ISO

Introduction

The objective of this page is to provide a high-level view of activities related to privacy standards in ISO. It does not cover security standards (but it does cover standards that cover both security and privacy).

Most projects are developed within ISO/IEC JTC1/SC27. More info can be found on in the SC27 portal:

Note that the portal will in general contain more information than this wiki, which focuses mainly on work carried out in ISO/IEC JTC1/SC27/WG5.The convenor is Kai Rannenberg, and the vice convenor is Jan Schallaböck. WG5 regularly publishes a document a standing document (SG1) on WG5 roadmap. It can be found in [1]

Some of the projects are also carried out in ISO/IEC JTC1/SC27/WG4.The convenor is Faud Khan, and the vice convenor is Johann Amsenga

Projects related to consumer protections are carried out within ISO PC317 from 2018 to 2023 and within ISO/IEC JTC 1/SC 44 (Consumer protection in the field of privacy by design) since 2024, convened by Jan Schallaböck. This included the development of ISO 31700 (Consumer protection: privacy by design for consumer goods and services).

Some conventions on ISO standards

The important things to know concerning ISO standards steps:

Standard	PWI: Preliminary work item (previously SP: Study period in SC27) NWIP: New Work Item Proposal NP: New Work Item WD: Working Draft CD: Committee Draft DIS: Draft International Standard FDIS: Final Draft International Standard IS: International Standard
Technical report	PWI: Preliminary work item (previously SP: Study period in SC27) NWIP: New work item proposal NP: New work item DTR: Draft Technical Report (formerly PDTR: Preliminary Draft Technical Report) TR: Technical Report
Technical specification	PWI: Preliminary work item (previously SP: Study period in SC27) NWIP: New Work Item Proposal NP: New Work Item WD: Working Draft DTS: Draft Technical Specification (formerly PDTS: Preliminary Draft Technical Specification) Technical Specification

Meetings

Progress is finalised in plenary meetings (taking place every 6 months).

Here is a list of meetings that took place or that will take place in SC27.

2014	April 7-15, 2014 Hong Kong Oct 20-24, 2014 Mexico City, Mexico
2015	May 4-12, 2015 Kuching, Malaysia Oct 26-30, 2015 Jaipur, India
2016	April 11-15, 2016 Tampa, USA Oct 23 (sunday) - 27 (thursday), 2016, Abu Dhabi, UAE
2017	April 18-22, 2017, Hamilton, New Zealand Oct 30- Nov 3, 2017, Berlin, Germany
2018	April, 16-20 Wuhan, China Sept 30 - Oct 4 - Gjovik, Norway
2019	April 1-5, Tel-Aviv, Israel October 14-18, Paris, France 19 October, Paris (jointly with SC27)
2020	April 21-26, Virtual meeting Sept 12-16, Virtual meeting
2021	April 12-15, Virtual meeting October 19-29, Virtual meeting
2022	March 29 - April 8, Virtual meeting Sept 26-30, Hybrid meeting - Luxembourg -
2023	April 17-21, Hybrid meeting - Redmond, US October 16-20, Hybrid meeting - Seoul, Korea
2024	April 8-12, Hybrid meeting - Manchester, UK September 26 - October 5, Virtual
2025	March 10-14, Hybrid meeting - Fairfax USA

ISO 31700 is dealt with in another committee (PC317 initially and now iSO/IEC JTC1/SC44). Here is a list of meetings that took place or that will take place in PC317.

2018	Nov 1-2, 2018, London
2019	Feb 6-8, Berlin (adhoc group) May 20-23, Toronto 19 October, Paris (jointly with SC27) 21-23 October, Paris (colocated with SC27)
2020	17-20 March, Virtual meeting 30 Sept - 2 Oct, Virtual meeting
2021	19-22 March, Virtual meeting 13-17 September, Virtual meeting
2022	16-20 May, Virtual meeting

Privacy references lists

Scope

The WG5 Standing Document 2 contains references with relevant descriptions to privacy-related:

Privacy regulatory authorities and regulations.
Standards.
Guidelines.
Newsletters and forums.
Organisations and associations.
Projects.
Data retention periods.

The WG5 Standing Document 2 shall not be considered as:

Legal interpretations.
Having been legally validated by a global law firm or relevant lawyers.

Documentation

https://www.din.de/resource/blob/78924/5ced65e40dcbe6e503c2392c75f3dd1e/sc27wg5-sd2-data.pdf

Calendar

This document is regularly updated

Published standards

19608:2018 TS Guidance for developing security and privacy functional requirements based on 15408

Editor	Naruki Kai
Scope	This Technical Report provides guidance for: developing privacy functional requirements as extended components based on privacy principles defined in ISO/IEC 29100 through the paradigm described in ISO/IEC 15408-2 selecting and specifying Security Functional Requirements (SFRs) from ISO/IEC 15408-2 to protect Personally Identifiable Information (PII) procedure to define both privacy and security functional requirements in a coordinated manner
Documentation	https://www.iso.org/standard/65459.html
Calendar	has been moved from TR to TS Published in October 2018
Comments

20547-4:2020 IS Big data reference architecture - Part 4 - Security and privacy

Editor	Jinhua Min, Xuebin Zhou
ScopeS	Specifies security and privacy aspects of the big data reference architecture including governance, collection, processing, exchange, storage and identification
Documentation	Is the follow-up of the NIST initiative for a big data interoperability framework. Reports are available there: [1], [2], [3], [4], [5], [6], [7] https://www.iso.org/standard/71278.html
Calendar	1st WD provided in June 2016 2nd WD provided in May 2017 3rd WD provided in November 2017 4th WD provided in April 2018 1st CD provided in November 2018 2nd CD provided in October 2019 DIS published in October 2019 FDIS publised in May 2020 Published in September 2020
Comments	WG9 is working on the following 20546 : big data overview and vocabulary 20547 : big data reference architecture Part 1: Framework and application process (TR) Part 2: Use cases and derived requirements (TR) Part 3: Reference architecture (IS) Part 4: Security and privacy fabric (IS) Part 5: Standards roadmap (TR) Part 4 is transferred to SC27 for development, with close liaison with WG 9 [Antonio Kung] The 20547 reference architecture should be instantiated into domain specific real architectures (e.g. health, transport, energy...). 20547-4 should therefore contain the generic elements that could be the starting point to derive a domain specific security and privacy fabric address the 5 Vs concern (volume, velocity, variety, veracity, value) Further to Berlin meeting, decision to change title (term fabric is removed)

