Overview
EN ISO/IEC 29100:2020 (ISO/IEC 29100:2011, including Amd 1:2018) defines a high-level privacy framework for the protection of personally identifiable information (PII) in information and communication technology (ICT) systems. Adopted by CEN as a European standard, it provides common privacy terminology, defines actors and roles in PII processing, describes privacy safeguarding considerations, and references recognized privacy principles relevant to information technology.
Key topics and requirements
- Common terminology for privacy and PII to enable consistent interpretation across organizations and jurisdictions.
- Actors and roles: definitions for PII principals, PII controllers, PII processors and third parties, and typical PII flows.
- Privacy safeguarding considerations that influence risk management, including legal/regulatory, contractual and business factors.
- Privacy policies and controls: guidance on how to define privacy safeguarding requirements and select appropriate controls.
- Privacy principles (explicitly covered):
- Consent and choice
- Purpose legitimacy and specification
- Collection limitation
- Data minimization
- Use, retention and disclosure limitation
- Accuracy and quality
- Openness, transparency and notice
- Individual participation and access
- Accountability
- Information security
- Privacy compliance
- Recognizing PII: identifiers, distinguishing attributes, pseudonymous data, metadata, unsolicited and sensitive PII.
- Integration guidance: annex comparing ISO/IEC 29100 concepts with ISO/IEC 27000 family concepts to support alignment with information security management.
Practical applications
- Use the standard to frame privacy requirements when specifying, procuring, designing, developing, testing, operating or maintaining ICT systems and services that process PII.
- Help privacy and security teams create or align privacy policies, notices and contracts with technology design and operations.
- Serve as a reference for privacy risk assessments, selection of privacy controls, and for communicating roles and responsibilities among controllers, processors and other stakeholders.
- Support organizations seeking to integrate privacy considerations with existing information security programs and standards.
Who should use this standard
- Privacy officers, security architects, system designers and developers, procurement teams, compliance managers, and third-party service providers involved in the ICT lifecycle where privacy controls are required.
- Organizations operating across jurisdictions that need a common vocabulary and high-level framework for PII protection.
Related standards
- ISO/IEC 27000 family (information security management) - Annex A of ISO/IEC 29100 maps related concepts.
- National and regional data protection laws and regulations - ISO/IEC 29100 is complementary to legal requirements and to other privacy standards and technical specifications.
This standard is a practical, high-level foundation for embedding privacy considerations into ICT systems and aligning privacy controls with information security and organizational governance.