Key takeaways
- Meet privacy laws and protect personal data.
- Privacy laws place specific duties on how you handle personal data.
- Start here: identify the privacy laws that apply to you.
Purpose
Meet privacy laws and protect personal data.
Requirement
Requirement summaryThe organization shall identify and meet the requirements regarding the preservation of privacy and protection of PII according to applicable laws and regulations and contractual requirements.
Why it matters
Privacy laws place specific duties on how you handle personal data. Security is a large part of meeting them.
How to implement
- Identify the privacy laws that apply to you.
- Map where personal data is held and processed.
- Implement required safeguards and assign a privacy lead.
- Handle data subject requests and breaches within legal timelines.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.34. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your privacy policy covering how you protect personal data.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.34 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Your list of personal data processing activities, kept up to date.
- Privacy risk assessments for higher-risk uses of personal data.
- Records of requests from individuals (for example access or deletion) answered on time.
Things you should be able to show or explain
- Your privacy lead should be able to explain how privacy rules are met.
How much to show: Three to five processing activities and any requests.
Common mistakes
- Processing list out of date.
- No assessment for new risky processing.
- Treating privacy as a legal-only topic disconnected from security.
- No data map, so requests cannot be answered.
- Tip: Align with your GDPR/privacy programme rather than duplicating it.
Policies & documents to have
- Legal, regulatory and contractual requirements register
FAQ
Is A.5.34 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.34?
Be ready to explain how the control works in your organisation and to provide things like: Your privacy policy covering how you protect personal data…