Nonconformity and corrective action (10.2)
The standard asks you to react, analyse the cause, act where needed and review effectiveness, keeping evidence of all of it. A breach is an incident; if it reveals that a control was not working, it is also a nonconformity.
Continual improvement (10.1)
Improvement is demonstrated through trends: fewer overdue requests, less time to decide whether to notify a breach, more processors reviewed on schedule.
Example
A fictitious accountancy firm finds during an internal audit that three access requests were answered after 40 days. The cause: they arrived in a generic inbox with no owner. The action: a single form with a deadline and an alert. Six months later, all were on time.
What an auditor usually asks for
- A nonconformity log with cause and action
- Dated verification of effectiveness
- Links between breaches, findings and actions
- Indicator trends in the management review
How to cover improvement in Kimobox
- 1Open the nonconformity from the breach, the audit or the overdue request.
- 2Require the root cause before moving on to corrective action.
- 3Schedule the effectiveness check for a later date.
The root cause is mandatory: a nonconformity is never closed with the correction alone.
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO/IEC 27701:2025 — Privacy information management systems. Requirements and guidance ISO/IEC · Second edition, October 2025
- ISO/IEC 27701:2019 — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management ISO/IEC · First edition, August 2019; withdrawn in October 2025
- Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) EUR-Lex · 27 April 2016; applicable since 25 May 2018
- ISO/IEC 27001:2022 — Information security management systems ISO/IEC · 25 October 2022