A.5.34 Privacy and protection of personal identifiable information (PII)

Control objective

This control requires the organization to identify the privacy protection requirements that applicable laws, regulations, and contracts impose on the personally identifiable information (PII) it processes, and to establish the policies, procedures, and accountability needed to meet them across the full lifecycle of PII, from collection through disposal. It calls for safeguarding the rights of data subjects, preventing misuse, leakage, and unauthorized access to PII, and communicating the organization's approach to privacy protection to everyone involved in PII processing. The ultimate aim is to prevent the sanctions and loss of trust that follow breaches of privacy law, and to run PII processing activities in alignment with the organization's management system and risk management.

Key checkpoints

Are the types, processing purposes, and flows of the PII the organization processes identified, and are the applicable privacy-related legal, regulatory, and contractual requirements understood?
Is a policy/guideline on privacy and PII protection established, and is it communicated and shared with all personnel and parties involved in PII processing?
Are an accountable owner for PII protection (such as a privacy officer) and a point of contact appointed, with roles and authority defined?
Are technical and organizational safeguards applied across the PII lifecycle: collection, use, provision, storage, and disposal?
Is there a procedure to receive and handle data subject requests such as access, correction, deletion, and suspension of processing?
Are privacy risks associated with PII processing, such as those from new services or systems, assessed and reflected in the controls?

Implementation guidance

Maintain an inventory of personal data, purposes, lawful processing bases, retention, locations, and sharing/processor relationships. Apply consent requirements where consent is the chosen valid basis, and distinguish it from other lawful bases.
Determine the applicable privacy laws, regulations, and contractual requirements (including domestic and foreign jurisdictions) in conjunction with the compliance requirements register in A.5.31, and separately manage the requirements that apply to cross-border transfers of PII.
Establish a policy/guideline on privacy and PII protection that defines processing principles, roles and responsibilities, procedures for upholding data subject rights, and safeguard standards, and communicate it to employees, processors, and external parties involved in PII processing.
Appoint an accountable owner for PII protection and a point of contact (privacy officer/responsible function), and operate a procedure to receive and handle inquiries, rights requests, and breach reports.
Apply safeguards across the personal-data lifecycle, including minimization, least privilege, appropriate encryption/pseudonymization/masking, and access logging. Before deletion at retention expiry, check preservation obligations and applicable exceptions; restrict retained information from unrelated use.
Conduct a privacy (impact) assessment when introducing new services/systems or when processing PII at scale, to identify and mitigate risks, and keep the processing policy and related notices up to date.
Receive access, correction, erasure, restriction, and consent-withdrawal requests, and verify the requester proportionately to risk. Apply the relevant deadlines, conditions, and exceptions, recording the decision basis. Handle breach notifications under their separate deadlines and recipient requirements.

Related controls and attributes

Evidence

PII processing inventory (processing items/purposes/retention periods/processing locations/third-party provision and outsourcing status, including flow diagrams)
Privacy and PII protection policy/guideline and records of its communication/training to employees and processors
Appointment document for the privacy officer and point of contact, and a definition of roles and responsibilities
Results of privacy (impact) assessments and records of follow-up action
Personal information processing policy and records of data subject notices/consent
Register of receipt and handling of data subject rights requests (access, correction, deletion, suspension of processing)
Evidence of applied PII safeguards (encryption/pseudonymization/access privileges/access logs/disposal records)

Nonconformity examples

The types and flows of PII the organization processes are not identified, so it cannot determine what personal data exists and where.
No policy or guideline on privacy/PII protection exists, or where one exists it is not communicated to the personnel/processors who actually handle PII.
No privacy officer or point of contact is appointed, so responsibility for responding to data subject inquiries and rights requests is unclear.
The applicable privacy laws or cross-border transfer requirements are not identified, so legal requirements are not met.
Personal data is retained after expiry without a valid retention basis, or used/shared without a lawful purpose or basis.
No procedure exists to receive and handle data subject rights requests such as access and deletion, so requests cannot be answered.
A privacy impact assessment required by applicable law (for example, the Korean public-institution PIA duty or a GDPR DPIA for likely high-risk processing) or by the organization's own policy is not performed for large-scale PII processing or a new system.