Category: ISO/IEC 27701

ISO/IEC 27701 has entered a new phase. Published on 14 October 2025, ISO/IEC 27701:2025 replaces the 2019 edition and transforms the Privacy Information Management System (PIMS) standard from an extension of ISO/IEC 27001 and ISO/IEC 27002 into an independent management system standard.

For organizations currently certified to ISO/IEC 27701:2019, this is not simply an editorial revision. The new edition changes the structure of the standard, strengthens privacy governance and reorganizes requirements and controls for personally identifiable information (PII) controllers and processors.

Under the transition arrangements communicated to QRC-certified clients, organizations holding QRC-issued accredited ISO/IEC 27701:2019 certification must complete their transition to ISO/IEC 27701:2025 by 31 October 2027. After the applicable deadline, accredited certification against the 2019 edition will no longer remain valid.

So, what has changed, and what should certified organizations do now?

What Is ISO/IEC 27701:2025?

ISO/IEC 27701:2025 specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System.

A PIMS helps an organization manage PII systematically by bringing privacy responsibilities, risks, controls, objectives, monitoring and continual improvement into a defined management framework. The standard applies to organizations acting as PII controllers, PII processors or both, regardless of their type, size or sector.

The International Organization for Standardization describes ISO/IEC 27701 as a framework that helps organizations demonstrate accountability, manage risks involving PII and continually improve privacy practices. It can also support an organization’s efforts to address applicable privacy obligations, although certification does not automatically establish compliance with every privacy law.

The Biggest Change: PIMS Is Now a Standalone Standard

ISO/IEC 27701:2019 was designed as an extension to ISO/IEC 27001 and ISO/IEC 27002. In practice, organizations implemented privacy requirements within an existing Information Security Management System (ISMS).

The 2025 edition changes this model. ISO/IEC 27701 can now be implemented and audited as an independent management system standard, without ISO/IEC 27001 certification being a prerequisite.

This makes formal privacy management more accessible to privacy-led organizations that may not require a separately certified ISMS. It also allows PIMS governance to be structured around privacy-specific objectives while retaining the ability to integrate with ISO/IEC 27001 and other management systems.

For organizations already operating an integrated ISMS and PIMS, the change does not mean the systems must be separated. The harmonized structure can support continued integration, provided the organization clearly addresses all applicable requirements and maintains effective governance across both systems.

Key Changes in ISO/IEC 27701:2025

Alignment with the ISO Harmonized Structure

The revised standard follows the familiar management system structure across Clauses 4 to 10:

• Context of the organization
• Leadership
• Planning
• Support
• Operation
• Performance evaluation
• Improvement

This structure improves alignment with standards such as ISO/IEC 27001, ISO 9001 and ISO/IEC 42001. Organizations operating multiple management systems may therefore find it easier to coordinate common processes such as objectives, competence, internal audits, management reviews, corrective actions and continual improvement.

However, structural familiarity should not be mistaken for automatic conformity. Existing PIMS documentation must be reviewed to ensure privacy-specific requirements are addressed in their new clause locations and supported by suitable evidence.

Stronger Organizational Context and Privacy Governance

The revised structure places privacy within the organization’s broader strategic and operational context. Organizations need to consider the nature of their PII processing, interested parties, applicable legal and regulatory environments, technology dependencies and internal or external factors that may affect privacy outcomes.

Leadership also has a clearer role in ensuring that privacy responsibilities are embedded across relevant functions. Privacy is not solely an IT or compliance concern it can affect product design, marketing, human resources, procurement, legal, customer operations and third-party management.

Updated Controls for PII Controllers and Processors

ISO/IEC 27701:2025 reorganizes the privacy control structure and continues to distinguish between responsibilities applicable to PII controllers and PII processors.

Organizations should revisit how they determine their role for each processing activity. A business may act as a controller in one context and a processor in another, which can change its obligations, contractual responsibilities and applicable controls.

The revised annex structure also provides implementation guidance and mappings that can help organizations understand the relationship between the new and previous editions.

