Overview
ISO/IEC 27555:2021 - Information security, cybersecurity and privacy protection - Guidelines on personally identifiable information deletion - provides a framework for organisations to develop policies and procedures for deleting personally identifiable information (PII). The standard focuses on harmonized terminology, an efficient approach to defining deletion rules, required documentation, and a broad definition of roles, responsibilities and processes to ensure consistent PII deletion across an organisation.
The document is intended for organisations that store or process PII and complements privacy and information security controls without prescribing technical deletion mechanisms or specific legal obligations.
Key topics and requirements
ISO/IEC 27555:2021 covers the following technical topics and procedural requirements:
- Harmonized terminology for PII deletion (e.g., clusters of PII, data objects, deletion).
- Framework for deletion including constraints, allocation of PII clusters, and documentation needs.
- Retention periods and regular deletion periods: concepts for defining when deletion should start and how often it should occur.
- Clusters of PII and data objects: identification, documentation and classification of PII used for consistent processing and deletion rules.
- Standard deletion periods, starting points and deletion classes: structuring abstract deletion rules and mapping them to real cases.
- Special situations: handling modifications, suspension, extensions of active use and backup/archive considerations.
- Organisational and system implementation requirements: organisation-wide aspects (backups, logs, transmission systems, disposal), individual IT system requirements, manual deletion processes and processor responsibilities.
- Roles and responsibilities: assignment of ownership, documentation duties and operational responsibilities for deletion processes.
Important exclusions noted by the standard: it does not set out specific legal provisions, concrete deletion mechanisms or their reliability, nor specific de‑identification techniques.
Applications and who should use it
ISO/IEC 27555:2021 is practical for professionals designing and operating privacy and data lifecycle controls, including:
- Privacy officers and data protection teams implementing the right to erasure and data minimization.
- Information security managers and cybersecurity architects aligning deletion with security controls.
- Records managers and IT operations responsible for retention, backup and disposal processes.
- Legal and compliance teams defining policy boundaries and interfacing with national law and contracts.
- Third‑party PII processors coordinating deletion responsibilities with controllers.
Use cases include creating deletion policies, standardising retention and deletion schedules, mapping PII clusters across systems, documenting deletion procedures, and managing exceptions and backups.
Related standards
- ISO/IEC 29100 - Information technology - Security techniques - Privacy framework (referenced for privacy principles and data minimization).
Keywords: ISO/IEC 27555:2021, PII deletion, personally identifiable information, deletion policies, data retention, privacy protection, information security, cybersecurity.