ISO 27001 Control 5.34: Privacy and Protection of PII

Most organizations collect personally identifiable information across dozens of systems — HR platforms, CRMs, marketing tools, vendor portals — yet few have the structured controls to protect it consistently. When that gap goes unaddressed, the result isn’t hypothetical: regulatory investigations, breach notification costs, and the kind of reputational damage that no incident response plan can reverse. ISO 27001 control 5.34 exists to close that gap.

What 5.34 Requires

ISO 27001 Annex A control 5.34 requires organizations to identify all applicable privacy legislation and implement specific technical and organizational measures to protect personally identifiable information throughout its lifecycle. It sits within Domain 5 (Organizational Controls) of ISO/IEC 27001:2022 and addresses the full scope of PII handling — from collection through disposal.

In practical terms, the control demands six things. First, you must identify every privacy law, regulation, and contractual obligation that applies to the PII your organization processes. Second, you need a topic-specific PII protection policy — separate from your general information security policy — that defines classification rules, handling procedures, retention periods, and disposal requirements. Third, a responsible person (typically a Data Protection Officer or privacy officer) must be formally appointed with clear authority and accountability.

On the technical side, 5.34 requires encryption, access controls, and data masking for PII-containing systems. Operationally, you must establish documented procedures for every stage of the PII lifecycle: collection, processing, storage, transfer, and destruction. Finally, every person who handles PII — not just IT staff — must receive training on their specific responsibilities. For a broader view of how these controls fit within the standard, see ISO 27001 compliance.

Why 5.34 Matters

Consider an organization that collects customer PII across its sales platform, HR system, and third-party analytics tools. Each system has its own access policies, retention settings, and data flows — none coordinated under a single privacy framework. When a misconfigured API exposes customer records for three months before detection, the organization faces not just a breach notification obligation but a regulatory investigation that reveals it never mapped its PII processing activities, never appointed a privacy owner, and has no documented legal basis for half the data it collects.

This is the scenario 5.34 is designed to prevent. The financial stakes are significant: IBM Security reports that the global average cost of a data breach reached $4.44 million in 2025, with breaches involving personal information carrying the highest per-record cost. Beyond direct costs, organizations face General Data Protection Regulation fines up to 4% of global annual turnover, CCPA penalties of $7,500 per intentional violation, and sector-specific enforcement under HIPAA, LGPD, and POPIA.

The operational impact compounds the financial exposure. Breach investigations consume executive attention for months. Customer churn accelerates when trust erodes. And certification bodies can suspend or withdraw ISO 27001 certification if a nonconformity against 5.34 is identified during surveillance audits. If you’re building your understanding of the standard from the ground up, ISO 27001 explained covers the key concepts and benefits.

What attackers exploit

PII-related breaches rarely stem from sophisticated attacks. They exploit gaps that 5.34 specifically addresses:

• Absent or outdated PII inventory — the organization doesn’t know what PII it holds, where it resides, or who has access
• No topic-specific privacy policy — a general security policy exists but doesn’t address PII handling, classification, or retention
• Lack of assigned privacy ownership — no DPO or privacy officer means no one monitors compliance or escalates issues
• PII stored without encryption or access restrictions — databases and file shares containing personal data are accessible to broad user groups
• No data minimization — systems collect and retain more PII than the stated processing purpose requires
• Third-party processors without contractual safeguards — vendors handle PII with no data processing agreement, breach notification SLA, or audit rights. Verizon’s 2025 DBIR found that third-party involvement in breaches doubled year-over-year to 30% of all confirmed incidents.
• Missing breach notification procedures — when an incident occurs, the organization has no documented process for regulatory reporting within required timeframes

These are not theoretical risks. They are the most common audit findings when organizations pursue ISO 27001 certification and the most frequent root causes in PII breach investigations. Organizations managing GDPR obligations across their vendor ecosystem can find additional guidance in GDPR compliance strategies.

How to Implement 5.34

Implementation splits into two domains: controls within your organization and assurance requirements for your vendors. Both must be addressed — auditors evaluate your PII protection across the full processing chain.

For your organization

1. Build a PII register. Create a Record of Processing Activities (ROPA) that lists every category of PII you process, the purpose and legal basis for processing, where the data resides, who has access, retention periods, and cross-border transfer details. This register is the foundation every other control builds on.

2. Identify applicable privacy legislation. Map your processing activities against GDPR, CCPA, HIPAA, LGPD, POPIA, and any sector-specific or contractual obligations. Maintain a legal register that connects each obligation to specific organizational controls.

3. Draft a topic-specific PII policy. This must be separate from your general information security policy. Cover PII classification rules, handling procedures for each lifecycle stage, retention schedules, secure disposal methods, and cross-border transfer safeguards. Generic policy templates that don’t reflect your actual processing activities will not pass an audit.