Greater Focus on Privacy Risk

The new edition strengthens the independent treatment of privacy risk within the management system. Risk assessment should consider how PII processing may affect individuals as well as the organization.

This broader perspective is important when evaluating new technologies, automated decision-making, AI-assisted processing, extensive monitoring, large-scale analytics, international operations and complex processor relationships.

Improved Alignment with Other Privacy Frameworks

The revised standard includes mappings to support comparison and integration with recognized privacy references, including the ISO/IEC 29100 Privacy Framework and the EU General Data Protection Regulation. It also provides links to standards relevant to public-cloud PII processing and the protection of PII.

These mappings can assist organizations in understanding relationships between requirements, but they do not replace a legal assessment of the privacy laws applicable to a particular processing activity or jurisdiction.

Who Needs to Transition?

The transition applies to organizations holding accredited ISO/IEC 27701:2019 certification that want to maintain valid accredited PIMS certification beyond the applicable deadline.  It is relevant across sectors, including:

• Technology and software companies
• Cloud and managed service providers
• Financial institutions and fintech organizations
• Healthcare and life-sciences organizations
• E-commerce and digital-platform businesses
• Business process outsourcing providers
• Government and public-sector entities
• Organizations processing employee, customer or partner PII at scale

For QRC-certified clients, the transition should be planned within the existing certification cycle so that the required audit and certification activities are completed no later than 31 October 2027.

What Happens If the Transition Is Not Completed?

Organizations that do not complete the transition by the applicable deadline risk losing the validity of their accredited ISO/IEC 27701 certification against the withdrawn 2019 edition.  That outcome may affect contractual commitments, supplier qualification, tenders, customer assurance and public claims linked to certified privacy management. Leaving the transition until the end of the window also creates operational risk: identified gaps may require changes to governance, documentation, controls, training and evidence before conformity can be demonstrated.  Early planning provides time to make controlled improvements and align the transition audit with an upcoming surveillance or recertification activity where feasible.

A Practical ISO/IEC 27701:2025 Transition Roadmap

1. Review and Scope –  Understand the revised requirements, confirm the certified PIMS scope and identify where the organization acts as a PII controller or processor.
2. Assess the Gaps –  Compare the existing PIMS with ISO/IEC 27701:2025, covering governance, privacy risks, controls, documented information and supporting evidence.
3. Implement Required Changes –  Update relevant policies, procedures, risk records, responsibilities and privacy controls. Address emerging risks involving AI, cloud services, third parties and cross-border data transfers.
4. Validate Readiness –  Build awareness among relevant teams, complete an internal audit and conduct a management review against the revised requirements.
5. Complete the Transition Audit –  Coordinate the transition audit with QRC within the existing certification cycle, allowing sufficient time to address findings before 31 October 2027.

Common Transition Mistakes to Avoid

Organizations can make the transition more manageable by avoiding a few recurring mistakes :

• Treating the revision as a clause-renumbering exercise
• Assuming ISO/IEC 27001 certification automatically demonstrates conformity with the standalone PIMS requirements
• Failing to reassess controller and processor roles
• Updating policies without validating operational implementation
• Overlooking cloud, AI, transfer and third-party processing risks
• Conducting the internal audit too close to the transition audit
• Waiting until 2027 to begin planning

The transition should strengthen the PIMS-not merely preserve the certificate.

Questions Leadership Should Ask

Leadership and privacy teams can use the transition to test whether the PIMS remains aligned with the organization’s current risk environment:

• Can we clearly identify where and why we process PII?
• Are our controller and processor roles accurate for each significant processing activity?
• Have changes in technology, AI use, cloud services or international transfers altered our privacy risks?
• Can process owners demonstrate that documented privacy controls operate effectively?
• Do our internal audit and management review processes evaluate privacy outcomes, not only procedural completion?
• Is our transition audit scheduled early enough to address unexpected findings?

If any of these questions are difficult to answer, the organization should prioritize them within its transition plan.

