ISO 27701 Privacy Information Management Course

Lesson 1 • Core Privacy Concepts and Principles

Introduces fundamental privacy definitions, data subject rights, and lawful processing bases. Provides the conceptual vocabulary needed throughout the course.

Lesson 2 • Global Privacy Regulatory Landscape

Surveys major international privacy frameworks and their common requirements. Contextualises ISO 27701 as a globally applicable management standard.

Lesson 3 • Relationship Between Privacy and Security

Explains how privacy and information security objectives overlap and diverge. Establishes why a unified management approach reduces organisational risk.

Lesson 1 • Certification and Audit Framework

Outlines the certification process, audit types, and conformity assessment requirements. Prepares students for the organisational journey toward ISO 27701 certification.

Lesson 2 • Key Definitions and Terminology

Establishes precise ISO 27701 terminology to ensure consistent interpretation. Prevents misapplication of requirements due to definitional ambiguity.

Lesson 3 • Business Case for ISO 27701 Adoption

Quantifies organisational benefits including regulatory alignment, trust, and risk reduction. Equips students to justify implementation investment to leadership.

Lesson 4 • Standard Architecture and Scope

Maps the clause structure of ISO 27701 and its relationship to ISO 27001 and ISO 27002. Clarifies what the standard does and does not mandate.

Lesson 1 • Documented Information Requirements

Specifies mandatory and recommended documentation for ISO 27701 conformance. Establishes document control practices that satisfy auditor expectations.

Lesson 2 • Planning: Risks, Objectives, and Controls

Applies risk-based thinking to identify privacy risks and set measurable PIMS objectives. Links risk treatment decisions to control selection.

Lesson 3 • Defining PIMS Scope and Context

Guides scoping decisions based on organisational context, stakeholder needs, and processing activities. A well-defined scope prevents audit nonconformities.

Lesson 4 • Resource and Competence Management

Identifies resource requirements, competence gaps, and awareness programme needs. Ensures the organisation can sustain PIMS operations over time.

Lesson 1 • Risk Treatment Options and Controls

Explains the four treatment options and maps them to ISO 27701 Annex controls. Ensures treatment decisions are documented and traceable.

Lesson 2 • Records of Processing Activities

Builds compliant records of processing activities as a foundational accountability tool. Links ROPA entries to risk assessment and control selection.

Lesson 3 • Data Protection Impact Assessments

Covers when and how to conduct DPIAs as a core privacy risk tool. Connects DPIA outputs to PIMS risk treatment decisions.

Lesson 4 • Privacy Risk Assessment Methodology

Introduces risk assessment frameworks applicable to personal data processing activities. Establishes a repeatable methodology for identifying and evaluating privacy risks.

Lesson 1 • PII Sharing, Transfer, and Disclosure

Governs controls for lawful data sharing, cross-border transfers, and third-party disclosures. Ensures transfers are documented and legally supported.

Lesson 2 • Conditions for PII Collection and Processing

Covers lawful basis determination, purpose limitation, and data minimisation controls. These controls form the legal and ethical foundation of controller obligations.

Lesson 3 • Obligations to PII Principals

Details controls for providing notice, obtaining consent, and honouring data subject rights. Operationalises transparency and accountability obligations.

Lesson 4 • Retention, Deletion, and Accuracy Controls

Implements controls for data lifecycle management including retention schedules and deletion. Addresses accuracy obligations that reduce regulatory exposure.

Lesson 1 • Processor Obligations and Boundaries

Defines the scope of processor authority and the limits of acting on controller instructions. Establishes the contractual and operational boundaries processors must respect.

Lesson 2 • Sub-Processor Management Controls

Covers controls for engaging, authorising, and monitoring sub-processors. Ensures the processor's supply chain does not introduce unmanaged privacy risk.

Lesson 3 • Records and Accountability for Processors

Establishes processor-specific documentation requirements including processing records and audit logs. Provides the evidence base needed for processor certification audits.

Lesson 4 • PII Principal Rights Support for Processors

Details how processors support controllers in fulfilling data subject rights requests. Clarifies processor responsibilities without overstepping controller authority.

Lesson 1 • Continual Improvement Processes

Applies nonconformity management and corrective action processes to drive PIMS maturity. Demonstrates how improvement cycles sustain long-term certification.

Lesson 2 • Management Review of the PIMS

Structures the management review process to evaluate PIMS performance and strategic alignment. Ensures leadership remains engaged and informed about privacy posture.

Lesson 3 • Privacy Incident Management

Establishes processes for detecting, reporting, and responding to personal data breaches. Links incident management to PIMS improvement and regulatory notification obligations.

Lesson 4 • Monitoring and Measurement Framework

Defines what to measure, how to measure it, and how to analyse results within the PIMS. Connects measurement outputs to management review and continual improvement.

Lesson 1 • Demonstrating Privacy Accountability to Stakeholders

Develops external and internal accountability reporting to regulators, customers, and boards. Accountability reporting is a key differentiator for certified organisations.

Lesson 2 • Strategic Privacy Roadmap Development

Builds a multi-year privacy programme roadmap aligned with business objectives and regulatory trends. Translates PIMS findings into prioritised strategic initiatives.

Lesson 3 • Privacy in Emerging Technologies

Addresses privacy risks and controls for cloud computing, AI, and IoT environments. Prepares practitioners to extend PIMS coverage to novel processing contexts.

Lesson 4 • Privacy Programme Maturity Models

Applies maturity frameworks to assess and advance PIMS capability beyond basic conformance. Maturity assessments guide strategic investment in privacy programme development.