20889:2018 IS Privacy enhancing de-identification terminology and classification of techniques

Editor	Chris Mitchell and Lionel Vodzislawsky
Scope	This international standard provides a description of privacy enhancing data de-identification techniques, to be used for describing and designing de-identification measures in accordance with the privacy principles in ISO/IEC 29100. In particular, this International Standard specifies terminology, a classification of de-identification techniques according to their characteristics, and their applicability for minimizing the risk of re-identification
Documentation	Slides presented by Chris Mitchel during IPEN workshop (June 5th 2015): http://ipen.trialog.com/wiki/File:CM_slide_for_150605.pdf https://www.iso.org/fr/standard/69373.html
Calendar	1st WD December 2015 2nd WD June 2016 1st CD Devember 2016 2nd CD May 2017 1st DIS January 2018 FDIS August 2018 Published in November 2018
Comments

27006-2:2021 TS Requirements for bodies providing audit and certification of information security management systems – Part 2: Privacy information management systems

Editor	Helge Kreutzmann, Fuki Azetsu, Hans Hedbom, Alan Shipman
Scope	This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701 in combination with ISO/IEC 27001, in addition to the requirements contained within ISO/IEC 27006 and ISO/IEC 27701. It is primarily intended to support the accreditation of certification bodies providing PIMS certification. Conformance to the requirements contained in this document needs to be demonstrated in terms of competence and reliability by certification body providing PIMS certification, and the guidance contained in this document provides additional interpretation of these requirements for certification body providing PIMS certification. NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes.
Documentation	https://www.iso.org/standard/71676.html
Calendar	Started in Paris October 2019 1st DTS published in July 2020, 2nd DTS published in October 2020 Publication in February 2021 Further to the March 2022 meeting, a revision is underway. This project has been renumbered to 27706 and renamed to Requirements for bodies providing audit and certification of privacy information management systems (see link below)
Comments

27018:2014 IS Code of practice for protection of PII in public clouds acting as PII processors

Editor	Revision: Ramaswamy Chandramouli, Hendrik Decroos
Scope	This International Standard establishes control objectives, controls and guidelines for implementing measures to protect Personally Identifiable Information (PII) in accordance with the privacy principles in ISO/IEC 29100 for the public cloud computing environment. It specifies guidelines based on ISO/IEC 27002, taking into consideration the regulatory requirements for the protection of PII which might be applicable within the context of the information security risk environment(s) of a provider of public cloud services. The standard concerns public cloud only and cloud service providers acting as PII processors.
Documentation	https://www.iso.org/standard/61498.html
Comments	published in 2014 Revision underway Further to the April 2023 meeting, discussion is taking place for a revision

27400:2022 IS Security and Privacy for the Internet of Things

Editor	Faud Khan, Koji Nakao, Luc Poulin, Antonio Kung (initial stages)
Scope	This document provides guidelines on risks, principles and controls for security and privacy of Internet of Things (IoT).
Documentation	https://www.iso.org/standard/44373.html
Calendar	Started in Wuhan April 2018 1st WD provided in June 2018 2nd WD provided in November 2018 3rd WD provided in June 2019 1st CD provided in December 2019 2nd CD provided in May 2020 3rd CD provided in March 2021 DIS provided in April 2021 FDIS provided in January 2022 Published in June 2022
Comments	Follow up of SP Privacy guidelines for IoT (WG5) SP Security guidelines for IoT (WG4) SP Security and privacy guidelines for IoT (WG4 with participation of WG5) Aprll 2020: Renamed from 27030 to 27400

27402:2023 IS IoT security and privacy - Device baseline requirements

Editor	Elaine Newton, Amit Elazari Bar On, Faud Khan
Scope	This document provides baseline ICT requirements for IoT devices to support security and privacy controls
Documentation	https://www.iso.org/standard/80136.html
Calendar	1st WD provided in May 2020 1st CD provided in November 2020 2nd CD provided in July 2021 DIS provided in December 2022 FDIS provided in October 2023 Publication in November 2023
Comments	Is a WG4 project. Delay between 2nd CD and DIS was due to discussions on requirements conformance (e.g. 27402 focuses on device requirements rather than device developer requirements)

27403:2024 IS Security techniques - ioT security and privacy - Guidelines for IoT domotics

Editor	Qin QIu, Yanghuichen Lin, Luc Poulin
Scope	This document provides guidelines to analyse security and privacy risks and identifies controls that can be implemented in Internet of Things (IoT)-domotics systems.
Documentation	https://www.iso.org/standard/78702.html
Calendar	Started in Paris October 2018 with a preliminary version 1st WD provided in October 2019 2nd WD provided in May 2020 3rd WD provided in March 2021 4th WD provided in April 2021 5th WD provided in May 2021 6th WD provided in July 2021 1st CD provided in January 2022 2nd CD provided in June 2022 DIS provided in October 2022 2nd DIS provided in April 2023 FDIS provided in January 2024 Publication in June 20é4
Comment	Is a WG4 project

