New Privacy / PII Risk Entry
Assess the privacy risk. Score = Likelihood × Impact. High/Critical privacy risks may require a DPIA (Art. 35 UK GDPR) and enhanced privacy controls. Special category data should be assessed conservatively.
Data Subject Rights — UK GDPR Articles 15–22 / ISO/IEC 27701 Cl. 7.3.6
ISO/IEC 27701 Clause 7.3.6 requires controllers to have processes to handle the exercise of PII principals' (data subjects') rights. Failures are a common source of ICO enforcement action. Processes must be documented, tested and staff must be trained to recognise and route requests.
Right of Access (SAR) — Art. 15
Respond within 1 month (extendable by 2 months for complex requests). Provide all personal data held + supplementary information. Risk: SARs may reveal other compliance gaps — process must be tested.
Right to Erasure — Art. 17
Erase data when no longer necessary, consent withdrawn, or objection made. Map all locations where data is held. Complex for backup systems. Legal holds may override. Third parties who received data must also be notified.
Right to Rectification — Art. 16
Correct inaccurate data and complete incomplete data. Must communicate correction to third parties who received the data. Requires data quality processes and data mapping to identify all stores of PII.
Right to Portability — Art. 20
Provide PII in a structured, commonly used, machine-readable format. Applies only to processing based on consent or contract. Must be able to transmit directly to another controller where technically feasible.
Right to Object — Art. 21
Object to processing based on legitimate interests or public task. Absolute right to object to direct marketing at any time — processing must cease immediately. Honour opt-outs promptly and propagate to all systems.
Automated Decisions — Art. 22
Right not to be subject to solely automated decisions with legal or similarly significant effects. Requires human review option, meaningful information about the logic, and ability to contest. AI Act may add further requirements.
Lawful Basis for Processing — Art. 6 UK GDPR / ISO/IEC 27701 Cl. 7.2.3
Every processing activity must have a documented lawful basis under Article 6 (and where special category data is involved, an additional condition under Article 9). Failure to document and rely on an appropriate basis is itself a breach of the data protection principles.
Consent — Art. 6(1)(a)
Must be freely given, specific, informed and unambiguous. Cannot be bundled or pre-ticked. Must be as easy to withdraw as to give. Not appropriate where significant imbalance of power (employer/employee). Record consent with timestamp and version of privacy notice shown.
Contract — Art. 6(1)(b)
Processing necessary for performance of a contract with the data subject, or to take pre-contractual steps at their request. Must be strictly necessary — cannot process additional data beyond what is needed for the contract. Common for customer and employment data.
Legal Obligation — Art. 6(1)(c)
Processing required to comply with a legal obligation under UK or EU law. Must document the specific legal requirement (e.g. statutory reporting obligations, health & safety, employment law). Cannot be used for optional regulatory requirements.
Vital Interests — Art. 6(1)(d)
Protect the life of the data subject or another person. Very narrow basis — limited to emergency situations. Cannot be relied upon for routine processing. Where consent could have been obtained in advance, consent should be the basis.
Public Task — Art. 6(1)(e)
Processing necessary for a task in the public interest or in the exercise of official authority. Primarily for public authorities and organisations exercising statutory functions. Private sector organisations rarely rely on this basis.
Legitimate Interests — Art. 6(1)(f)
Most flexible basis — requires a three-part LIA (Legitimate Interests Assessment): (1) identify a legitimate interest; (2) necessity test — is processing necessary?; (3) balancing test — do data subject interests override? Document the LIA. Not available for public authorities processing in performance of official tasks.
ISO/IEC 27701:2025 — Structure & Key Clause Guidance
ISO/IEC 27701 extends ISO/IEC 27001 and ISO/IEC 27002 by adding requirements for a Privacy Information Management System (PIMS). It provides a framework for managing PII and maps directly to GDPR obligations, making it a powerful tool for demonstrating compliance.
PII Controller Requirements (Cl. 7)
Organisations that determine the purposes and means of processing PII. Obligations: lawful basis, transparency (privacy notice), data subject rights, processor management, DPIA, privacy by design, records of processing.
PII Processor Requirements (Cl. 8)
Organisations that process PII on behalf of a controller. Obligations: act only on documented instructions, use only authorised sub-processors, assist controller with DSRs, security of processing, assist with breach notification, deletion/return on termination.
Privacy by Design (Cl. 7.5)
Data protection must be embedded into systems and processes from the outset, not bolted on. Key principles: data minimisation, purpose limitation, pseudonymisation where possible, encryption, least privilege access, privacy-preserving defaults.
Records of Processing (RoPA) (Cl. 7.2.8)
Mandatory for most organisations under Art. 30 UK GDPR. Must record: controller/DPO details, purposes, categories of data subjects and PII, recipients, transfers, retention periods, security measures.
1–4: Low — standard controls 5–9: Medium — enhanced controls 10–16: High — consider DPIA 17–25: Critical — DPIA required / immediate action