Management System Certification

ISO/IEC 27701 Privacy Information Management System Certification

Build a privacy information security umbrella and build a privacy information security firewall

In the era of Internet and big data, many businesses cannot be carried out without the processing of personal privacy information, and privacy protection has become a major focus of attention in the current society. On August 20, 2021, the 30th meeting of the Standing Committee of the 13th National People's Congress voted to pass the Personal Information Protection Law of the People's Republic of China, which will officially come into effect on November 1, 2021.

This means that protecting Personal Identity Information (PII) is not only a social consensus, but has also become a mandatory requirement of the law, and organizations face multiple responsibilities from customers, end-users, investors, and government regulation. How organizations should manage Personally Recognized Information (PII) or personal data, and how to ensure privacy compliance, have become new problems and challenges that organizations urgently need to solve.

ISO/IEC 27701 is an international management system standard developed based on this requirement. It is an extension of ISO 27001 (Information Security Management Systems) and ISO 27002 (Guidelines for Information Security Control Practices) in privacy information management. Provide guidance for organizations in protecting personal privacy information. With the release of the EU's GDPR and more similar privacy data protection laws and regulations, the global demand for compliance with privacy requirements is increasing. Almost every organization processes personally identifiable information (PII). In addition, the number and types of PIIs being processed are constantly increasing, and the cooperation between organizations in handling PIIs is also increasing. Protecting privacy in the context of PII processing is a social demand and a major issue of specialized laws and regulations worldwide.

The ISO 27701 Privacy Information Management System enables organizations to continuously improve their practices in data protection, while also deepening the information security management system in personal information protection. It aims to strike a reasonable balance between personal data utilization and protection, and reduce risks in organizational operations and compliance.

The significance of certification

• Clarify privacy protection requirements for PII controllers and processors, assist organizations in identifying and analyzing privacy risks;

• Clarify the compliance goals of privacy protection management, reduce the burden of organizational compliance while reducing organizational compliance risks;

• Ensure that the interests of senior management, organizational owners, and key stakeholders meet privacy protection requirements;

• Communicate the value of privacy compliance to organizational clients or partners, thereby enabling the organization to achieve long-term and sustainable development of personal privacy security compliance;

• Based on the unified framework of international standards, the cost of compliance communication can be reduced, and the credibility of the organization can be conveyed to the public;

• Create a stronger sense of trust and opportunities for the organization to communicate to its controlling organization, partners, customers, and employees.