27550:2019 TR Privacy engineering for system lifecycle processes

Editor	Antonio Kung, Mathias Reinis
Scope	This technical report provides privacy engineering guidelines that are intended to help organisations integrate recent advances in privacy engineering into their engineering practices: it describes the relationship between privacy engineering and other engineering viewpoints (system engineering, security engineering, risk management); it describes privacy engineering activities in key engineering processes such as knowledge management, risk management, requirement analysis, architecture design; The intended audience includes engineers and practitioners who are involved in the development, implementation or operation of systems that need privacy consideration, as well as managers in organisations responsible for privacy, development, product management, marketing, and operations
Documentation	A youtube presentation on privacy engineering: https://www.youtube.com/watch?v=BymNvbmSr2E https://www.iso.org/standard/72024.html
Calendar	1st WD provided in January 2017 2nd WD provided in June 2017 1st PDTR provided in January 2018 2nd PDTR provided in June 2018 3rd PDTR provided in October 2018 Version for publication provided in April 2019 Publication in September 2019
Comments	[Antonio Kung] Follows ISO/IEC 15288 Systems and software engineering -- System life cycle processes Integrates major results from NIST 8062, CNIL PIA, ULD proposal on privacy protection goals (unlinkability, transparency, intervenabilty), LINDDUN threat analysis and mitigation taxonomy, Radboud university design strategies

27551:2021 IS Requirements for attribute-based unlinkable entity authentication

Editor	Nat Sakimura, Jaehoon Na, Pascal Pailler
Scope	This International Standard Defines a framework including terms, entity roles and interactions for attribute-based unlinkable entity authentication, and Specifies requirements for attribute-based unlinkable entity authentication implementations. This International Standard is applicable to any information system that performs attribute-based unlinkable entity authentication
Documentation	https://www.iso.org/standard/44373.html
Calendar	1st WD provided in April 2017 2nd WD provided in Dec 2017 3rd WD provided in July 2018 4th WD provided in February 2019 1st CD provided in October 2019 DIS provided in November 2019 FDIS provided in September 2020 Published in September 2021
Comments

27555:2021 IS Guidelines on Personally Identifiable Information Deletion

Editor	Dorotea Alessandra de Marco, Yan Sun, Volker Hammer
Scope	This document specifies the conceptual framework for deletion of PII. It gives guidelines for establishing organizational policies that embrace concepts presented by specifying: a harmonised terminology for PII deletion, an approach for defining deletion/de-identification rules in an efficient way, a description of required documentation, and a definition of roles, responsibilities and processes. This document is intended to be used by organizations where PII and other personal data is being stored or processed. This document does not address: specific legal provision, as given by national law or specified in contracts, specific deletion rules for particular types of PII as are to be defined by PII controllers for processing???? deletion mechanisms including those for cloud storage, security of deletion mechanisms, specific techniques for de-identification of data.
Documentation	https://www.iso.org/fr/standard/71673.html
Calendar	1st WD provided in March 2019 2nd WD provided in June 2019 1st CD provided in December 2019. Title changed (former title: establishing a PII deletion concept in organisations) 2nd CD was published in June 2020 DIS was provided in January 2021 FDIS was provided in April 2021 Publication in October 2021
Comments	It is based on a German standard

27556:2022 IS User-centric privacy preferences management framework

Editor	Shinsaku Kiyomoto, Antonio Kung, Heung Youl Youm
Scope	This document provides a user-centric framework for handling personally identifiable information (PII), based on privacy preferences.
Calendar	Established in Gjovik (October 2018) 1st WD provided In June 2019 2nd WD provided in December 2019 1st CD provided in May 2020 2nd CD provided in October 2020 3rd CD provided in April 2021 DIS provided in October 2021 FDIS provided in May 2022 Publication in October 2022
Documentation	https://www.iso.org/standard/71674.html
Comments	Project named changed from "User-centric framework for the handling of personally identifiable information (PII) based on privacy preferences" to "User-centric privacy preferences management framework"

27557:2022 IS Organizational privacy risk management

Editor	Kimberly Lucy, Markus Gierschmann, Kelvin Magtalas, Carlo Harpes
Scope	Provides guidelines for organizational privacy risk management. Designed to provide guidance to organizations processing personally identifiable information (PII) for integrating risks to the organization related to the processing of PII, including the privacy impact to individuals, as part of an organizational privacy risk management program. Assists in the implementation of a risk-based privacy program which can be integrated in the overall risk management of the organization, and supports the requirement for risk management as specified in management systems (such as ISO/IEC 27701:2019). This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which are organizations processing PII, or developing products and services that can be used to process PII.
Documentation	https://www.iso.org/standard/71674.html
Calendar	1st WD was published in May 2020 2nd WD was published in October 2020 1st CD was published in April 2021 DIS was provided in October 2021 FDIS was provided in June 2022 Published in November 2022

27559:2022 IS Privacy-enhancing data de-identification framework

Editor	Malcolm Townsend, Santa Borel
Scope	This document provides a framework for identifying and mitigating re-identification risks and risks associated with the lifecycle of de-identified data. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations implementing data de-identification processes for privacy enhancing purposes.
Documentation	https://www.iso.org/standard/71677.html
Calendar	1st WD was provided in July 2020 2nd WD was provided in February 2021 1st CD was prrovided in April 2021 DIS was provided in October 2021 FDIS was provided in June 2022 Published in November 2022

27560:2023 TS Privacy technologies – Consent record information structure

Editor	Jan LIndquist, Andrew Hughes, Kelvin Magtalas
Scope	This document specifies an interoperable, open and extensible information structure for recording PII Principals' or data subjects' consent to data processing. This document further provides guidance on the use of consent receipts and consent records associated with a PII Principal's data processing consent to support the: — provision of a record of the consent to the PII Principal; — exchange of consent information between information systems; and, — management of the lifecycle of the recorded consent.
Documentation	https://www.iso.org/standard/80392.html
Calendar	1st WD was provided in May 2020 2nd WD was provided in January 2021 3rd WD was provided in April 2021 4th WD was provided in October 2021 5th WD was provided in June 2022 DTS was provided in October 2022 Publication in August 2023

