In this ultimate how to audit guide to ISO 27001 Annex A 5.34 Privacy and Protection of PII I, you will learn directly from an ISO 27001 Lead Auditor:
- 10 Key Audit Steps
- Verification Criteria
- Required Evidence
- The Pass / Fail Test
I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.
Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.
Table of contents
- 1. Privacy Policy and PII Handling Procedure Verified
- 2. Personal Data Inventory and RoPA Confirmed
- 3. Data Protection Impact Assessment (DPIA) Execution Validated
- 4. Data Subject Rights Request (DSRR) Mechanism Verified
- 5. Privacy by Design and Default Implementation Confirmed
- 6. Secure PII Disposal and Anonymisation Procedures Verified
- 7. Data Transfer Agreements (DTA) and SCCs Validated
- 8. PII Access Restriction and Least Privilege Verified
- 9. Privacy Awareness Training Records Identified
- 10. PII Breach Notification Procedure and Logging Confirmed
Auditing ISO 27001 Annex A 5.34 is the technical verification of an organization’s governance over personal data to ensure regulatory compliance. The Primary Implementation Requirement is a functional Record of Processing Activities, providing the Business Benefit of mitigated legal risks and enhanced data subject trust through transparent handling.
1. Privacy Policy and PII Handling Procedure Verified
Verification Criteria: A documented policy exists that defines the organisation’s requirements for the protection of Personally Identifiable Information (PII) in accordance with applicable laws.
Required Evidence: Approved Privacy Policy and PII Handling Procedure with explicit version control and management sign-off.
Pass/Fail Test: If the organisation lacks a formalised policy that specifically addresses the protection of PII, mark as Non-Compliant.
2. Personal Data Inventory and RoPA Confirmed
Verification Criteria: A Record of Processing Activities (RoPA) is maintained, identifying all PII categories, purposes of processing, and data flows.
Required Evidence: A current RoPA or Data Inventory mapping PII across internal systems and third-party processors.
Pass/Fail Test: If the organisation cannot identify where PII is stored or the legal basis for processing specific data categories, mark as Non-Compliant.
3. Data Protection Impact Assessment (DPIA) Execution Validated
Verification Criteria: High-risk processing activities are subjected to a formal DPIA to identify and mitigate privacy risks before processing begins.
Required Evidence: Signed DPIA reports for all major technical projects or high-risk data processing operations initiated in the current cycle.
Pass/Fail Test: If a new high-risk system (e.g., automated profiling or large-scale health data) was launched without a completed DPIA, mark as Non-Compliant.
