ISO/IEC 27559:2022 PDF

Name: ISO/IEC 27559:2022 — Information security, cybersecurity and privacy protection – Privacy enhancing data de-identification framework
SKU: ISO/IEC 27559:2022
Price: 25 EUR
Availability: InStock

Information security, cybersecurity and privacy protection – Privacy enhancing data de-identification framework

Название (английский):

ISO/IEC 27559:2022

Information security, cybersecurity and privacy protection – Privacy enhancing data de-identification framework

Статус документа:: Действующий
Формат:: Электронный (PDF)
Количество страниц:: 22
Дата публикации:: 16 ноября 2022 г.
Издание:: ISO/IEC IS 27559 edition 1 version 1
ICS:: 35.030

Тип поставки:

Full version330 €Read online 24h10 €Read online 72h15 €

Язык документа:

ruen

Срок поставки:4 раб. дн. (перевод)

Цена:330 €

Описание (английский):

This document provides a framework for identifying and mitigating re-identification risks and risks associated with the lifecycle of de-identified data. This document is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, that are PII controllers or PII processors acting on a controller’s behalf, implementing data de-identification processes for privacy enhancing purposes.

Abstract

Похожие стандарты

Стандарты, упомянутые в описании

Overview - ISO/IEC 27559:2022 (Privacy enhancing data de-identification framework)

ISO/IEC 27559:2022 provides a practical framework for identifying and mitigating re-identification risks and managing risks across the lifecycle of de‑identified data. Applicable to all sizes and types of organizations (public, private, government, not‑for‑profit) acting as PII controllers or PII processors, the standard supports privacy‑enhancing use of personal data while maintaining oversight when data are reused, shared, or released. It guides organizations on assessing the environment, attacker capabilities, data properties and implementing governance to reduce identity disclosure.

Key topics and technical requirements

Context assessment

Threat modelling, assessment of adversary motives and capacity, and transparency/impact assessment for stakeholder engagement.

Data assessment

Characterization of data features: data principals, data types, attribute categories and dataset properties to inform de‑identification choices.

Attack modelling

Consideration of population vs. sample‑based attacks, maximum/average risk scenarios and selection of appropriate data privacy models.

Identifiability assessment and mitigation

Methods to quantify identifiability, adversarial testing, and iterative mitigation steps such as reconfiguring environments, transforming data (e.g., masking, aggregation, techniques described in ISO/IEC 20889), and re‑evaluation.

De‑identification governance

Roles and responsibilities, policies and procedures, disclosure management, stakeholder communication, monitoring after data release, and incident mitigation.

Practical tools referenced

Includes informative annexes (example identifiers, threshold benchmarks) to support implementation.

Applications - who uses ISO/IEC 27559 and why

Data protection officers, privacy teams, and compliance managers use the framework to meet regulatory privacy expectations while enabling data use.

Data custodians and security engineers apply threat and attack modelling guidance to design safe data sharing and access controls.

Researchers and analytics teams adopt the framework to enable internal reuse or external sharing of datasets without compromising privacy.

Cloud and third‑party processors use the standard to define responsibilities when de‑identification or oversight is outsourced. Benefits include stronger data governance, reduced re‑identification risk, and clearer alignment with privacy law and corporate privacy policies.

Related standards

ISO/IEC 20889 - privacy enhancing data de‑identification terminology and techniques

ISO/IEC 29100 - privacy framework

ISO/IEC 27000 series - information security management vocabulary

ISO 31000 - risk management

Keywords: data de‑identification, privacy enhancing, re‑identification risk, PII, de‑identified data, data governance, threat modelling, anonymization, pseudonymization, ISO/IEC 27559.

ISO/IEC 27559:2022 PDF

Abstract

Похожие стандарты

Overview - ISO/IEC 27559:2022 (Privacy enhancing data de-identification framework)

Key topics and technical requirements

Applications - who uses ISO/IEC 27559 and why

Related standards

Технические детали

ISO/IEC 20889:2018

Privacy enhancing data de-identification terminology and classification of techniques

SIST EN ISO/IEC 29100:2020

Information technology - Security techniques - Privacy framework (ISO/IEC 29100:2011, including Amd 1:2018)

BS EN ISO/IEC 27000:2020

Information technology. Security techniques. Information security management systems. Overview and vocabulary

BS ISO/IEC 27557:2022

Information security, cybersecurity and privacy protection. Application of ISO 31000:2018 for organizational…