ISO 27001 Annex A 5.34 Privacy and protection of personally identifiable information
What it says
The organization shall identify and meet the requirements regarding the preservation of privacy and protection of PII according to applicable laws and regulations and contractual requirements.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure privacy and PII protection according to laws and contracts.
This control is all about making sure your business handles people's personal information in a way that respects their privacy and complies with laws. If you don't take this seriously, you could face hefty fines and lose the trust of your customers if their private information gets mishandled or exposed.
Free. Save your status, tasks and notes.
Why it matters
Mishandling PII can lead to significant fines and brand damage, eroding customer trust and exposing the organisation to legal actions.
How to implement
The IT manager should develop a privacy policy specifically focusing on protecting personally identifiable information (PII).
Start by reviewing the Privacy Act 1988 and relevant Australian legislation to create a policy that aligns with legal requirements and company practices.
The HR department should ensure all employees are informed and trained on the privacy policy and PII protection procedures.
Conduct regular training sessions and provide materials that make it easy for everyone to understand their role in safeguarding personal information.
A designated privacy officer should be appointed to oversee PII protection.
This person will guide team members on handling PII, monitor compliance with policies, and be the go-to contact for any privacy-related questions or issues.
The compliance officer should regularly review and update procedures to ensure they match current laws and regulations.
Check the Office of the Australian Information Commissioner's (OAIC) updates for any changes in data protection requirements and adjust processes accordingly.
The technical team should implement protective measures like encryption and access controls to secure PII.
Use software tools to ensure data stored digitally is protected and only accessible to authorised personnel.
Keep it running
Regularly audit data handling processes for compliance with privacy laws and ensure all staff are trained on the latest PII protection practices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the organisation's privacy policy documents.
Look at
Examine if the policy explicitly addresses PII protection and conforms to Australian legal requirements.
Good evidence
A comprehensive policy is available, reflecting compliance with the Privacy Act and detailing procedures for protecting PII.
- Check 2 of 5What an auditor asks for
Ask for
Ask for training records and materials about PII protection.
Look at
Verify whether all relevant employees have received training and understand their roles in PII protection.
Good evidence
Regularly updated training sessions are recorded, and employees can demonstrate knowledge of privacy procedures.
- Check 3 of 5What an auditor asks for
Ask for
Request records detailing the appointment and roles of a privacy officer.
Look at
Check if responsibilities for privacy management are assigned and documented.
Good evidence
A privacy officer is formally designated, with clear responsibilities outlined and communicated across the organisation.
- Check 4 of 5What an auditor asks for
Ask for
Ask for compliance check reports with current laws regarding PII.
Look at
See if the organisation regularly reviews policies and practices against up-to-date legislation.
Good evidence
Frequent reviews are documented, with policy adjustments tracked against changes in laws.
- Check 5 of 5What an auditor asks for
Ask for
Request information on technical measures used to protect PII.
Look at
Assess whether there are appropriate controls and technology in place, such as encryption and access controls.
Good evidence
The organisation uses recognised technologies to secure PII, with logs showing controlled access to sensitive information.
Mappings
Closest match in ISO/IEC 42001: A.4.3, Document the data resources used by your AI system, which partially overlaps with this control.
ISO/IEC 42001: 6 mappings
This control partially overlaps A.4.3.
Annex A 4.3 requires documenting the AI system's data resources, which often includes identifying whether datasets contain personal information and the provenance/usage constraints of that data. Annex A 5.34 requires the organisation to identify and meet privacy and PII protection requirements, which directly intersects when AI data resources include PII. The overlap is on knowing and governing data used, but Annex A 5.34 is primarily a legal/regulatory privacy compliance control, while Annex A 4.3 is broader AI data resource documentation regardless of whether PII is present.
This control partially overlaps A.5.2.
Annex A 5.2 (ISO/IEC 42001) requires a process to assess potential AI-driven impacts on individuals, groups and society throughout the AI system lifecycle. Annex A 5.34 (ISO/IEC 27001) overlaps because privacy/PII impacts are a common and significant subset of AI impacts that should be assessed (e.g., inference, re-identification, unlawful secondary use). Annex A 5.34 is narrower to privacy and protection of PII, while Annex A 5.2 extends beyond privacy to broader human, societal, and group harms (e.g., bias, safety, economic and social impacts).
This control partially overlaps A.5.4.