Plan Your ISO/IEC 27701:2025 Transition with QRC

ISO/IEC 27701:2025 gives privacy management a clearer, independent foundation while preserving compatibility with established ISO management systems. Organizations that begin early can use the transition to improve accountability, strengthen privacy-risk governance and demonstrate continued confidence to customers and stakeholders.

QRC Assurance and Solutions is an accredited certification body for ISO/IEC 27701. QRC-certified clients should coordinate their transition audit within the existing certification cycle and complete all applicable transition requirements by 31 October 2027.

Ready to plan your transition to ISO/IEC 27701:2025?

Contact QRC to confirm the certification transition process, expected audit arrangements and suitable scheduling for your organization.

Frequently Asked Questions

1. When was ISO/IEC 27701:2025 published?
   ISO records the publication date of the second edition as 14 October 2025. It replaces the withdrawn ISO/IEC 27701:2019 edition.
2. What is the ISO/IEC 27701:2025 transition deadline for QRC-certified clients?
   Under the transition arrangements communicated to QRC-certified clients, the transition must be completed by 31 October 2027. Organizations should confirm their individual audit plan and certification-cycle arrangements with QRC.
3. Is ISO/IEC 27001 still required for ISO/IEC 27701:2025?
   No. ISO/IEC 27701:2025 is an independent management system standard and can be used without ISO/IEC 27001. Organizations may still integrate their PIMS and ISMS where this supports their objectives and operating model.
4. Can the transition audit be combined with a surveillance or recertification audit?
   Transition activities may be planned within the existing certification cycle, subject to applicable accreditation and certification arrangements. Organizations should coordinate the timing and audit requirements directly with QRC.
5. Does ISO/IEC 27701 certification prove compliance with privacy laws?
   Certification demonstrates that the organization’s PIMS conforms to the applicable standard requirements within its certified scope. It can support accountability and regulatory-alignment efforts, but it does not automatically prove compliance with every applicable privacy law.

Role and Responsibilities Questions

Q1: What exactly is a Data Protection Officer supposed to do under DPDP?

The DPO serves as the point of contact between the organization and the Data Protection Board of India. Your responsibilities include overseeing the organization’s data protection strategy, ensuring compliance with the DPDP Act and Rules, serving as the contact point for data principals exercising their rights, liaising with the Data Protection Board, and conducting or overseeing data protection impact assessments. The role requires both legal understanding and operational capability – you need to understand the law and translate it into processes your organization can execute.

Q2: Do I need to be based in India to serve as DPO?

For Significant Data Fiduciaries, the DPO must be based in India. This is an explicit requirement under the DPDP Act. For other data fiduciaries, while there is no strict residency requirement for the privacy lead, having someone in India who understands the local regulatory landscape and can engage with the Data Protection Board is practically essential.

Q3: Can the DPO role be combined with other positions?

The DPDP Act does not explicitly prohibit dual roles, but the DPO must have sufficient authority and independence to fulfill the role effectively. Avoid combining the DPO role with positions that create conflicts of interest – for example, the DPO should not also head the marketing function that relies heavily on personal data processing.

Consent and Legal Basis Questions

Q4: What makes consent valid under DPDP?
Consent must be free, specific, informed, unconditional, and unambiguous. It must be given through a clear affirmative action. Pre-ticked checkboxes, consent bundled with terms of service, or consent conditional on receiving a service are not valid. Each purpose of processing requires separate consent, and data principals must be able to withdraw consent as easily as they gave it.

Q5: Can we process personal data without consent?
Yes, in specific circumstances called legitimate uses. These include processing necessary for the performance of a function under law, compliance with court orders or judgments, responding to medical emergencies, processing for employment purposes, and processing in the public interest. Each legitimate use has specific conditions that must be met – it is not a blanket exception.

Q6: How should we handle consent for data we collected before DPDP came into force?
You need to provide a notice to data principals about the personal data you already hold and the purposes for which it was collected. If the original collection was based on consent, that consent remains valid provided the purpose has not changed. If you want to use previously collected data for new purposes, you need fresh consent. The DPDP Compliance Rules specify the timeline for sending these retrospective notices.

