What it covers. An international standard for establishing and improving a privacy information management system. It was first published in 2019 as an extension to ISO/IEC 27001 and 27002, and a later edition allows it to be used as a standalone management system. It covers organisations acting as controllers and as processors of personal data.
In practice. Organisations define the scope of personal data processing, assign privacy roles, maintain records of processing, and implement controls for lawful processing, data subject rights, retention and transfers. It is often used to demonstrate accountability under GDPR, alongside a mapping between the standard and legal obligations. Auditors expect a defined scope, risk assessment covering privacy, documented controls and evidence that they operate.
Common gaps. Common gaps are treating privacy as a policy exercise without operational records, weak processor oversight, and a scope that excludes systems where personal data actually flows.