ISO/IEC 15944-12:2025 PDF

Overview

ISO/IEC 15944-12:2025 - “Information technology - Business operational view - Part 12: Privacy protection requirements (PPR) on information life cycle management (ILCM) and EDI of personal information (PI)” provides methods and operational guidance to identify privacy and data‑protection constraints in Open‑edi modelling and business transaction scenarios. The standard integrates existing normative elements from the ISO/IEC 15944 series and ISO/IEC 14662, and sets out an enumerated minimum set of ILCM policy and operational requirements for recorded information exchanged via EDI as Information Bundles (IBs) and related Semantic Components (SCs).

Key topics and technical requirements

• Fundamental privacy protection principles - the standard describes primary sources and eleven (11) core privacy principles and their link to consumer protection and accessibility.
• ILCM principles supporting PPR - requirements for retention, accuracy, data integrity, disposition/expungement, archival, backup and limits on use/disclosure.
• Tagging/labeling requirements - mandatory tagging (labelling) of Sets of Personal Information (SPIs) and data elements to support lifecycle policies and enforcement.
• Accountability and “under the control of” - rules to establish organizational control, responsibility and governance across lifecycle phases.
• Rules for EDI of personal information - requirements for exchanging PI between primary ILCM person and agents, third parties and regulators.
• Data conversion, migration and synchronization - guidance and rules for converting or synchronizing SPIs while preserving PPR and referential integrity.
• Retention & disposition schedules - establishment and maintenance of Record Retention and Disposal Schedules (RRDS) and triggers for retention.
• Conformance and governance - conformance statement framework and how agents/third parties should demonstrate compliance.
• Annexed guidance - normative vocabularies, rule consolidations, decision trees, and exclusions (see Annex H).

Note: ISO/IEC 15944-12:2025 provides operational best‑practice statements and rules but does not mandate specific technical mechanisms or functional support services.

Practical applications

• Developing privacy‑aware Open‑edi business transaction models and scenarios.
• Defining ILCM policy, retention/disposition schedules and tagging strategies for personal data.
• Aligning enterprise data governance, legal/regulatory compliance and EDI implementations with jurisdictional privacy constraints.
• Scoping requirements for data migration, synchronization and third‑party data exchanges.
• Creating conformance profiles for agents, third parties and regulators in EDI ecosystems.

Who should use this standard

• Data protection officers, privacy architects and legal/compliance teams
• Enterprise architects and EDI solution designers
• Information governance and records management professionals
• System integrators, software vendors and regulators implementing Open‑edi transactions

Related standards

• ISO/IEC 14662 (Open‑edi reference model)
• ISO/IEC 15944 series: Parts 1, 2, 4, 5, 8, 9, 10 - referenced and integrated in this Part 12 for privacy and ILCM requirements

Keywords: ISO/IEC 15944-12:2025, privacy protection, information life cycle management, ILCM, EDI, personal information, PPR, Open-edi, data protection, record retention, tagging.