Q7: Do we need consent for every cookie on our website?
DPDP focuses on personal data processing, not specifically on cookies. However, cookies that collect or process personal data – such as those used for behavioral tracking, personalization, or analytics that identify individuals – require consent. Strictly necessary cookies that are essential for website functionality may not require consent, but this should be assessed case by case.

Data Rights and Breach Questions

Q8: What is the timeline for responding to data principal rights requests?
The DPDP Rules specify response timelines for rights requests. You should aim to acknowledge receipt within 48 hours and complete the request within the prescribed period. Having a documented workflow with assigned responsibilities and tracking mechanisms is essential for meeting these timelines consistently.

Q9: What counts as a personal data breach under DPDP?
A personal data breach is any unauthorized processing, accidental or unlawful destruction, loss, alteration, disclosure, or access to personal data. This is broader than just external hacking – it includes accidental data exposure, misdirected emails containing personal data, lost devices with unencrypted personal data, and insider access violations.

Q10: How quickly must we report a breach?
The DPDP Act requires notification to the Data Protection Board and affected data principals without unreasonable delay. The DPDP Rules provide more specific timelines. Your incident response plan should include clear criteria for when a security incident becomes a reportable personal data breach, and the notification process should be pre-documented so it can be executed quickly during a real incident.

Q11: Do we need to notify every data principal affected by a breach?
Yes, when the breach is likely to cause harm to the data principal. The notification must describe the nature of the breach and the measures the data principal can take to protect themselves. The Data Protection Board may also direct specific remedial actions.

Cross-Border and Vendor Questions

Q12: Can we transfer personal data outside India? 

The DPDP Act permits cross-border transfer of personal data to countries that are not on the restricted list published by the central government. If your data processing involves transfers to countries on the restricted list, those transfers are prohibited unless specifically exempted. For countries not on the restricted list, transfers are permitted, but you must ensure that the processing by the overseas entity complies with the Act’s requirements through appropriate contractual arrangements.

Q13: What data processing agreements do we need with our vendors? 

Every data processor that processes personal data on your behalf must be governed by a valid contract or data processing agreement. This agreement should specify the nature and purpose of processing, the types of personal data involved, the duration of processing, the obligations of the processor regarding security measures, the requirement to delete or return data upon termination, and the audit rights of the data fiduciary.

Q14: Are cloud service providers considered data processors under DPDP?

Yes. If your organization uses cloud services to store or process personal data, the cloud provider is acting as a data processor. Your agreement with the provider must address DPDP requirements, including data localization if applicable, security measures, breach notification, and the provider’s obligations regarding data principal rights requests.

Q15: How do we manage compliance when we use multiple sub-processors? 

Maintain a register of all sub-processors in your data processing chain. Ensure that each sub-processor is bound by contractual obligations that are at least as protective as your agreement with the primary processor. Implement regular assessments of sub-processor compliance and maintain visibility into where your data is being processed across the chain.

Q: Is DPO certification required under DPDP?

A: The DPDP Act does not mandate a specific certification for DPOs. However, having relevant privacy certifications demonstrates competence and is increasingly expected by organizations and regulators.

Q: Can we outsource the DPO function?

A: For non-SDF organizations, engaging an external DPO or privacy consultant is permissible. Significant Data Fiduciaries may need to evaluate whether the role can be effectively fulfilled externally given the in-India residency requirement.

QRC provides DPDP compliance advisory and DPO support services. Contact us to strengthen your data protection program.

Privacy Information Management System (PIMS) standard called ISO/IEC 27701 was created to assist organisations in adhering to privacy legislation all over the world. Numerous nations have passed new data protection legislation in recent years that specify the conditions for safeguarding and handling personally identifiable information (PII). However, it isn’t always obvious how businesses should abide by these rules. The 2019 release of ISO 27701 offers organisations practical advice to help them comply with these many rules.