27561:2024 IS POMME Privacy operationalization model and method for engineering

Leaders	John Sabo, Antonio Kung, Srinivas Poorsala, Dorotea Alessandra de Marco, Aswathy KUMAR&nbsp, Michele Drgon;
Objective	This document describes a model and method to operationalize privacy principles into sets of controls and functional capabilities. the method is described as a process following ISO/IEC/IEEE 24774; it operationalizes ISO/IEC 29100; it is intended for engineers and other practitioners developing systems controlling or processing PII; it is designed for use with other standards and privacy guidance; it supports networked, interdependent applications and systems.
Documentation	https://www.iso.org/standard/80394.html
Calendar	1st WD provided in April 2021 2nd WD provided in October 2021 1st CD provided in May 2022 2nd CD provided in November 2022 DIS provided in May 2023 FDIS provided in October 2023 standard published in March 2024
Comments	It the result of the study period privacy engineering model It is based on OASIS-PMRM http://docs.oasis-open.org/pmrm/PMRM/v1.0/cs02/PMRM-v1.0-cs02.html

27562:2024 IS Privacy guidelines for fintech services

Leaders	Heung Youl Youm, Janssen Esguerra
Objective	This document provides guidelines on privacy for fintech services. It identifies all relevant business models and roles in consumer-to-business relations and business-to-business relations, as well as privacy risks and privacy requirements, which are related to fintech services. It provides specific privacy controls for fintech services to address privacy risks. This document is based on the principles from ISO/IEC 29100, ISO/IEC 27701, and ISO/IEC 29184, the privacy impact assessment framework described in ISO/IEC 29134, and the risk management guideline described in ISO 31000. It also provides guidelines focusing on a set of privacy requirements for each stakeholder. This document can be applicable to all kinds of organizations such as regulators, institutions, service providers and product providers in the fintech service environment.
Documentation	https://www.iso.org/standard/80395.html
Calendar	1st WD provided in April 2021 2nd WD provided in October 2021 3rd WD provided in May 2022 1st CD provided in November 2023 2nd CD provided in May 2023 DIS provided in November 2023 FDIS provided in May 2024 Publication in December 2024
Comments	It the result of the study period privacy guidelines for Fintech services

27563:2023 TR Security and privacy in artificial intelligence use cases - Best practices

Leaders	Antonio Kung, Peter Dickman, Heung Youl Youm, Yunwei Zhao, Volker Smoljko, Kelvin Magtalas, Srinivas Poorsala
Objective	This document provides information on how to assess the impact of security and privacy in AI use cases, covering in particular those published in ISO/IEC TR 24030 (Information technology – Artificial Intelligence (AI) – use cases)
Documentation	https://www.iso.org/standard/80396.html ISO/IEC 24030 covers 132 use cases that are described here: https://standards.iso.org/iso-iec/tr/24030/ed-1/en/Use+cases-v05_electronic_attachment_022021.pdf ISO/IEC 27563 covers the security of privacy of the 132 use cases, described here: https://standards.iso.org/iso-iec/tr/27563/ed-1/en/Security-privacy-AI-use-cases.pdf
Calendar	Established in October 2021 Draft TR was provided in December 2021 Further to March 2022 meeting, title is changed from Impact of security and privacy in AI use cases to security and privacy in AI use cases, and 2nd Draft TR was provided in May 2022 3rd draft DTR was provided in September 2022 Further to April 2023 meeting, publication was mede in May 2023
Comments	It is the result of phase 1 of PWI 6089 Impact of AI on security and privacy

27570:2021 TS Privacy Guidelines for Smart Cities

Editor	Antonio Kung, Heung Youl Youm, Clotilde Cochinaire
Scope	The document takes into account a multiple agency as well as a citizen centric viewpoint, and provides guidance on how privacy standards can be used at a global level and at an organisational level for the benefit of citizens This document is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, that provides service in the smart city environments
Documentation	https://www.iso.org/standard/71678.html
Calendar	1st WD was provided in June 2018 further the Wuhan meeting. 2nd WD was provided in October 2018 further to the Gjovik meeting. A 1st PDTS was provided in May 2019 further to the Tel Aviv meeting. A 2nd PDTS was provided in November 2019 further to the Paris meeting A 3rd PDTS was provided in May 2020 further to the April 2020 virtual meeting The document will go to publication further to the September 2020 virtual meeting. The standard was published in January 2021 see following press release: https://www.iso.org/news/ref2631.html The standard was confimed in October 2024
Comments	First ecosystem oriented standard for privacy Follow up of SP Privacy in Smart cities Liaison will take place with WG11 (smart cities), SC40 (IT Service Management and IT Governance), TC268/SC1/WG4 (sustainable cities and communities), EIP-SCC (European Innovation Platform - Smart Cities and Communities)

27701:2019 IS Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management - Requirements and guidelines

Editor	Alan Shipman, Heung Youl Youm, Oliver Weissmann, Srinivas Poosarla
Scope	This document specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS) in the form of an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy management within the context of the organization. In particular, this document specifies PIMS-related requirements and provides guidance for PII controllers and PII processors holding responsibility and accountability for PII processing. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which are PII controllers and/or PII processors processing PII within an ISMS. Excluding any of the requirements specified in clause 5 of this document is not acceptable when an organization claims conformity to this document.
Documentation	https://www.iso.org/standard/71670.html
Calendar	1st WD provided in April 2017 2nd WD provided in June 2017 1st CD provided in April 2018 2nd CD provided in June 2018 DIS provided in March 2019 Publication in August 2019 A revision has been initiated in October 2022
Comments	Was initially ISO/IEC 27552. Was renamed to ISO/IEC 27701 in August 2019 A second version is underway since Mid 2023 with a title change: Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance

