Monitoring and measurement (9.1)
Good indicators are the ones drawn from the records: rights requests answered on time, breaches per quarter and their time to notification, processors with a contract in force, training completed.
Internal audit (9.2)
The programme covers the clauses and the applicable controls, with auditors who do not review their own work. Auditing a sample of rights requests from start to finish tells you more than reading the procedure.
Management review (9.3)
Its inputs include legal and contextual changes, audit results, indicators and breaches. Its outputs are decisions on improvement and change, and they are kept as evidence.
What an auditor usually asks for
- A privacy indicator dashboard
- An internal audit programme and reports
- Management review minutes with their decisions
- Follow-up of the resulting actions
How to cover evaluation in Kimobox
- 1Calculate indicators from the rights, breach and processor records.
- 2Plan the audit programme and log the findings in the same system.
- 3Generate the management review with the period’s data already loaded.
Indicators are not filled in by hand before the review: they come straight from the records.
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO/IEC 27701:2025 — Privacy information management systems. Requirements and guidance ISO/IEC · Second edition, October 2025
- ISO/IEC 27701:2019 — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management ISO/IEC · First edition, August 2019; withdrawn in October 2025
- Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) EUR-Lex · 27 April 2016; applicable since 25 May 2018
- ISO/IEC 27001:2022 — Information security management systems ISO/IEC · 25 October 2022