The information security management system (ISMS) standard ISO/IEC 27001 has been expanded with ISO/IEC 27701:2019. ISO/IEC 27701 focuses primarily on protecting personal data, while ISO/IEC 27001 establishes a standard for secure IT governance in the broadest sense. The first international standard of its kind, ISO/IEC 27701, is applicable to both public and private businesses, as well as to governmental and non-profit organisations. It encourages adherence to all other regions’ personal data governance regulations as well as the GDPR in the EU.

How Come ISO 27701 Certification Is Essential? 

National governments and organisations like the EU have enacted stringent new legislation regarding private data privacy in the wake of several high-profile data breaches. The PII of citizens, including names, residences, age, bank account information, and more, are protected by these data protection regulations. However, it might be very difficult to comprehend how to apply these standards to your organization’s ISMS. Additionally, it is difficult and time-consuming for organisations to ensure compliance with the data governance requirements of numerous nations when processing customer and employee data across multiple jurisdictions. You are supported by ISO/IEC 27701, which offers a standardized method of adhering to all of these laws.

Following are some advantages of ISO 27701 certification:

• Clarification of the roles and responsibilities of PII controllers and processors as well as adherence to all pertinent data protection legislation.
• Increase stakeholder trust in your privacy and data protection procedures and gain a competitive edge with ISO/IEC 27701 certification.
• To fulfil the requirements of international data governance regulations, achieve world-class standards through a strict risk- and compliance-driven strategy.
• Increase openness by employing thorough security and privacy controls to track and report data privacy advances.
• Reduce PII-related risk by monitoring changing privacy risks and the regulatory environment.
• Demonstrate that you adhere to PII protection requirements around the world, supporting business ties with your customers and suppliers.

Read more about this: 10 Essential Requirements of GDPR Summarized.

In the data dependent world today, organizations across the globe are dealing with Personal Data in some extent or another. The increasing number of sensitive data sharing services and platforms have raised concerns around Personal Data and Personal Identifiable data to a great extent. Private Data protection is an immediate need, especially for organizations that act as PII controllers / Fiduciaries and/or PII Processors.

To address this need, Regulatory bodies across the globe have introduced significant data privacy legislation/regulation to protect the Data Subjects / PII Principals. The privacy specific ISO 27701:2019 standard, GDPR, California Consumer Privacy Act and Philippines Data Protection Act are a few to name.

While going through these multiple privacy regulations across various countries, its clear that the emphasis is more towards the expectations from Data Processors and/or Data controls of Personal Data. These acts/ regulations state about what the organization is supposed follow to avoid any penalties and consequences in case of any breach or non-compliance to the legislations. The regulations guide everyone on how to meet those expectations in terms of Protection of the Personal data and supporting rights of data owners etc.

ISO 27701:2019 – Extension of the renowned ISO 27001:2013

ISO 27701 specifies the requirements, providing guidance for establishing, implementing, and maintaining a privacy management system for information. The standard is an extension to ISO/IEC 27001 and ISO/IEC 27002.

As PII controllers and PII processors hold major responsibility and accountability while managing the PII, the standard stated privacy requirements apply to all size organizations that process PII within the scope of ISMS. The clear guidance helps organizations to establish, implement, and maintain the Privacy framework within their system, helping them with the data protection measures.

The PIMS’s Clauses 5 through 8 are drafted specially for the data protection program.

Clause 5 – Data Protection: Addresses every clause in ISO 27001 and identifying organization’s status to recognize the need for data protection, considering the organization’s role in relation to PII as a controller or processor.

Clause 6: PIMS-specific guidance on ISO 27002 controls: Establishes a top-level amendment for ‘information security’ that needs to be included under privacy, having significantly impact on data protection.

Clause 7: Additional guidance for PII controllers: Guidance on ISO 27701’s Annex A controls that address critical areas of data protection and privacy that are not accounted for by the controls provided in ISO 27001.

Clause 8: Additional guidance for PII processors: Guidance on ISO 27701’s Annex B controls addressing critical areas of data protection and privacy that are not accounted for by the controls provided in ISO 27001.