29100:2011 IS Privacy framework

Editor	Stefan Weiss Revision : Nat Sakimura, Jan Schallaboeck
Scope	This International Standard provides a framework for defining privacy control requirements related to personally identifiable information within an information and communication technology environment.This International Standard is designed for those individuals who are involved in specifying, procuring, architecting, designing, developing, testing, administering and operating ICT systems.
Documentation	Is a free standard : see http://standards.iso.org/ittf/PubliclyAvailableStandards/index.html
Comments	Revision published in February 2024

29101:2018 IS Privacy architecture framework

Editor	Stefan Weiss and Dan Bogdanov, For revision: Nat Sakimura, Shinsaku Kiyomoto
Scope	This International Standard describes a privacy architecture framework that describes concerns for ICT systems that process PII; lists components for the implementation of such systems; and provides architectural views contextualizing these components. This International Standard is applicable to entities involved in specifying, procuring, architecting, designing, testing, maintaining, administering and operating ICT systems that process PII. It focuses primarily on ICT systems that are designed to interact with PII principals.
Documentation	https://www.iso.org/standard/75293.html
Comments	1st edition published in april 2013 Current edition confirmed in May 2024

29134:2023 IS Guidelines for Privacy impact assessment

Editor	Mathias Reinis
Scope	This document gives guidelines for: a process on privacy impact assessments, and a structure and content of a PIA report. It is applicable to all types and sizes of organizations, including public companies, private companies, government entities and not-for-profit organizations. This document is relevant to those involved in designing or implementing projects, including the parties operating data processing systems and services that process PII.
Documentation	https://www.iso.org/fr/standard/86012.html
Calendar	Published in June 2017
Comments	Is the second edition. First edition was published in 2017

29151:2017 IS Code of Practice for PII Protection (also a ITU document - ITU-T X.1058)

Editor	Heung Youl Youm, Alan Shipman Editors for revision: Heung Youl Youm, Alan Shipman, Erik Boucher, Sungchae Park
Scope	This International Standard establishes commonly accepted control objectives, controls and guidelines for implementing controls, to meet the requirements identified by a risk and impact assessment related to the protection of Personally Identifiable Information (PII). In particular, this International Standard specifies guidelines based on ISO/IEC 27002, taking into consideration the regulatory requirements for processing PII which may be applicable within the context of an organization's information security risk environment(s). This International Standard is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, which process PII, as part of their information processing.
Documentation	March 3rd presentation made by editor during an informal confcall with Dawn Jutla (OASIS) and Antonio Kung (PRIPARE): http://ipen.trialog.com/wiki/File:X.gpim-29151_oasis.pdf https://www.iso.org/standard/62726.html
Calendar	Published in August 2017 PWI 8888 to prepare revision in March 2023 1st CD of revision provided in October 2023 2nd CD of revision to be provided in Apri 2924
Comments	Also an ITU reference (ITU-T X.gpim)

29184:2020 IS Online privacy notices and consent

Editor	Nat Sakimura, Srinivas Poorsala, Jan Schallaboeck
Scope	This document is a specification for the content and the structure of online privacy notices as well as the process of requesting consent to collect and process PII from a PII principal. This document is applicable to all situations, where a PII controller or any other entity processing PII interacts with PII principals in any online context.
Documentation	https://www.iso.org/standard/71678.html
Calendar	1st WD provided in June 2016 2nd WD provided in April 2017 3rd WD provided in June 2017 1st CD provided in December 2017 2nd CD provided in July 2018 3rd CD provided in March 2019 DIS provided in may 2019 FDIS provide in march 2020 Publication in June 2020
Comments	Initiated in Jaipur (Oct 2015) Follows Study Period initiated in Kuching (May 2015) User friendly online privacy notice and consent

29190:2015 IS Privacy capability assessment model

Editor	Alan Shipman
Scope	This International Standard provides organizations with high-level guidance about how to assess their capability to manage privacy-related processes. In particular, it: specifies steps in assessing processes to determine privacy capability; specifies a set of levels for privacy capability assessment; provides guidance on the key process areas against which privacy capability can be assessed; provides guidance for those implementing process assessment; provides guidance on how to integrate the privacy capability assessment into organizations operations
Documentation	https://www.iso.org/standard/45269.html
Calendar
Comments

29191:2012 IS Requirements for partially anonymous, partially unlinkable authentication

Editor	Kazue Sako (NEC)
Scope	This International Standard defines requirements on relative anonymity with identity escrow based on the model of authentication and authorization using group signature techniques. This document provides guidance to the use of group signatures for data minimization and user convenience. This guideline is applicable in use cases where authentication or authorization is needed. It allows the users to control their anonymity within a group of registered users by choosing designated escrow agents.
Documentation	https://www.iso.org/standard/45270.html
Comments	Published in December 2012 Minor revision for FDIS in July 2024

31700-1:2023 IS Consumer Protection - Privacy-by-design for consumer goods and services - High level requirements

