All 93 controls · Organizational controls
Control 5.34
Privacy and protection of PII
What ISO/IEC 27002:2022 control 5.34 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
The organization is to identify, and then satisfy, the requirements for preserving privacy and protecting personally identifiable information that arise from applicable laws, regulations and contracts. Purpose: comply with the legal, regulatory and contractual requirements concerning the security aspects of PII protection. Guidance: set a topic-specific policy covering privacy and the protection of PII and communicate it to relevant parties; develop and implement privacy and PII protection procedures and make them known to everyone involved in processing PII. Meeting these procedures and the relevant laws requires suitable roles, responsibilities and controls, usually best achieved by appointing someone such as a privacy officer who guides staff, service providers and others on their individual responsibilities and the procedures to follow. Responsibility for handling PII is assigned with regard to the relevant laws, and appropriate technical and organizational measures are put in place to protect it. Other information: many countries regulate how PII is gathered, processed, sent and erased, may impose duties on those who collect and share it, and may restrict transfers abroad; ISO/IEC 29100 gives a high-level framework, ISO/IEC 27701 covers privacy information management, ISO/IEC 27018 covers public cloud PII processors, and ISO/IEC 29134 gives guidance on privacy impact assessment for identifying and reducing privacy risks.
Purpose in the standard’s terms, in our words: Ensures compliance with requirements on the information security aspects of protecting PII.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Identify, Protect; Information protection, Legal and compliance; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | IdentifyProtect |
| Operational capabilities | Information protectionLegal and compliance |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- The topic-specific privacy and PII protection policy and its communication to relevant parties
- Privacy procedures communicated to everyone who processes PII
- Appointment of a privacy officer or equivalent with documented responsibilities
- A record of processing or PII inventory mapping which laws apply to each processing activity
- Privacy impact assessments for high-risk processing and the resulting mitigations
- Evidence of technical and organizational measures protecting PII, such as access restrictions, encryption and cross-border transfer safeguards
Where audits commonly find gaps
- Privacy is treated as a legal matter only, with no link to security controls
- No one is formally responsible for guiding staff and providers on PII handling
- Cross-border transfers of PII occur without checking applicable restrictions
- Privacy impact assessments are not performed for new processing
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (18.1.4) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.