The implementation guidance and key references stated in ISO 27701 touches base with the elements to identify:

1. Impact assessment (like the kind of data the organization is collecting or processing)
2. Location of the data storage (comprising of the locations impacting the data),
3. Transfer of data takes place between any other parties or processing companies.

To understand these data elements better, the organization can depend on its internal Data Flows, Process mapping documents and more.

Meeting compliance with GDPR, CCPA, CPL

The robust guidelines and requirements stated in the ISO 27701, helps any organization implementing to come certainly halfway in meeting any other privacy legislations and regulations without much hassle. ISO 27701 provides basic requirements and guidance for the following aspects of

1. Conditions for Collection and Processing of Personal Data
2. Obligations towards Data Owners/ PII Principals
3. How to implement Privacy by design and Privacy by default
4. Conditions applied for Data Sharing, Transfer and Disclosure

Mapping with GDPR:

ISO 27701 Annex D, provides an indicative mapping between the requirements of GDPR and the controls stated under PIMS, indicating how fulfilling compliance as per ISO 27701 can help fulfil multiple obligations of GDPR as well.

Mapping to ISO/IEC 29100 :

Annex C of the PIMS provides an indicative mapping between provisions of this document and the privacy principles from ISO/IEC 29100

Key Differences between multiple privacy standards

The main difference between various Privacy regulations/ Legislation and 27701 is that this regulation only focusses on What to do, whereas 27701 focuses on How to do.

ISO 27701 is an auditable standard that complies with these requirements for generating evidence of how the organization processes the personal data. Some interesting topic while dealing with multiple privacy standards are:

1. Anonymization vs Pseudonymization
2. Data Controller vs Data Processor
3. Data Subject Access Request (DSAR)
4. “Don’t Sell My Information” on the website — Requirement of CCPA
5. Backup Policy for PII
6. Supervisory Authority of Member Countries

Similar affirmations hold importance while facilitating the agreements with all the stakeholders like Regulatory Bodies, End Users, Consumers, Clients and whomsoever it is relevant to.

For global organizations planning to implement privacy controls, ISO 27701 can be the best approach for build a baseline, even if the organizations are bound by other laws and legislations. The prime focus should be to have stringent policies and process in place to prevent fines owing to data breach or non-compliance with the data protection regulations.

As ISMS is the prime requirement to build your information security management, investing in international privacy standard like PIMS (ISO 27701) will certainly have a positive impact in long term.

The worldwide standard for a privacy information management system is ISO/IEC 27701. (PIMS). It is a privacy addition to ISO/IEC 27002 Security Controls and ISO/IEC 27001 Information Security Management.

These are some particular organisational roles:

• PII controllers (among them are those who act as joint PII controllers)
• PII processors

Following are the clauses mentioned in ISO 27701:

Clause 1: Scope

In here, the prerequisites for the management system’s intended use are outlined. As an addition to ISO/IEC 27001 and ISO/IEC 27002, ISO/IEC 27701 aims to provide rules and recommendations for setting up, implementing, maintaining, and improving a privacy information management system. focused on the individuals who are in charge of and accountable for handling PII, including PII controllers and PII processors.

Clause 2: Normative references

Documents cited in a standard are considered normative references. These include: ISO/IEC 27000 Overview and vocabulary for information security management systems ISO/IEC 27001 Information security management systems: requirements The ISO/IEC 27002 Code of Practice for Information Security Controls Framework for privacy established by ISO/IEC 29100

Clause 3: Terms and definitions

Important terminology used throughout the standard that are not defined in ISO/IEC 27000 and ISO/IEC 29100 are given a few extra definitions in this section.

Clause 4: General

In relation to ISO/IEC 27701, this clause “sets the scene.” It gives a high-level overview of the document’s organisation and identifies where the PIMS-specific requirements are located in reference to ISO/IEC 27001 and ISO/IEC 27002.

Clause 5: PIMS specific requirements related to ISO/IEC 27001

The purpose of this clause is to incorporate the protection of privacy into the information security criteria of ISO/IEC 27001 as well.