Editor	Project leader: Michelle Chibba
Scope	Specification of the design process to provide consumer goods and services that meet consumers’ domestic processing privacy needs as well as the personal privacy requirements of Data Protection. In order to protect consumer privacy the functional scope includes security in order to prevent unauthorized access to data as fundamental to consumer privacy, and consumer privacy control with respect to access to a person’s data and their authorized use for specific purposes. The process is to be based on the ISO 9001 continuous quality improvement process and ISO 10377 product safety by design guidance, as well as incorporating privacy design JTC1 security and privacy good practices, in a manner suitable for consumer goods and services
Documentation	See https://www.iso.org/standard/76402.html
Calendar	Official start date: November 1 2018 First meeting: November 1-2 2018, BSI London Adhoc meeting, February 24-24, 2019, DIN Berlin Second meeting : May 21-23 2018, Toronto, where 1st working draft will be discussed Joint JTC1/SC27/WG5 and PC317/WG1 meeting: October 19th 2019, Paris Third meeting: October 21-23 2019 AFNOR Paris Fourth meeting: March 17-20 2020 Virtual Fifth meeting: Sep 30-Oct 2 2020 Virtual Sixth meeting: April 19-22 2021 Virtual Seventh meeting September 13-17 2021 Virtual Eight meeting May 16-19 2022 Virtual
Versions	1st WD provided in March 2019 2nd WD provided in July 2019 3rd WD provided in Dec 2019 4th WD provided in June 2020 1st CD provided in March 2021 2nd CD provided in May 2021 DIS provided in January 2022 FDIS provided in June 2022 Publication in February 2023
Comments	Note that this is an ISO standard managed by the PC 317 technical committee that is chaired by Jan Schallaboek Further to the Seventh meeting, a proposal was made to provide a technical report on use cases. 31700 would be changed into a multipart standard ISO 31700-1 Privacy-by-design for consumer goods and servives - high level requirements ISO 31700-2 Privacy-by-design for consumer goods and servives - use cases see launch event : https://www.eventbrite.co.uk/e/launch-event-iso-31700-privacy-by-design-for-consumer-goods-and-services-tickets-488718479127

31700-2:2023 TR Consumer Protection - Privacy-by-design for consumer goods and services - Use cases

Editor	Project leader: Michelle Chibba Draft provided by AhG use cases: Antonio Kung (Ahg Convenor), Rae Dulmage, Peter Esisenegger, Gail Magnusson, Rusne Juozapaitene, Dorotea de Marco
Scope	This document provides suggestions on how to use ISO 31700-1 as well as use cases illustrating the application of ISO 31700-1. The intended audience includes engineers and practitioners who are involved in the development, implementation or operation of digitally enabled consumer goods and services.
Documentation	See https://www.iso.org/standard/76402.html
Calendar	May 2019 : request for use cases March 2020: creation of AhG on use cases April 2021: continuation of AhG on use cases September 2021: approval to create 31700-2Official start date: November 1 2018 June 2022: Draft technical report February 2023: Publication
Versions	1st intenal draft provided in September 2021 Draft TR provided in June 2022
Comments	Includes 3 use case: on-line retainling, fitness company, and smart locks. Note that the last two use cases are IoT use cases see launch event : https://www.eventbrite.co.uk/e/launch-event-iso-31700-privacy-by-design-for-consumer-goods-and-services-tickets-488718479127

Standards in development

5181 IS Security and privacy - Data provenance

Editor	Ryan Ko, Jan de Meer, Yi Zhang
Scope	This document provides guidelines, methodology and techniques for deriving securely information denoted to as provenance metadata about data assets from multiple sources, intermediaries or users.
Documentation	https://www.iso.org/standard/80971.html
Calendar	Started in February 2023
Comments	This is a SC 27/WG 4 project, a follow-up of PWI 5181 Data provenance 1st WD provided in March 2023 2nd WD provided in August 2023 3rd WD provided in December 2023 1st CD provided in June 2024 2nd CD provided in November 2024 3rd CD to be provided further to fairfax meeting in March 2025

10267 IS Personal information factor (PIF) in data related to real persons

Editor	Ian Opperman, Srinivas Poosarla, Dorotea Alessandra De Marco, Erik Boucher
Scope	The purpose of this document is to provide guidance on the methods to quantify the amount of personal information in a data set when that data contains information about the characteristics of, actions of, or relationships to, natural persons. This guidance on the quantification of the level of personal information can further inform the considerations for appropriate use, sharing and exchange of such data. This document is a high level, principles-based advisory standard which sets out terms and concepts, that can be referenced by organizations, persons and systems that use data.
Documentation	https://www.iso.org/standard/89607.html
Calendar	Started in October 2024
Comments	This project was initially submitted and approved in ISO/IEC JTC1/SC32 Data management and interchange 1st WD provided in October 2024 2nd WD to be provided in May 2025

27018 2nd Edition - IS Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors

Editor	Revision: Ramaswamy Chandramouli, Hendrik Decroos
Scope	This document establishes commonly accepted control objectives, controls and guidelines for implementing measures to protect personally identifiable information (PII) in line with the privacy principles in ISO/IEC 29100: for the public cloud computing environment. In particular, this document specifies guidelines based on ISO/IEC 27002:2022, taking into consideration the regulatory requirements for the protection of PII which can be applicable within the context of the information security risk environment(s) of a provider of public cloud services. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which provide information processing services as PII processors via cloud computing under contract to other organizations. The guidelines in this document can also be relevant to organizations acting as PII controllers. Hence this document is not meant to be used for certification purposes.
Documentation	https://www.iso.org/standard/61498.html
Comments	published in 2014 Revision underway DIS provided in October 2023 FDIS provided in October 2024

27045 IS Big data security and privacy — Guidelines for managing big data risks

Editor	Dapeng Liu, Victoria Hailey, Shiqi Li
Scope	This document provides guidance on how to navigate the threats that can arise during the big data life cycle from the various big data characteristics that are unique to big data: volume, velocity, variety, variability, volatility, veracity and value, including when using big data for the design and implementation of AI systems. This document can help organizations build or enhance their big data security and privacy capabilities, including when using big data in the development and use of AI systems. This document is applicable to all organizations that develop or use big data systems, regardless of their type, size or purpose.
Documentation	https://www.iso.org/standard/88970.html
Calendar	1sd WD was provided in July 2024 2nd WD Was provided in December 2024 3rd WD to be provided further to Fairfax March 2025 meeting
Comments	Follow-up of PWI 27045

