Cyber Cultura course
ISO 27701: Compliance Practices and Controls
The ISO/IEC 27701:2025 PIMS, standalone or integrated with the ISMS.
Prepares students to implement a Privacy Information Management System (PIMS) according to ISO/IEC 27701:2025, meeting the privacy requirements for controllers and processors.
The 2025 edition turned 27701 into a management system standard in its own right: the PIMS can be implemented and certified without ISO/IEC 27001, or integrated with an existing ISMS. The course covers both paths.
- Workload
- 5 hours
- Format
- Online or in-company
- Investment
- On request
We’ll reply with dates, format and investment.
Who it’s for
- DPOs and privacy professionals who will implement or maintain a PIMS.
- ISMS owners who want to integrate privacy into the management system.
- Companies that process personal data as processors and need to demonstrate compliance to their customers.
What you’ll develop
- Map processing activities (ROPA) and legal bases, and carry out the DPIA.
- Govern data subject rights and privacy notices.
- Implement the Annex A controls for controllers and processors, and third-party contracts.
- Integrate privacy into the development lifecycle, logging, masking, retention and disposal.
- Measure compliance: the PIMS Statement of Applicability, LGPD and 27701 metrics, and audits.
Syllabus
5 hours
01Fundamentals of ISO/IEC 27701:2025 and the PIMS
- The PIMS as a management system in its own right, certifiable without ISO/IEC 27001, and integration with an existing ISMS
- What changed from the 2019 edition and how to transition
- Roles and responsibilities: controller and processor, DPO or Encarregado, process and data owners
- Privacy principles and how to evidence them (LGPD)
02Structure of ISO/IEC 27701:2025
- Clauses 4 to 10: PIMS requirements (context, leadership, planning, support, operation, performance evaluation and improvement)
- Annex A: PIMS reference controls for controllers, for processors, and information security controls common to both
- Annex B: implementation guidance for the controls
- Correspondence with ISO/IEC 27001 and 27002 and with privacy regulations
03Privacy governance and PIMS documents
- Corporate privacy policy, standards and procedures (document architecture)
- Privacy Committee, cadence, decision log and integration with the security committee
- Privacy risks (integration with ISO/IEC 27005 and ISO 31000) and high-risk criteria
04Record of processing activities (ROPA) and legal bases
- Minimum fields: purposes, legal bases, categories, systems, third parties, retention and measures
- LGPD legal bases and selection with evidence
- LIA (legitimate interest assessment): purpose, necessity and balancing
- Continuous updates: changes, new third parties and new purposes
05DPIA: Data Protection Impact Assessment
- Triggers: high risk, sensitive and children’s data, automated decisions, monitoring and new technologies
- Structure: necessity and proportionality, risks to data subjects, mitigations and decision
- Approval by the DPO or Committee and revalidation upon material change
06Data subject rights
- Portal and channels, identity verification, deadlines and exceptions
- Workflows by right: access, correction, deletion, portability, withdrawal of consent and review of automated decisions
- Audit trails and effectiveness metrics
07Controller: Annex A controls
- Transparency and notices, purpose and minimization, privacy by default
- Consent and preferences; cookie and SDK management
- Retention and disposal; classification and lifecycle
- International transfers: legal grounds and safeguards
- Contracts with processors: instructions, subprocessors, security, audit, deletion and return
08Processor: Annex A controls
- Processing under the controller’s instructions and record of activities
- Security and confidentiality; segregation; incident notification
- Subprocessors: approval and control; return and deletion of data at termination
- Periodic evidence to the controller: reports, tests and certifications
09Privacy in engineering and the development lifecycle
- Privacy requirements in user stories; threat modeling, including LINDDUN
- SAST, DAST, SCA and secret scanning with privacy checks
- Logs with minimization and masking; environment segregation; policy-as-code in CI/CD
- De-identification: pseudonymization, anonymization, tokenization, encryption and key management
10Third parties and the supply chain
- Due diligence by criticality: evidence, certifications, SOC 2, pentest and cloud posture
- Data processing agreement (DPA) and LGPD clauses: notification, support for rights, deletion and transfer
- Continuous monitoring, SLAs and secure offboarding, with a certificate of destruction or return
11Personal data incidents
- Classification of severity and of risk to data subjects; coordination with SecOps
- Criteria and content for notifying data subjects and the ANPD (Brazil’s data protection authority), where applicable
- Chain of custody, communication and corrective actions; updating the DPIA and the controls
12Continuity and ICT readiness for privacy
- RTO and RPO for services with personal data; failover and restore with integrity and security validation
- Immutable backups and disposal consistent with the retention policy
- Integrated tests (tabletops) with personal data scenarios
13Metrics, audits and Statement of Applicability
- KPIs and KRIs: data subject requests, evidenced legal bases, current DPIAs, processors with a DPA, and incidents
- PIMS Statement of Applicability (Annex A) and compliance matrix between the LGPD and 27701
- Internal and external audits, nonconformities and corrective actions; exceptions and privacy risk acceptance
14Simulated example and practical artifacts
What the course includes
- Simulated example
- Practical artifacts
For your team
This course is also offered in-company, on-site or remote, as a private class for your company.
Cyber Cultura course
ISO 27701: Compliance Practices and Controls
We’ll reply with dates, format and investment.
cyber@cyberconsulting.com.br