The ultimate how to implement guide to ISO 27001 Annex A 5.34 Privacy and Protection of PII.
Table of contents
- 1. Conduct Forensic Data Discovery
- 2. Construct a Granular Record of Processing Activities (RoPA)
- 3. Implement Automated Data Retention Policies
- 4. Enforce Pseudonymisation and Anonymisation
- 5. Secure PII with Column-Level Encryption
- 6. Operationalise Subject Access Requests (DSARs)
- 7. Validate Cross-Border Data Transfers
- 8. Integrate Privacy by Design into SDLC
- 9. Audit Sub-Processor Compliance
- 10. Establish Breach Notification Protocols
1. Conduct Forensic Data Discovery
Control Requirement: Identify and classify all PII held within the organisation’s systems.
Required Implementation Step: Ignore user surveys. Run automated data discovery tools (using regex patterns for NI numbers, emails, credit cards) across all unstructured file servers, S3 buckets, and database schemas to locate “shadow” PII. Map these findings to your asset register.
Minimum Requirement: A scan report confirming the physical location of all PII, reconciled against the stated inventory.
2. Construct a Granular Record of Processing Activities (RoPA)
Control Requirement: Document the legal basis and purpose for processing PII (alignment with GDPR/DPA 2018).
Required Implementation Step: Create a detailed register that maps specific database tables and columns to a legal basis (e.g., Consent, Contract, Legitimate Interest). Ensure this document explicitly lists the “Who, What, Where, Why, and When” for every PII data set.
Minimum Requirement: A RoPA document that references specific system identifiers (Table IDs/API endpoints) rather than vague business processes.
3. Implement Automated Data Retention Policies
Control Requirement: Ensure PII is not kept for longer than necessary.
Required Implementation Step: Configure database-level retention policies (e.g., TTL indices in MongoDB, Retention Policies in SQL) to automatically purge or anonymise user data once the retention period expires. Do not rely on manual administrative deletion.
Minimum Requirement: Verified scripts or configuration settings that auto-delete PII after the defined retention period.
DO IT YOURSELF
ISO 27001
All the templates, tools, support and knowledge you need to do it yourself.
4. Enforce Pseudonymisation and Anonymisation
Control Requirement: Reduce risk to data subjects by obscuring their identity.
Required Implementation Step: Apply dynamic data masking or tokenisation to PII fields in non-production environments (staging/dev). Ensure developers work with sanitised data sets, not live customer data.
Minimum Requirement: Technical proof that Lower Environments (Dev/Test) do not contain raw, identifying PII.
5. Secure PII with Column-Level Encryption
Control Requirement: Protect PII confidentiality against unauthorised access.
Required Implementation Step: Beyond full-disk encryption, implement application-layer or database column-level encryption for highly sensitive PII (e.g., health data, financial identifiers). Manage the decryption keys strictly via a Hardware Security Module (HSM) or Key Management Service (KMS).
Minimum Requirement: Database schema showing sensitive columns are encrypted at rest.
6. Operationalise Subject Access Requests (DSARs)
Control Requirement: Facilitate the rights of data subjects (access, rectification, erasure).
Required Implementation Step: Develop and test scripts that can query all systems to extract or delete a specific user’s data upon request. Ensure this process handles “hard deletes” across backups and third-party SaaS integrations where possible.
Minimum Requirement: A tested procedure (runbook) that executes a “Right to be Forgotten” request within 72 hours.
7. Validate Cross-Border Data Transfers
Control Requirement: Ensure PII remains protected when transferred internationally.
Required Implementation Step: Audit cloud configuration regions. Ensure data is pinned to specific geographic regions (e.g., “UK South” or “EU West”) and does not replicate to non-adequate jurisdictions without Standard Contractual Clauses (SCCs) and a Transfer Risk Assessment (TRA).
Minimum Requirement: Network diagrams and cloud configs proving data residency is restricted to approved jurisdictions.
8. Integrate Privacy by Design into SDLC
Control Requirement: Consider privacy at the earliest stage of system development.
Required Implementation Step: Update the change management process. Require a Data Privacy Impact Assessment (DPIA) trigger for any code commit or schema change that introduces new PII fields. Block deployment pipelines until privacy risks are mitigated.
Minimum Requirement: Jira/Git history showing privacy reviews attached to feature branches involving PII.
9. Audit Sub-Processor Compliance
Control Requirement: Ensure third-party vendors protect your PII data. Required Implementation Step: Review every SaaS tool and vendor processing your PII. Enforce signed Data Processing Agreements (DPAs) that mandate security controls equivalent to your own. Periodically audit their SOC 2 reports or ISO certificates specifically for privacy controls.
Minimum Requirement: A central repository of signed DPAs for every external PII handler.
10. Establish Breach Notification Protocols
Control Requirement: Promptly notify authorities and subjects of PII compromises.
Required Implementation Step: Draft specific templates for notifying the ICO (or relevant authority) and affected individuals. Integrate these into the Incident Response Plan. Test the communication chain to ensure notifications can be issued within the statutory 72-hour window.
Minimum Requirement: Pre-approved legal notification templates and a tested call tree for privacy incidents.
About the author
