information, access and applicable requirements still matter. Assess a proposed new use through the organisation’s authorised privacy process.
Connect privacy requirements with practical safeguards
Discuss privacy-related ISMS controls with Sterling. Consulting and scoped Effivity ISO & GRC automation software can support accountable implementation. For cloud responsibilities, explore Cloud Security and Privacy training. Learning and consulting do not replace specialist legal advice or independent certification decisions. Return to the organisational controls guide.