Operational planning and control (8.1)
The criteria set during planning are applied day to day: a new processing activity goes through its assessment before it starts, and a new supplier receives no data without a contract. Outsourced processes are controlled as well.
Ongoing risk assessment and treatment (8.2 and 8.3)
The assessment is repeated at planned intervals and whenever there are significant changes: a new application, a transfer to another country, a merger. The results of every assessment and every treatment plan must be kept.
Where Annex A comes in
In practice, operation is where the controls live: the record of processing, impact assessments, handling of rights, contracts with processors. They are explained in the chapter devoted to Annex A.
What an auditor usually asks for
- A procedure for onboarding new processing activities with prior assessment
- Dated risk assessment results
- Treatment plans with their implementation status
- Control of external processes and suppliers
How to cover operation in Kimobox
- 1Set up the onboarding of a processing activity as a workflow with assessment and approval.
- 2Schedule the periodic risk review with due-date alerts.
- 3Oversee processors from the supplier portal.
No new processing activity starts until the workflow has taken it through its assessment.
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO/IEC 27701:2025 — Privacy information management systems. Requirements and guidance ISO/IEC · Second edition, October 2025
- ISO/IEC 27701:2019 — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management ISO/IEC · First edition, August 2019; withdrawn in October 2025
- Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) EUR-Lex · 27 April 2016; applicable since 25 May 2018
- ISO/IEC 27001:2022 — Information security management systems ISO/IEC · 25 October 2022