Privacy risk assessment (6.1.2)
Risk is measured against the people whose data are processed, not just against the company: a leak of health data weighs very differently from that of a sales directory. The method is up to you, but it must produce consistent, comparable results when repeated.
Treatment and statement of applicability (6.1.3)
Controls are chosen for each risk, checked against Annex A, and a statement of applicability records which ones apply and why the rest are excluded. A processor that never collects data from data subjects can justify excluding controls designed for the controller.
Objectives and changes (6.2 and 6.3)
Privacy objectives must be measurable —for instance, the percentage of requests answered on time— and have a plan, an owner and a date. Changes to the system are planned, not improvised.
What an auditor usually asks for
- A documented privacy risk assessment methodology
- Assessment results with an owner for each risk
- A statement of applicability with exclusions justified
- Privacy objectives with an indicator and a plan
How to cover planning in Kimobox
- 1Run the risk assessment in the risk matrix, with an owner and a treatment.
- 2Keep the statement of applicability as a controlled document linked to the risks.
- 3Measure objectives with indicators drawn from the records themselves.
The statement of applicability can be shared with the ISO 27001 one when both systems coexist.
ISO 27701 templates and records in this chapter
- ISO 27701 privacy risk assessment template · Mandatory record
- ISO 27701 statement of applicability template · Mandatory document
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO/IEC 27701:2025 — Privacy information management systems. Requirements and guidance ISO/IEC · Second edition, October 2025
- ISO/IEC 27701:2019 — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management ISO/IEC · First edition, August 2019; withdrawn in October 2025
- Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) EUR-Lex · 27 April 2016; applicable since 25 May 2018
- ISO/IEC 27001:2022 — Information security management systems ISO/IEC · 25 October 2022