4. Appoint a privacy officer or DPO. Formalize the role with a documented appointment letter, defined responsibilities, reporting lines, and authority to escalate issues. This person must have visibility into all PII processing activities.

5. Implement technical controls. Deploy encryption at rest and in transit for PII-containing systems. Configure role-based access control so users access only the PII their role requires. Apply data masking and pseudonymization in non-production environments.

6. Conduct Data Protection Impact Assessments (DPIAs). For any high-risk processing activity — large-scale profiling, new system deployments handling PII, cross-border transfers — complete a DPIA before processing begins. Document risk treatment decisions and residual risk acceptance.

7. Train all personnel who handle PII. Training must be role-specific, not a generic awareness module. Staff who process PII daily need practical guidance on classification, handling, and incident reporting. Maintain records of completion, dates, and assessment results.

8. Establish retention schedules and secure disposal. Define how long each PII category is retained, the legal or business justification, and the disposal method. Disposal must be verified — not just scheduled — for both digital and physical records.

Common mistakes that auditors flag repeatedly: treating PII protection as an IT-only concern, copying generic policy templates without tailoring them to actual processing, failing to update the PII register when new systems launch, ignoring SaaS applications and shadow IT, and overlooking cross-border transfer requirements when data moves between jurisdictions.

ISO/IEC 27701 and ISO 29100 provide complementary frameworks. ISO 27701 extends ISO 27001 with a privacy information management system (PIMS), while ISO 29100 defines a privacy framework with principles that map directly to 5.34’s requirements. For additional context on how these implementation controls align with ISO 27002 guidance, see ISO 27002 practices.

For your vendors (third-party assessment)

Every vendor that processes PII on your behalf must demonstrate controls equivalent to your own. A structured third-party risk management program is essential. Start your assessment with these questions:

• Do you maintain a Record of Processing Activities?
• What is your lawful basis for processing PII on our behalf?
• Do you have a designated DPO or privacy officer?
• What encryption standards protect PII at rest and in transit?
• What is your breach notification SLA?

Evidence to request: Data Processing Agreement (DPA) with defined processing scope, PII handling procedures, encryption standards documentation, breach notification process and SLAs, recent audit reports (SOC 2 Type II or ISO 27701 certification), and sub-processor disclosures.

Red flags that warrant escalation: No DPA in place, inability to specify data residency locations, no documented breach notification process, refusal to share audit reports or grant right-to-audit clauses, and undisclosed sub-processors.

Verification steps: Request and exercise right-to-audit clauses. Check for ISO 27701 certification or SOC 2 Type II reports with privacy criteria coverage. Validate that sub-processor disclosures are current and complete. For a step-by-step approach, see how to conduct a third-party risk assessment. Tools like UpGuard’s vendor risk platform can automate evidence collection and continuous monitoring across your vendor portfolio.

Audit Evidence for 5.34

When auditors assess 5.34 compliance, they evaluate documented policies, technical implementations, and operational evidence that PII protection is active — not just planned. Prepare these artifacts before your audit:

Cross-Framework Mapping

Control 5.34 does not exist in isolation. If your organization operates under multiple compliance frameworks, understanding where 5.34 overlaps with other standards reduces duplicate effort and strengthens your overall privacy posture. Organizations managing GDPR third-party requirements alongside ISO 27001 will find significant overlap in the privacy criteria below.

The NIST 800-53 mappings provide full coverage because both frameworks require a documented privacy program, specific PII handling procedures, and purpose limitation controls. SOC 2 and NIST CSF overlap partially — they address access controls and data security but lack the prescriptive PII lifecycle requirements that 5.34 and NIST 800-53 mandate.

Related ISO 27001 Controls

Control 5.34 connects to several other Annex A controls. Understanding these relationships helps you build an integrated compliance program rather than addressing each control in isolation.

Frequently Asked Questions

What is ISO 27001 5.34?

ISO 27001 Annex A control 5.34 requires organizations to identify applicable privacy laws and implement specific technical and organizational measures to protect personally identifiable information. It is part of Domain 5 (Organizational Controls) in ISO/IEC 27001:2022.

What happens if 5.34 is not implemented?

Without 5.34 controls, organizations face regulatory fines, audit nonconformities that can prevent ISO 27001 certification, and increased exposure to data breaches involving personal information. Certification bodies can suspend existing certifications if a major nonconformity is identified.

How do you audit 5.34?

Auditors verify the existence of a PII-specific policy, a legal register of privacy obligations, a Record of Processing Activities, DPO appointment documentation, technical control evidence (encryption, access controls), and training records. They also confirm the organization understands its lawful basis for processing each category of PII.

How UpGuard Helps

UpGuard’s platform provides continuous monitoring of PII-related compliance across your organization and third-party vendors. It surfaces privacy control gaps, tracks vendor security postures against frameworks including ISO 27001, and generates audit-ready evidence that maps directly to controls like 5.34. Explore the UpGuard platform.