Question 1 of 10 · Fundamental principles and concepts of a privacy information management system
What happens to organizations certified to ISO/IEC 27701:2019?
Existing certificates transition within a period set by accreditation rules. Certificates were not canceled on publication, and 27001 certificates are unaffected.
Question 2 of 10 · Initiation of the PIMS implementation
What should initiation decide about external help?
Initiation decides whether consultants or training are needed and for which tasks, so outside help is planned and budgeted. A certification body cannot implement a PIMS it would later certify, because that breaks impartiality (B). External input is allowed (C), and ownership of the PIMS stays with the organization, not its suppliers (D).
Question 3 of 10 · Planning a PIMS implementation based on ISO/IEC 27701
Why involve legal and privacy roles in PIMS planning?
Legal and privacy specialists identify the applicable laws, contracts and regulatory obligations, and help decide whether the organization acts as controller or processor, both of which drive control selection. They do not own the PIMS alone (A), and technical controls (C) need IT and security input. Auditing a PIMS they designed (D) would break auditor objectivity.
Question 4 of 10 · Implementation of a PIMS based on ISO/IEC 27701
What control addresses PII retention?
Retention controls keep PII no longer than necessary for its purposes, using schedules that reflect legal requirements, followed by secure disposal. A single period for everything (A) ignores differing purposes and legal duties, and immediate deletion (B) can breach legal retention obligations. Offline archives (D) still hold PII and keep it in scope.
Question 5 of 10 · Monitoring and measurement of a PIMS based on ISO/IEC 27701
How often should PIMS management reviews occur?
The harmonized structure requires top management to review the management system at planned intervals, which the organization decides, often yearly. The standard sets no fixed monthly cycle (C). Reviews do not wait for a certification body (B) or a breach (D), although a breach may prompt an extra review.
Question 6 of 10 · Continual improvement of a PIMS based on ISO/IEC 27701
How is the effectiveness of corrective action verified?
The organization reviews the effectiveness of corrective action, typically by checking after a suitable period that the nonconformity and its cause have not recurred. Assigning an owner (B), approving the plan (C) or updating a document (D) show the action was started or done, not that it worked.
Question 7 of 10 · Preparing for a PIMS certification audit
What usually happens if a major nonconformity is found at stage 2?
A major nonconformity must be corrected, and the correction verified, often through a follow-up review, before certification is granted. A certificate with a note (B) is not issued while a major is open, and the audit is not canceled with a refund (C). Staff agreeing with a finding (D) does not remove it.
Question 8 of 10 · Fundamental principles and concepts of a privacy information management system
How does ISO/IEC 27701:2025 relate to ISO/IEC 27001?
Since 2025, 27701 stands alone with its own clauses 4 to 10 and controls, and shares the harmonized structure so it can be integrated with an ISMS. It does not replace 27001, and 27001 does not extend it.
Question 9 of 10 · Initiation of the PIMS implementation
Why review contracts at initiation?
Data processing agreements and client terms add obligations the PIMS must meet.
Question 10 of 10 · Planning a PIMS implementation based on ISO/IEC 27701
What must the PIMS scope make clear?
Scope defines which processing, which roles (controller, processor or both) and which parts of the organization the PIMS covers. Products, budgets and auditors are not scope.
0 of 10
Fundamental principles and concepts of a privacy information management system
Initiation of the PIMS implementation
Planning a PIMS implementation based on ISO/IEC 27701
Implementation of a PIMS based on ISO/IEC 27701
Monitoring and measurement of a PIMS based on ISO/IEC 27701
Continual improvement of a PIMS based on ISO/IEC 27701
Preparing for a PIMS certification audit
Which domains cost you the points? Members see a breakdown by domain and a study plan built from it.