The ISO/IEC 29100 privacy framework, turned into privacy your teams practise every day.

What it is

What is the ISO/IEC 29100 privacy framework?

ISO/IEC 29100 is the international privacy framework published by ISO and IEC through their joint committee on information security, cybersecurity and privacy protection. It sets out a common set of privacy terms, names the parties involved when personally identifiable information (PII) is processed, describes the factors that shape how PII must be safeguarded and lists the privacy principles that information technology should respect.

In practice it is the reference point that lets legal, engineering, security, procurement and business teams talk about personal data in the same words. Product teams use it to build privacy in from the first requirement; privacy leads use it as the backbone of a programme spanning several national laws. Running a certifiable management system is the role of ISO/IEC 27701.

Current edition. ISO/IEC 29100:2024, the second edition, published in February 2024. It cancels and replaces ISO/IEC 29100:2011 as a minor revision and absorbs the 2011 edition's 2018 amendment. No further revision was shown as under way on iso.org when this page was prepared.

Who it is for

Who uses ISO/IEC 29100?

The framework applies to any organisation, large or small, whose systems or services touch personal data, whether it decides why the data is used or processes it for someone else. Organisations come to Sterling for ISO/IEC 29100 from four starting points:

• A customer wants to see how you handle their people's data. Privacy questionnaires assume recognised principles and roles; the framework gives your answers a structure reviewers recognise.
• A tender or procurement framework references international privacy standards. Bid teams need to show a governed approach, and to know accurately whether the buyer expects a framework or a certificate.
• Regulators in several countries expect accountability. Different data protection laws, one programme: the framework's neutral principles give legal advisers and operations one baseline to map each law against.
• Group companies need one privacy language. Subsidiaries and acquired businesses use different terms for the same things; a common framework makes group policy and reporting possible.

Requirements

What are the main ISO/IEC 29100 requirements?

Strictly, ISO/IEC 29100 contains no certifiable requirements. It is built from two main parts, the basic elements of the privacy framework and a set of eleven privacy principles, with an informative annex relating its concepts to the ISO/IEC 27000 information security vocabulary. The summary follows the standard's own headings in plain language.

• Terms and definitions: the shared privacy vocabulary, including PII, PII principal, controller and processor.
• Actors and roles: PII principals, PII controllers, PII processors and third parties, and how they interact.
• Recognising PII: identifiers, linkable information, pseudonymous data, metadata, unsolicited PII and sensitive PII.
• Privacy safeguarding requirements: the legal and regulatory, contractual, business and other factors that set your obligations.
• Privacy policies and privacy controls: how the organisation states its intentions and puts measures in place.
• Principles on collecting data: consent and choice; purpose legitimacy and specification; collection limitation; data minimisation.
• Principles on using data: use, retention and disclosure limitation; accuracy and quality.
• Principles on individuals: openness, transparency and notice; individual participation and access.
• Principles on governance: accountability; information security; privacy compliance.

Putting it into practice

How do you implement ISO/IEC 29100?

Because the framework is guidance, the route ends in demonstrated alignment, not a certificate. If a certificate is part of the goal, the same work becomes the foundation for ISO/IEC 27701.

1. 01
   Agree the scope and the question you must answer.The services, systems, countries and processing activities in scope, and who is asking for assurance: a client, a regulator, the board or the group.
2. 02
   Gap assessment against the framework and your laws.We compare current notices, contracts, registers and system designs with the roles and principles, alongside the privacy laws your legal advisers confirm apply, and agree actions with owners and dates.
3. 03
   Map the data and assign the roles.Record what personal data you hold, where it flows and your role for each activity, then correct contracts that say otherwise.
4. 04
   Put the principles into policies, controls and design.Minimisation, retention, notice, access and security built into procedures and system requirements, with people trained and records kept.
5. 05
   Review, demonstrate and decide the next step.An internal review of the programme, an alignment report you can share with clients, and a decision on whether to proceed to ISO/IEC 27701 certification.

Check the route before you sign. Nobody can issue a genuine ISO/IEC 29100 certificate, so treat any offer of one as a warning sign. If you need certification, ask which body will audit your ISO/IEC 27701 system, whether it is accredited for privacy management certification, and whether its accreditation body is a signatory to the Global ACI arrangement; then confirm the answers with the accreditation body itself. The certification buyer's checklist

Cost

How much does an ISO/IEC 29100 programme cost?

Cost follows the size of your personal data footprint and how much of the groundwork already exists, not the length of the standard. With no certification body involved, there are no audit fees unless you add ISO/IEC 27701.

Timeline

How long does ISO/IEC 29100 implementation take?

Pace depends mostly on how quickly the people who know the data can map it, and how many contracts and systems need to change. As an estimate, an alignment programme typically takes two to four months; multi-country groups with legacy systems take longer.

If a client questionnaire or tender has a deadline, tell us at the start and we will say what can accurately be shown by then.

Your engagement

What your ISO/IEC 29100 engagement includes

Sterling OS™ structures the work. Choose Design™, where your team implements with our guidance, or Drive™, where Sterling manages it with your owners; they are alternatives, not stages. Automate™ is Effivity, and Sustain™ keeps the programme current afterwards, or after an ISO/IEC 27701 certificate is issued.

• Scope, gap assessment and plan

  Roles, owners and dates agreed before work starts, with the laws your advisers confirm apply.

• Data map and role register

  What personal data you hold, where it goes and whether you are controller or processor for each activity.

• Effivity ISO & GRC software

  Your privacy registers and records run in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Policies, controls and privacy by design

  Principles written into procedures, contracts and system requirements your teams follow.

• Internal review and alignment report

  Evidence gathered against each principle, gaps closed, and a report you can share with clients.

Sterling does not certify, attest, validate or accredit; ISO/IEC 29100 carries no certificate, and we work alongside your legal advisers rather than giving legal advice.

Often combined with

Standards organisations pair with ISO/IEC 29100

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.