Determine your function as a processor and/or controller within the framework of the company, and take into account the influence of internal and external elements including privacy-specific rules and contractual requirements. Depending on your function, you must implement and apply the pertinent controls from Annexes A and/or B to your current statement of applicability.

Additionally, you must take into account the parties with an interest in the processing of PII, the scope of your PIMS, and the efficient implementation, upkeep, and ongoing improvement of the system. To ensure the protection of privacy, consideration and extension of ISO/IEC 27001’s requirements for management, planning, support, operation, performance evaluation, and improvement must be taken into account. Risks to information and processing of PII must now be evaluated and handled carefully, in particular.

Clause 6: PIMS specific guidance related to ISO/IEC 27002

This clause aims to expand ISO/IEC 27002’s information security recommendations to include privacy protection.

For instance, based on compliance, contractual, and stakeholder needs, enterprises need to take into account the extra implementation guidance regarding information security policies to incorporate pertinent privacy declarations.

Roles and duties in respect to the processing of PII are described with greater clarity. This includes being informed of incident reporting requirements and the repercussions of a privacy violation.

Advice is provided to guarantee that PII is taken into account while classifying your information. You must be aware of the PII your company handles, where it is kept, and the systems it passes through. Additionally, people need to know what PII is and how to spot it.

On incident management, removable media, user access on PII processing systems and services, cryptographic protection, reassigning PII storage space, back-up and recovery of PII, event log reviews, information transfer policies, and confidentiality agreements, more thorough implementation guidance is provided.

Additionally, this clause’s instructions encourage you to take PII into account before transmitting data over open networks and as part of the system’s development and design. Relationships with suppliers as well as their expectations and obligations must be addressed.

Clause 7: Additional guidance for PII controllers

This section deals with PIMS-specific implementation advice for PII controllers. It is associated with the measures detailed in Annex A.

For instance, in order to be in compliance with the laws that apply, you must specify the precise purposes for the PII you process and have a legal justification for doing so. If the intent behind processing PII evolves or expands, updates should be made.

Aside from these topics, the guidance also outlines contracts with PII processors, clear roles and responsibilities with any joint controllers, considerations of special category data and consent requirements, privacy impact assessment requirements to reduce risk to PII principals, and considerations of special category data and considerations.

People whose PII you process should understand why and how information is processed, along with a point of contact for inquiries. On consent, withdrawals, and PII access, correction, or deletion, specific instructions are provided. Additionally offered are third-party obligations, managing requests, and automated decision-making advice.

The accuracy and quality of PII, constraints on the amount collected based on the purpose of processing, and end of processing criteria should all be taken into account when implementing privacy by design for processes and systems. Importantly, PII sharing, transfer, and disclosure information is provided to assist you in moving your records between jurisdictions.

Clause 8: Additional guidance for PII Processors

This section addresses implementation advice for PII processors particular to PIMS. The restrictions indicated in Annex B are relevant.

For instance, in order to help customers meet their obligations, including those of PII principles, customer contracts should mention your company’s function as a PII Processor. To utilise PII data for marketing and advertising, prior consent is required.

There is advice provided on how to locate and keep track of the records required to prove compliance with the agreed-upon PII processing you carry out.

Detailed instructions are provided on how to assist your customer with specific requests, manage temporary files created during processing, return, transfer, or securely dispose of PII, and use the proper transmission controls.

In order to accommodate jurisdictional transfers, third-party and subcontractor requirements, and management of legally enforceable PII disclosures, thorough PII sharing, transfer, and disclosure guidance is provided.

Annexes

The ISO/IEC 27701 standard contains a number of Annexes. While annexes C–F contain additional information that can help with setting up and running an effective PIMS, annexes A and B are for controllers and processors, respectively. Following are covered in Annexes:

Annex A

An inventory of PII controller controls. A reason for any control that is excluded must be included in the statement of applicability even though not all controls will be necessary.

