ISO/IEC 15944-17:2024

Overview

ISO/IEC 15944-17:2024 - Information technology - Business operational view - Part 17 - sets out fundamental principles and rules governing Privacy-by-Design (PbD) in the context of electronic data interchange (EDI) and collaboration space environments. This first-edition standard focuses on PbD as an external constraint on any Person (organization or public administration) engaged in EDI transactions that include personal information. It defines privacy principles, life‑cycle management expectations, tagging/labelling of personal information bundles (SPIs/SRIs), and operational best practices at the Business Operational View (BOV) level. Importantly, ISO/IEC 15944-17:2024 addresses business and governance requirements and explicitly does not specify the technical mechanisms (Functional Service View, FSV) needed to implement those requirements.

Key topics and requirements

• Privacy-by-Design principles: formalizes PbD concepts (proactive, default privacy, embedded privacy, full functionality, end-to-end safeguards, transparency, user‑centricity) and maps them to privacy protection principles.
• Privacy protection principles (PPP): consolidates primary legal/regulatory sources into an eleven‑point PPP framework applicable to EDI exchanges.
• Tagging and labelling: requirements for identifying and tagging sets of personal information (SPIs) and their semantic components (SRIs) to support policy enforcement and interoperability.
• Information Life Cycle Management (ILCM): rules to ensure personal information remains “under the control of” the organization across the full life cycle (cradle-to-grave) with clear accountability obligations.
• Collaboration space governance: operational best practices for processes, procedures and governance needed to support PbD in multi‑party EDI and collaboration environments.
• Conformance and scope: guidance on conformance statements and mapping to Open‑edi reference model constraints; Annex D lists detailed exclusions to scope.

Applications and who should use it

Practical uses include embedding privacy requirements early in business modelling, defining operational policies for cross‑organizational EDI, and creating interoperable metadata and tagging schemes for personal data. Typical users:

• Privacy engineers and Data Protection Officers (DPOs)
• Enterprise architects and EDI solution designers
• Compliance, legal and governance teams
• Standards developers and implementers integrating BOV requirements with technical FSV standards
• Public administrations and vendors operating collaboration spaces

Related standards

ISO/IEC 15944-17:2024 is intended for use with:

• ISO/IEC 14662 (Open‑edi Reference Model)
• Other parts of the ISO/IEC 15944 series (e.g., -1, -4, -5, -8, -12) The document maps PbD/BOV requirements to existing normative elements without prescribing technical protocols or security mechanisms (FSV), allowing organizations to apply jurisdictional privacy obligations within EDI and collaboration spaces.