Our own servers in Europe · GDPR · Support in your language
English
Let's talk

Module 1 of 9 · ISO 27701 · Clause 4

Context and scope of the PIMS

The privacy system starts by knowing which personal data are processed, in what capacity —controller, processor or both— and under which laws and contracts.

Content reviewed on

Context and interested parties (4.1 and 4.2)

On top of the usual factors, the standard asks you to consider applicable privacy legislation, the decisions of supervisory authorities and contractual commitments with customers that set conditions on the data. Data subjects themselves —customers, employees, patients— are interested parties too, not just the regulators.

Your role in each processing activity

The same company is often the controller for its own staff payroll and the processor for the data its customers entrust to it. That distinction decides which Annex A controls apply and must be settled before risks are assessed.

Scope of the system (4.3)

The scope sets out the processing activities, sites, systems and processes included, along with their interfaces with third parties. A scope that leaves out precisely the riskiest processing undermines the credibility of the certificate.

What an auditor usually asks for

  • An inventory of processing activities with the organisation’s role in each
  • A list of laws, authority decisions and contracts affecting the data
  • Interested parties with their privacy expectations
  • A documented PIMS scope statement

How to cover context in Kimobox

  1. 1Document the context of the privacy system as one more versioned record.
  2. 2Register interested parties and their requirements in a table with an annual review.
  3. 3Start from the record of processing activities to define the scope.

The scope rests on the record of processing activities, not on a separate list that quietly goes out of date.

How Kimobox handles data and the GDPR

ISO 27701 templates and records in this chapter

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

  1. ISO/IEC 27701:2025 — Privacy information management systems. Requirements and guidance ISO/IEC · Second edition, October 2025
  2. ISO/IEC 27701:2019 — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management ISO/IEC · First edition, August 2019; withdrawn in October 2025
  3. Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) EUR-Lex · 27 April 2016; applicable since 25 May 2018
  4. ISO/IEC 27001:2022 — Information security management systems ISO/IEC · 25 October 2022
Next → Leadership and privacy policy