Data protection policy

Identify and meet privacy and PII-protection requirements from law, regulation and contract.

What the ISO 27002 guidance expects the document to say: Requires the requirements for preserving privacy and protecting personally identifiable information to be identified and met, in line with applicable laws, regulations and contractual requirements.

Top management shall establish a privacy policy that is appropriate to the purpose of the organization, provides a framework for setting privacy objectives, includes a commitment to satisfy applicable requirements related to the processing of PII, and includes a commitment to continual improvement of the privacy information management system. The policy shall be available as documented information, be communicated within the organization, and be available to interested parties as appropriate. The transition documents record that a written privacy policy is now a mandatory standalone requirement rather than an augmentation of the information security policy.

Implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that processing is performed in accordance with the Regulation, taking into account the nature, scope, context and purposes of processing and the risks of varying likelihood and severity for the rights and freedoms of natural persons. Review and update those measures where necessary. Where proportionate in relation to the processing activities, the measures must include implementing appropriate data protection policies. Adherence to an approved code of conduct or an approved certification mechanism may be used as one element by which to demonstrate compliance, not as a substitute for it.