ISO/IEC 15944-12:2020

Overview - ISO/IEC 15944-12:2020 (PPR on ILCM and EDI of PI)

ISO/IEC 15944-12:2020 defines privacy protection requirements (PPR) for the information life cycle management (ILCM) of personal information (PI) exchanged in business transactions, particularly those using Electronic Data Interchange (EDI) and Open-edi modelling technologies. The standard provides methods to identify additional external constraints (jurisdictional, legal and regulatory) that must be applied to recorded information in business transactions, integrates relevant normative elements from the ISO/IEC 15944 series and ISO/IEC 14662, and offers overarching operational best-practice statements to support implementation and governance.

Note: this part focuses on policy, governance and ILCM requirements and does not specify the technical functional support services (FSV) required to implement those mechanisms.

Key topics and technical requirements

• Fundamental privacy protection principles - a consolidated set of privacy principles (including 11 key principles) and links to consumer accessibility and protection.
• ILCM principles supporting PPR - requirements for compliance, purpose limitation, informed consent, control, retention limits, accuracy, integrity, safeguards, archiving and disposition/expungement.
• Tagging / labelling of data - rules for tagging Sets of Personal Information (SPIs) and Single Recorded Items (SRIs) to support policy enforcement and interoperability.
• Accountability and “under the control of” - governance and operational rules ensuring organizations retain control and responsibility for PI across its life cycle.
• Retention, state changes and disposition - specification of retention triggers, state-change types, record retention and disposal schedules (RRDS), and disposition/expungement rules.
• Data conversion, migration and synchronization - guidance on preserving ILCM constraints during data conversion and cross‑system synchronization.
• EDI-specific rules - requirements for EDI of PI between primary ILCM parties and agents, third parties and regulators.
• Conformance and annexed guidance - conformance statements and informative annexes (compliance decision trees, referential integrity, exclusions, and cross-references to other parts of the series).

Practical applications - who should use it

• Privacy officers, data protection officers and compliance teams developing ILCM policies that meet jurisdictional privacy laws.
• Enterprise architects, solution designers and system integrators implementing EDI/Open-edi business transactions that include PI.
• Business analysts and modelers using Open-edi scenarios to identify external constraints on data content.
• Auditors and regulators assessing conformity with privacy and ILCM governance practices.
• Third-party processors and agents who must align their handling of PI with primary ILCM requirements.

Related standards and references

• ISO/IEC 14662 (Open-edi reference model)
• Other parts of the ISO/IEC 15944 series (Parts 1, 2, 4, 5, 8, 9, 10)
• Annexes in ISO/IEC 15944-12 provide implementation guidance, exclusions (Annex H) and conformance criteria.

Keywords: ISO/IEC 15944-12, privacy protection, information life cycle management, ILCM, EDI, Open-edi, personal information, PPR, data retention, tagging, conformance.