ISO 27701 Privacy Information Management Lead Auditor

Module 1: Introduction to ISO 27701

• ISO 27701 overview
• Purpose and scope
• Privacy information management
• PIMS concepts
• Personally identifiable information
• Key terminology

Module 2: Understanding the PIMS Framework

• PIMS structure
• Privacy management principles
• Management system approach
• PIMS boundaries
• Process approach
• Privacy management lifecycle

Module 3: Privacy & Information Security Management

• Information security principles
• Privacy and security relationship
• Integrated management concepts
• Privacy extensions
• Security controls
• Coordinated management

Module 4: Organisational Context

• Internal context
• External context
• Interested parties
• Privacy requirements
• Organisational boundaries
• PIMS scope

Module 5: Privacy Governance & Leadership

• Leadership commitment
• Privacy governance
• Privacy policy
• Organisational roles
• Responsibilities and authorities
• Accountability

Module 6: PII Roles & Responsibilities

• PII principals
• PII controllers
• PII processors
• Responsibility allocation
• Processing relationships
• Accountability requirements

Module 7: Privacy Risk Management

• Privacy risks
• Risk identification
• Threats and vulnerabilities
• Privacy impacts
• Risk analysis
• Risk evaluation

Module 8: Privacy Risk Treatment

• Risk treatment options
• Control selection
• Control implementation
• Residual risk
• Risk acceptance
• Treatment monitoring

Module 9: PII Inventory & Data Mapping

• Identifying PII
• PII inventories
• Processing activities
• Data flows
• Data locations
• Processing records

Module 10: PII Lifecycle Management

• PII collection
• Storage
• Processing
• Sharing and transfer
• Retention
• Secure deletion

Module 11: Privacy by Design & Default

• Privacy by design
• Privacy by default
• Data minimisation
• Purpose limitation
• System considerations
• Embedded privacy controls

Module 12: PII Controller Responsibilities

• Processing purposes
• Privacy information
• PII principal requests
• Consent considerations
• Processing records
• Controller accountability

Module 13: PII Processor Responsibilities

• Processing instructions
• Processor responsibilities
• Customer requirements
• Subprocessor considerations
• Data return
• Data deletion

Module 14: Third Parties & Subprocessors

• Third-party relationships
• Supplier controls
• Subprocessor management
• Responsibility allocation
• Privacy requirements
• Third-party monitoring

Module 15: PII Transfers & Disclosure

• Data transfers
• Data location
• Transfer controls
• Disclosure requests
• Disclosure records
• Transparency

Module 16: Privacy Incident Management

• Privacy incidents
• Incident identification
• Reporting and escalation
• Response activities
• Communication
• Incident documentation

Module 17: PIMS Documentation & Records

• Privacy policies
• Procedures
• Processing records
• Risk documentation
• Control records
• Document management

Module 18: Monitoring & Performance Evaluation

• Privacy performance
• Monitoring activities
• Performance indicators
• Control effectiveness
• Performance analysis
• Improvement opportunities

Module 19: Audit Principles

• Integrity
• Fair presentation
• Due professional care
• Confidentiality
• Independence
• Evidence-based auditing

Module 20: Managing a PIMS Audit Programme

• Audit programme objectives
• Audit priorities
• Audit frequency
• Resources
• Auditor selection
• Programme monitoring

Module 21: Lead Auditor Responsibilities

• Audit leadership
• Team coordination
• Task allocation
• Professional judgement
• Audit communication
• Managing audit activities

Module 22: Audit Objectives, Scope & Criteria

• Defining objectives
• Establishing scope
• Selecting criteria
• PIMS boundaries
• Privacy processes
• Audit feasibility

Module 23: Risk-Based Audit Planning

• Privacy risks
• PII sensitivity
• Processing activities
• Previous findings
• Audit priorities
• Sampling strategies

Module 24: Audit Preparation & Document Review

• Privacy policies
• PII inventories
• Processing records
• Risk assessments
• Control documentation
• Audit checklists

Module 25: Conducting PIMS Audits

• Opening meetings
• Personnel interviews
• Process observations
• Document review
• Record review
• Following audit trails

Module 26: Auditing Privacy Controls

• PII lifecycle controls
• Access controls
• Controller controls
• Processor controls
• Third-party controls
• Incident controls

Module 27: Gathering & Evaluating Audit Evidence

• Objective evidence
• Evidence sources
• Audit sampling
• Evidence sufficiency
• Evidence reliability
• Control effectiveness

Module 28: Audit Findings & Reporting

• Evaluating conformity
• Identifying nonconformities
• Supporting evidence
• Writing findings
• Audit conclusions
• Audit reports

Module 29: Corrective Actions & Audit Follow-Up

• Immediate corrections
• Root cause analysis
• Corrective-action plans
• Reviewing responses
• Effectiveness verification
• Closing findings

Module 30: Audit Team Leadership & Continual Improvement

• Leading audit teams
• Managing disagreements
• Auditor performance
• Complex audit situations
• Lessons learned
• Improving audit effectiveness