ISO/IEC 29100:2024

Overview

ISO/IEC 29100:2024 - Information technology - Security techniques - Privacy framework - is an international standard that defines a high-level privacy framework for the protection of personally identifiable information (PII) in information and communication technology (ICT) systems. The second edition updates the original 2011 publication and consolidates terminology, actor roles, safeguarding considerations, and references to established privacy principles. ISO/IEC 29100:2024 is intended for organizations and individuals involved in specifying, procuring, designing, developing, operating, and maintaining ICT systems where privacy controls are required.

Key topics and requirements

ISO/IEC 29100:2024 structures practical privacy guidance around clear topics and requirements:

• Common privacy terminology - standardized definitions for PII, anonymization, consent, identifiability, opt‑in/opt‑out, pseudonymous data, sensitive PII, metadata, and related terms.
• Actors and roles - identification of key stakeholders such as PII principals, PII controllers, PII processors, and third parties, plus their interactions and responsibilities.
• Recognizing PII - guidance on identifiers, other distinguishing characteristics, linked information, unsolicited PII and what constitutes PII in ICT contexts.
• Privacy safeguarding considerations - organizational, legal/regulatory, contractual and business factors that influence safeguarding requirements.
• Privacy principles - referenced principles include:
  • Consent and choice
  • Purpose legitimacy and specification
  • Collection limitation and data minimization
  • Use, retention and disclosure limitation
  • Accuracy and quality
  • Openness, transparency and notice
  • Individual participation and access
  • Accountability, information security and privacy compliance
• Privacy policies and controls - high‑level expectations for policies and technical/organizational controls to protect PII.
• Annex mapping - correspondence to ISO/IEC 27000 family concepts to align privacy with information security.

Applications and who should use it

ISO/IEC 29100:2024 is practical for:

• IT architects, developers and system designers building systems that process PII.
• Procurement and vendor management teams defining privacy requirements in contracts and outsourced processes.
• Privacy officers, risk assessors and compliance teams performing privacy impact assessments and defining safeguarding needs.
• Security and operations teams implementing privacy controls, access management, data retention and anonymization measures.
• Legal and governance functions aligning ICT practices with regulatory and contractual obligations.

Use cases include drafting privacy-aware requirements, shaping vendor contracts, developing privacy policies, guiding pseudonymization/anonymization decisions, and aligning information security and data protection programs.

Related standards

• ISO/IEC 29100:2024 includes an annex mapping to the ISO/IEC 27000 series and is intended to complement existing information security standards and privacy engineering initiatives.

Keywords: ISO/IEC 29100:2024, privacy framework, PII, privacy principles, data protection, privacy controls, information security, PII controller, PII processor, data minimization, consent.