Step 1 – Initial Consultation

Understand your organization’s personal-data processing activities, privacy objectives, information-security environment, and certification requirements.

Step 2 – Gap Assessment

Evaluate existing privacy and information-security practices against ISO/IEC 27701 requirements.

Step 3 – Define PIMS Scope

Determine the processes, locations, departments, information systems, PII processing activities, and organizational boundaries covered by the PIMS.

Step 4 – Identify PII Processing Activities

Map how personal information is collected, stored, used, transferred, retained, shared, and deleted.

Step 5 – Privacy Risk Assessment

Identify privacy risks and evaluate their potential impact on individuals and organizational objectives.

Step 6 – Documentation

Develop privacy policies, procedures, processing records, risk assessments, controls, forms, and supporting PIMS documentation.

Step 7 – Implementation

Implement the Privacy Information Management System throughout the defined scope.

Step 8 – Employee Training

Train employees on privacy responsibilities, personal-data handling, information security, and PIMS procedures.

Step 9 – Internal Audit

Conduct internal audits to evaluate PIMS conformity and identify nonconformities.

Step 10 – Management Review

Review PIMS performance, privacy risks, objectives, audit findings, incidents, complaints, corrective actions, and improvement opportunities.

Step 11 – Corrective Actions

Address identified nonconformities and verify the effectiveness of corrective actions.

Step 12 – Certification Audit

An independent certification body conducts the external assessment of your Privacy Information Management System.

Step 13 – Certification Decision

The certification body reviews the assessment results and independently makes the certification decision.

Step 14 – Continual Improvement

Maintain the PIMS, monitor privacy risks, review processing activities, address incidents, and continually improve privacy-management practices.