Control A.5.34Privacy and protection of PII
The organisation must identify and meet the requirements regarding the preservation of privacy and protection of personally identifiable information according to applicable laws and regulations and contractual requirements.
The bridge between the ISMS and data protection law. For an organisation in the EU that means the GDPR and the national law alongside it, and the control does not reproduce those obligations — it requires them to be identified and met.
The relationship worth getting right is that security is one part of data protection and not the whole of it. An ISMS can deliver the security of processing; it does not deliver lawful basis, transparency, purpose limitation, data subject rights or transfer mechanisms, and an organisation that treats certification as evidence of data protection compliance has conflated the two.
Where they meet most concretely is breach notification. A personal data breach carries its own statutory clock, assessed against different criteria from a security incident, and the incident process under A.5.24 has to make that assessment rather than assume it.
How to put this in place
Personal data brings legal duties that overlap with the ISMS. Treating privacy as a separate world leads to personal data missing from your risk assessment.
- Identify where personal data is processed and which privacy laws apply.
- Name who is responsible for privacy.
- Keep records of processing and link them to the asset inventory.
- Carry out impact assessments where needed.
- Link breach notification to the incident procedure and the ISMS risk assessment.
Evidence an auditor usually looks for: records of processing, privacy impact assessments, the breach notification procedure, and the named privacy lead.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists records of processing of personal data among the documents auditors commonly expect for this control.