27091 IS Cybersecurity and privacy - Artificial Intelligence - Privacy Protection

Editor	Priya Chakraborty, Antonio Kung, Byoung-Moon Chin
Scope	This document provides guidance for organizations to address privacy risks in artificial intelligence (AI) systems and machine learning (ML) models. The guidance in this document helps organizations identify privacy risks throughout the AI system lifecycle, and establishes mechanisms to evaluate the consequences of and treat such risks. This document is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations that develop or use AI systems.
Documentation	https://www.iso.org/standard/56582.html
Calendar	Project started in February 2023
Comments	Follow-up of PWI 6089 Impact of Artificial Intelligence on Security and Privacy Is also the counterpart of ISO/IEC 27090 Cybersecurity and privacy — Artificial Intelligence — Guidance for addressing security threats and failures in artificial intelligence systems (under development) 1st WD provided in May 2023 2nd WD provided in October 2023 3rd WD provided in December 2024 1st CD to be provided in April 2025

27560 Structure of personally identifiable information (PII) processing records

Editor	Jan LIndquist, Andrew Hughes, Kelvin Magtalas
Scope	This document specifies an interoperable, open, and extensible information structure for recording information relevant to the processing of Personally Identifiable Information (PII). This document further provides guidance on the use of this information to support the: — provision of a record of PII processing to another entity within or outside the organisation; — provision of a PII processing record to the PII Principal in the form of a ‘Privacy Receipt’; — exchange of PII processing information i.e. information on how PII is processed between information systems; and, — management of the lifecycle of PII processing as based on the use of a specific lawful basis.
Documentation
Comment	Is a revision of ISO/IEC TS 27560, further to PWI 27569 PII processing record information structure
Calendar	1st WD to be provided in July 2025

27564 TS Privacy protection - Guidance on the use of models for privacy engineering

Leaders	Michelle Chibba, Antonio Kung, Jonathan Fox, Srinivas Poosarla
Objective	This document provides guidance on how to use modelling in privacy engineering. It describes categories of models that can be used, the use of modelling to support engineering, and the relationships with other references and standards for privacy engineering and for modelling.. It provides high-level use cases describing how models are used.
Documentation	https://www.iso.org/standard/89319.html
Calendar	1st WD provided in October 2024 1st DTS to be provided in April 2025
Comments	Initiated as a result of the H2020 project PDP4E Follow-up of PWI 27564 Privacy models

27565 IS Guidance on privacy preservation based on zero-knowledge proofs

Leaders	Bingsheng Zhang, Patrick Curry, Srinivas Poosarla
Objective	This document provides guidelines on using zero knowledge proofs (ZKP) to improve privacy by reducing the risks associated with the sharing or transmission of personal data between organisations and users by minimizing the information shared. It will include several ZKP functional requirements relevant to a range of different business use cases, then describes show different ZKP models can be used to meet those functional requirements securely.
Documentation	https://www.iso.org/standard/80398.html
Calendar	Established in October 2021 1st WD provided in June 2022 2nd WD provided in November 2022 3rd WD provided in May 2023 1st CD provided in December 2023 2nd CD provided in May 2024 DIS provided in October 2024 2nd DIS to be provided in April 2025
Comments	It the result of PWI 7758 Guidance on privacy preservation based on zero knowledge proofs

27566-1 IS Age assurance - Part 1: Framework

Leaders	Tony Allen, Denis Pinkas, Mark Svancarek
Scope	This document establishes core principles, including privacy and security, for the purpose of enabling age-related eligibility decisions
Documentation	https://www.iso.org/standard/88143.html
Calendar	Started in May 2023 1st WD provided in December 2023 2nd WD provided in March 2024 1st CD provided in July 2024 DIS provided in October 2024 Treatment of DIS still on-going
Comments	It the result of PWI 7732 Age verification

27566-3 IS Age assurance - Part 3: Approaches to comparison or analysis

Leaders	Tony Allen, Denis Pinkas, Mark Svancarek
Scope	This document establishes approaches to specifying, differentiating and comparing characteristics of age assurance methods and components during an evaluation.
Documentation	https://www.iso.org/standard/88147.html
Calendar	Started in October 2023 1st WD provided in December 2023 2nd WD provided in July 2024 3rd WD to be provided in April 2025
Comments	It the result of PWI 7732 Age verification Former title: Benchmarks for benchmarking analysis

27568 TS Security and privacy of digital twins

Leaders	Antonio Kung, Karim Tobich
Scope	This document provides a framework for organizations to address security and privacy risks in digital twin systems. This document helps organizations identify security and privacy risks throughout the digital twin systems lifecycles, and establishes mechanisms to evaluate the consequences and to treat risks.
Documentation
Calendar	Request for ballot made
Comments	Needs to liaise with on-going work in ISO/IEC JTC 1/SC 41 IoT and digital twins Is the result of PWI 2758 Security and privacy of digital twins

27573 IS Privacy protection of user avatar and system avatar interactions in the metaverse

Leaders	Hoon Jae Lee, Hee Bong Choi, Rusne Juozapaitiene, Dae-Ki Kang, Vishnu Kanhere, Antonio Kung
Scope	This document provides requirements for protecting personally identifiable information((PII) during interactions between user avatars and system avatars in the metaverse. This document identifies and classifies the PII generated and used by user avatars and system avatars and addresses privacy threats in the spaces where the avatar operates during the interactions between the user avatar and the system avatar.
Documentation
Calendar	Request for ballot initiated in March 2025
Comments	Result from PWI

