Management commitment (5.1)
Top management must ensure that privacy objectives fit the strategy, that the system has resources and that it is built into business processes rather than left in a compliance folder.
Privacy policy (5.2)
This is the system’s internal policy, not the legal notice on the website. It records the commitment to meet applicable privacy requirements and to improve the system, and it provides the framework for setting objectives.
Roles and authorities (5.3)
Someone must be named as accountable for the system meeting the standard and for reporting to top management. Where there is a data protection officer, their role and independence must fit with that assignment, without mistaking them for the system owner.
What an auditor usually asks for
- A privacy policy that is approved, communicated and available
- A PIMS responsibility matrix
- Appointment of the data protection officer, where required
- Evidence of the resources allocated to the system
How to cover leadership in Kimobox
- 1Publish the privacy policy as a controlled document, with read acknowledgement.
- 2Assign an owner to every processing activity and every risk directly in the system.
- 3Prepare the management review with the period’s breaches and requests already loaded.
Read acknowledgement proves the policy has reached the people who handle the data.
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO/IEC 27701:2025 — Privacy information management systems. Requirements and guidance ISO/IEC · Second edition, October 2025
- ISO/IEC 27701:2019 — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management ISO/IEC · First edition, August 2019; withdrawn in October 2025
- Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) EUR-Lex · 27 April 2016; applicable since 25 May 2018
- ISO/IEC 27001:2022 — Information security management systems ISO/IEC · 25 October 2022