Support, competence and documentation

Competence and awareness (7.2 and 7.3)

Training targets the roles that touch data: customer service staff who receive rights requests, HR, IT. You need to keep evidence of competence and check that awareness actually turns into behaviour.

Communication (7.4)

The organisation decides what it communicates about privacy, to whom and when, including communications with supervisory authorities and customers. A breach is no time to improvise who speaks.

Documented information (7.5)

Policies, procedures and records must be identified, reviewed, protected and available. The system’s own records often contain personal data and need their own access and retention controls.

What an auditor usually asks for

• A privacy training plan by role
• Training attendance and evaluation records
• A communication plan, including dealings with authorities
• Version and access control for PIMS documentation

How to cover support in Kimobox

1. 1Assign privacy training from the role-based training matrix.
2. 2Manage policies and procedures as controlled documents with their approver.
3. 3Restrict by profile who can see records that contain personal data.

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

1. ISO/IEC 27701:2025 — Privacy information management systems. Requirements and guidance ISO/IEC · Second edition, October 2025
2. ISO/IEC 27701:2019 — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management ISO/IEC · First edition, August 2019; withdrawn in October 2025
3. Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) EUR-Lex · 27 April 2016; applicable since 25 May 2018
4. ISO/IEC 27001:2022 — Information security management systems ISO/IEC · 25 October 2022