27574 IS Privacy in brain-computer interface (BCI) applications

Leaders	Srinivas Poorsala, Erik Boucher, Jyoty kushwaha, Binsheng Zhang, Marta beltran Pardo
Scope	This document provides requirements and guidelines on privacy for Brain Computer Interface Applications. It provides privacy controls specific to Brain Computer Interface Applications to address the privacy risks based on the principles described in ISO/IEC 29100 and ISO/IEC 27701.
Documentation
Calendar	Request for NP ballot initiated in April 2025
Comments	Result of PWI

27701 IS Privacy information management systems — Requirements and guidances

Editor	Alan Shipman, Heung Youl Youm
Scope	This document specifies requirements for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS). Guidance is provided to assist in the implementation of the controls in this document. This document is intended for PII controllers and PII processors holding responsibility and accountability for PII processing. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations.
Documentation	https://www.iso.org/standard/85819.html
Calendar	A revision has been initiated in October 2022 FDIS provided in June 2023 New format CD provided in October 2023 New DIS provided in June 2024 New FDIS provided in January 2025
Comments

27706 2nd Edition - IS Requirements for bodies providing audit and certification of privacy information management systems

Editor	Kimberly Lucy, Fuki Azetsu, Gigi Robinson
Scope	This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701 in combination with ISO/IEC 27001, in addition to the requirements contained within ISO/IEC 27006-1. It is primarily intended to support the accreditation of certification bodies providing PIMS certification. The requirements contained in this document need to be demonstrated in terms of competence and reliability by any body providing PIMS certification, and the guidance contained in this document provides additional interpretation of these requirements for any body providing PIMS certification. NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes.
Documentation	https://www.iso.org/standard/82894.html
Calendar	1st CD was provided in May 2022 2nd CD was provided in November 2022 DIS was provided in May 2023 Further to October 2023 meeting, document is being restructured DIS submitted in July 2024 FDIS submitted in November 2024
Comments	Follow-up of ISO/IEC 27006-2 TS

29151 2nd Edition - IS Controls and guidance for personally identifiable information protection

Editor	Heung Youl Youm, Alan Shipman Editors for revision: Heung Youl Youm, Alan Shipman, Erik Boucher, Sungchae Park
Scope	This International Standard establishes commonly accepted control objectives, controls and guidelines for implementing controls, to meet the requirements identified by a risk and impact assessment related to the protection of Personally Identifiable Information (PII). In particular, this International Standard specifies guidelines based on ISO/IEC 27002, taking into consideration the regulatory requirements for processing PII which may be applicable within the context of an organization's information security risk environment(s). This International Standard is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, which process PII, as part of their information processing.
Documentation	https://www.iso.org/standard/62726.html
Calendar	Preparation of revision started in September 2023 1st CD provided in February 2024 2nd CD provided in May 2024 DIS provided in October 2024 2nd DIS to be provided in April 2025
Comments	Also an ITU reference (ITU-T X.gpim)

Active Preliminary Work Items

PWI 7709 Security and privacy reference architecture for multi-party data fusion and mining (Started in April 2021)

Leaders	Xiaoyuan Bai, Jin Peng
Objective	This document provides the followings: a typical model of multi-sourced data processing and the stakeholders, and analysis the security concerns, challenges and objectives. a framework to mitigate the security challenges and concerns. detailed guidelines of the “security and privacy controls” which is one of the elements of the framework. mappings between security challenges and controls.
Documentation
Calendar	1st PWI in June 2021 2nd PWI in September 2021 3rd PWI in January 2022 4th PWI in March 2022 5th PWI in June 2022 Proposal for new project in February 2023 Further to proposal PWI is restarted in April 2023 1st PWI in September 2023 2nd PWI Presentation in October 2024 3rd PWI to be provided further to Fairfax meeting March 2025
Comments	Is a WG4 project

PWI 27046 Big data security and privacy - Implementation guidelines (restarted in April 2023)

Editor	Le Yu, Victoria Hailey, Jinghua Min
Scope	This proposal aims to analyze challenges and risks of big data security and privacy, and proposes guidelines for implmentation of big data secuirty and privacy in aspects of big data resources, and organizing, distributing, computing and destroying big data
Documentation	https://www.iso.org/standard/78572.html
Calendar	1st WD was provided in October 2019 2nd WD was provided in June 2020 3rd WD was provided in November 2020 4th WD was provided in April 2021 5th WD was provided in April 2022 1st CD was provided in October 2022 Further to April 2023 meeting, this project will be reverted to preliminary work item (PWI)
Comments	Is a WG4 project

PWI 27566 IS Age assurance - Part 2: Interoperability, technical architecture and guidelines for use (started in November 2023)

Leaders	Tony Allen, Denis Pinkas, Mark Svancarek
Scope	This document provides guidelines for interoperability, technical architecture and use of age assurance systems.
Documentation
Calendar	Started in November 2023 1st PWI text provided in December 2023 2nd PWI text provided in March 2024 NP voted on September 2024
Comments	It the result of PWI 7732 Age verification

PWI 27575 Privacy for metaverse frameworks (Started in March 2025)

Leaders	Hee Bong Choi, Hoon Jae Lee, Antonio Kung, Rusne Juozapaitiene, Vishnu Kanhere, HyunDuk Shin
Scope	This PWI aims to analysis a landscape of elements, personal identifiable information (PII), privacy threats, and privacy protection measures in the metaverse framework. The PWI provides a landscape of regulations, industry approaches and standards development in order to protect PII in the metaverse frameworks. It will: • Identify elements of metaverse frameworks; • Outline an architectural framework(s); • Describe key concepts and terminology, including definitions where possible; • Define privacy problems, including PII, threats, environment; and • Suggest NWIP as needed. Additionally, if collaboration with other SCs such as SC 24 is needed, this PWI may suggest joint work to enhance standardization harmonization;
Documentation
Calendar
Comments

Completed Preliminary Work Items or Study Periods

Completed study periods and pwis

ISO