Annex A 5.4 (ISO/IEC 42001:2023) requires the organisation to assess and document how AI systems may impact individuals or groups over the life cycle, which commonly includes privacy-related impacts. Annex A 5.34 (ISO/IEC 27001:2022) requires identifying and meeting privacy and PII protection requirements, overlapping where AI impacts arise from PII processing, profiling, or inference. Annex A 5.4 extends beyond privacy compliance into broader human and societal impacts, while Annex A 5.34 is specifically scoped to privacy/PII obligations and controls.
This control partially overlaps A.8.5.
Annex A 8.5 requires determining and documenting obligations to report AI system information to interested parties. Annex A 5.34 involves privacy compliance, often including reporting obligations when AI systems handle PII. The overlap is on external disclosure obligations linked to PII, but Annex A 8.5 includes broader AI reporting contexts.
This control partially overlaps A.10.3.
Annex A 10.3 requires the organisation to ensure supplier-provided services/products/materials used for AI align with responsible AI development and use. Annex A 5.34 overlaps because responsible AI supplier usage frequently includes ensuring PII is handled lawfully by AI vendors (e.g., limits on training, retention, secondary use, cross-border transfer), which must be built into supplier selection and oversight. Annex A 5.34 is specifically privacy/PII compliance, whereas Annex A 10.3 covers wider responsible AI alignment beyond privacy, such as safety, robustness, and accountability.
This control partially overlaps A.10.4.
Annex A 10.4 mandates that customer expectations and needs be integral to responsible AI systems, including handling customer data transparently. Annex A 5.34 overlaps by focusing on privacy compliance-aligned with customer privacy expectations when AI uses personal data. However, Annex A 10.4 addresses broader expectations such as AI accuracy and transparency beyond privacy.
ASD Information Security Manual: 6 mappings
This control partially overlaps ISM-1395.
ISM-1395 requires service providers to apply appropriate protection to data entrusted to them or their services. Annex A 5.34 overlaps where the entrusted data includes PII, requiring the organisation to meet privacy and PII protection obligations via law, regulation and contract, which are often flowed down to providers. Annex A 5.34 is limited to PII/privacy compliance, while ISM-1395 applies to entrusted data more broadly (not only PII).
This control partially overlaps ISM-1880.
Annex A 5.34 requires the organisation to identify and meet applicable legal, regulatory, and contractual requirements for privacy and protection of PII. ISM-1880 relates by requiring notification to customers and the public for cybersecurity incidents involving customer data, which is often a legal or regulatory privacy obligation. ISM-1880 is focused on incident notification while Annex A 5.34 addresses the comprehensive privacy compliance lifecycle.
This control partially overlaps ISM-2021.
ISM-2021 requires system owners to limit data collection and storage to what is necessary, reducing exposure from excessive retained information. Annex A 5.34 requires meeting privacy and PII protection requirements, which commonly includes data minimisation principles under privacy law and contractual obligations. They overlap on minimising personal information holdings, but Annex A 5.34 is broader in covering legal/regulatory privacy obligations beyond minimisation (e.g. notice, lawful basis, rights handling).
This control partially overlaps ISM-2103.
ISM-2103 requires that organisational data handled by AI applications is not used to train, fine-tune, or improve AI models unless the data owner has given informed and explicit consent in advance. Annex A 5.34 requires the organisation to identify and meet privacy and PII protection requirements arising from law, regulation, and contracts, which commonly include consent and limits on secondary use (including model training). Annex A 5.34 is broader and not AI-specific, while ISM-2103 is specifically about preventing unauthorised secondary use of organisational data for AI model improvement (including where data is not necessarily PII).
This control supports ISM-1268.
ISM-1268 requires enforcing need-to-know for database contents and includes controls like minimum privileges and tokenisation to limit exposure of sensitive data. ISO/IEC 27001:2022 Annex A 5.34 requires meeting privacy and PII protection requirements, which commonly necessitates restricting who can access PII stored in databases and reducing exposure via tokenisation/masking. ISM-1268 is a technical access enforcement approach, while Annex A 5.34 is a compliance-driven requirement that ISM-1268 helps satisfy for database-held PII.
This control supports ISM-2046.
ISM-2046 requires sensitive data not to be logged and ensures that permissions are set appropriately in software that allows user impersonation. Annex A 5.34 supports this by establishing obligations to protect PII, which often drives requirements to avoid capturing sensitive fields in logs and to restrict log access. Annex A 5.34 is compliance-focused and does not directly specify logging controls or impersonation-specific log permissioning like ISM-2046.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.
Draft your ISO 27001 documentation