Annex B

An inventory of PII processor controls. A reason for any control that is excluded must be included in the statement of applicability even though not all controls will be necessary.

Annex C

Controls for PII controllers are mapped to the privacy principles in ISO/IEC 2900. This illustrates how compliance with ISO/IEC 27701’s requirements and controls relate to the privacy principles in ISO/IEC 29100.

Annex D

Articles 5 to 49 of the GDPR are mapped to the provisions in ISO/IEC 27701 (except 43). This demonstrates how fulfilling GDPR regulations might be relevant to conforming to ISO/IEC 27701 requirements and controls.

Annex E

Clauses in ISO/IEC 27701 mapped to:

• Requirements for PII processors in public clouds under ISO/IEC 27018
• ISO/IEC 29151 for guidelines and extra controls for PII controllers.

Annex F

Provides information on how to apply ISO/IEC 27701 to ISO/IEC 27001 and ISO/IEC 27002. It offers various application examples as well as a clear map of how information security words are extended to encompass privacy.

Named after the monstrous wrath dog of the underworld from greek mythology,  Cerberus  is a banking trojan, created by the remote attackers which allows it to steal the account data, SMSs and all other important data of the device.

Taking advantage of the ongoing pandemic situation, scammers are targeting the financial data of the users’ smartphones.  Cerberus, the malicious software is being blessed with the amid pandemic scenario impersonates and sends SMSs providing some content and links that might deploy it’s malicious app by usually by sending emails pretending that they are from reputed companies and procuring the personal data that reveals the financial credentials of the customer. Recently on Tuesday the CBI announced that this kind of trojan often tends to be tricky for the users as they ask to provide the authentication details.  CERT  recently issued a security notification regarding zoom stating it as not a safe platform for the usage of individuals. The cerberus is more impacted to the internet users who are involved in the work from home jobs.

Impertinent behaviour and speed of criminal activity has been increasing from the time since our prime minister Narendra Modi has announced about the PM cares fund for helping the victims of  COVID-19  pandemic. Various cerberus attacks have been phished off to transfer money in the name of treating patients. Fraudulent E- commerce sites have developed rapidly promising to treat corona victims.

The investigator could face the challenges like sending email to susceptible people for sharing password and bank credentials. Meanwhile the fraudsters are surging their way through the meeting places of corporate offices like google hangout and zoom. Some of the advisories warned that usage of open WiFi networks is dangerous also changing the default passwords would reduce the risk of the crime happening forth.

Operation Pangaea was launched by the  INTERPOL  to eradicate this kind of malicious software and nearly around 120 criminals from 90 countries which would worth around 14 million dollars were caught by them but this has not been executed in Indian government didn’t have any such kind of execution for such kind of issues. Slew of malicious software has become a banking trojan exploiting the name of coronavirus.

Cerberus makes use of an overlay top display of an actual mobile banking app and can trick the users into entering their banking credentials into the fake login screen. All the financial data can be acquired by the remote attackers. Such kind attacks are done for unique targets and banking apps. When the cerberus trojan gets installed in your device it doesn’t show any icon for the application to the user. It pretends to act like a flash player in order to gain permission from the system.

By chance if the software gets installed due the lack of security it automatically registers the command and control over the systems. To robb the credential information of the device it launches remote screen overlay attacks. This impinges the customers to provide their details on some of the websites with fake login screens. The victim totally gets devastated by all the credential data over their respective devices.

To be safe from such malicious practices one should beware of downloading the applications as this malware relies on social engineering tactics to make its way onto a victim’s device. Click the links from trusted sources, if you receive any suspicious link stay cautious and avoid interacting with the message. Using an antivirus software would be more adorable to protect from such harming trojans.

Software files especially from the third party unofficial sites shady sites, third party downloaders, Peer-to-Peer networks, freeware download pages, free file hosting sites, etc., can be and often are used to proliferate malicious programs. Third party, fake installers are often used to spread malware too. If the above precautions are taken care off the malicious software could not be encouraged and there shall be no threat for the users credentials.