Privacy and protection of personal identifiable information (PII)

Plain-language summary

Identifying and meeting the privacy and personal-information protection requirements that apply to your organisation under law, regulation and contract — POPIA in South Africa, GDPR where it applies — and showing how the ISMS supports them.

What the clause is really asking

Personal information is usually an organisation's most regulated information; this control ties the ISMS to privacy law. It asks you to identify and meet the requirements for preserving privacy and protecting personally identifiable information (PII) that apply to you. That typically means a privacy policy; knowing what personal information you hold, where, why and on what lawful basis; someone accountable; technical and organisational measures proportionate to the risk; and handling data subject requests, breaches, cross-border transfers and operators. In South Africa this is POPIA: the eight conditions for lawful processing, and the Information Officer — by default the head of the organisation — whose duties are set by sections 55 and 56 and Regulation 4 (a compliance framework, a personal information impact assessment, the PAIA manual, internal measures and awareness sessions), and who must be registered with the Information Regulator. GDPR applies if you offer services to, or monitor, people in the EU. The common misunderstanding is that ISO 27001 certification proves POPIA compliance; security safeguards (section 19) are one condition of eight. ISO/IEC 27701 extends the ISMS into privacy management.

What auditors look for

Auditors ask for the privacy policy, the record of what personal information is processed and the Information Officer's registration. They test the Regulation 4 duties: is there a compliance framework, has a personal information impact assessment been done, is the PAIA manual current and available? They sample a process such as recruitment or customer onboarding and trace the personal information through collection, use, storage, sharing with operators and deletion. They ask for the data subject request log and how requesters are verified. The hard question: what personal information do you hold that you no longer need, and why is it still here?

Typical evidence

Privacy or data protection policy; processing register of personal information with purpose, lawful basis, location and retention; Information Officer and deputy designations and Regulator registration; personal information impact assessments; PAIA manual; operator agreements; data subject request log; privacy notices; cross-border transfer assessments; privacy awareness training records.

How to comply — recommendations

Confirm who the Information Officer is, designate deputies in writing, and check registration with the Information Regulator. Build a processing register by department: what personal information, why, lawful basis, where it lives, who it is shared with and how long it is kept. Run a personal information impact assessment for the high-risk processes, typically HR, customer data and CCTV. Update the PAIA manual and privacy notices. Put operator agreements in place (see 5.20). Set up a simple log and procedure for access and correction requests. Report privacy status to management at least once a year. If you serve customers in the EU, check your GDPR obligations with an adviser.

Common nonconformities

Information Officer not registered or deputies not designated; no inventory of personal information processed; no personal information impact assessment; PAIA manual missing or out of date; privacy notices absent or inaccurate; no procedure for data subject requests; operators processing personal information without written agreements; ISO 27001 controls treated as the whole of POPIA compliance.

Resources for this clause

• ArticlePOPIA section 19 and ISO 27001: how the standard evidences the law — and why a certificate is not compliance
• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Free downloadPOPIA ↔ ISO 27001 CrosswalkTwenty-four POPIA and Regulation 4 duties in plain words, each mapped to the ISO/IEC 27001:2022 clauses and Annex A controls that evidence it — with the GDPR article and NIST CSF 2.0 category alongside, the evidence to show, and a status you mark.
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.