While theoretically an organization could adopt ISO 27701 as a separate standalone framework to apply to an organization’s privacy program, the framework was conceptualized as an extension of the ISO data security standards. As a result, it is organized based upon the assumption that an organization already has a security program that is built off of ISO/IEC 27001:2013 (Information security management systems) and ISO/IEC 27002:2013 (Code of practice for information security controls).

The requirements and controls of the ISO 27701 framework are divided into four sections. The first two sections identify which of the ISO 27701 and ISO 27002 security controls are adopted (either directly or with slight modification or additional guidance) for purposes of the privacy framework:

Most security sections were adopted with little modification other than to interpret the term “information security” as referring to “information security and privacy.” The following provides an example of a side-by-side comparison of the requirements under the security framework and the privacy framework:

Other security sections were adopted in conjunction with textual refinements or additional implementation guidance.

The next two sections identify new guidance (separate and apart from guidance contained in the security frameworks) that apply to controllers and to processors as those terms are understood under the European GDPR: