ISO/IEC 29100 — Privacy Framework

Why does it matter?

The commercial use and value of PII is increasing, PII is shared across jurisdictions, and ICT systems are growing more complex, which can make it hard for an organization to ensure privacy and comply with the laws that apply (Introduction). ISO/IEC 29100 gives a common vocabulary, a set of roles and a set of principles, so that privacy requirements can be written, built into systems and reviewed in the same terms by lawyers, engineers and vendors.

Key benefits include:

• A common vocabulary

Clause 3 defines 24 terms, including PII, PII principal, PII controller, PII processor, privacy risk, privacy impact assessment, privacy control and sensitive PII.

• Defined roles

Clause 5.2 names four actors in the processing of PII: PII principals, PII controllers, PII processors and third parties.

• Systems designed for privacy

Its use will aid the design, implementation, operation and maintenance of ICT systems that handle and protect PII (Introduction).

• A base for other standards

It can serve as a basis for a technical reference architecture, privacy technologies, privacy controls for outsourced data processes, privacy risk assessments and engineering specifications (Introduction).

• Better privacy programs

The Introduction says use of the document will improve organizations' privacy programs through best practices.

How does it work?

Clause 5 lists the components of the framework: actors and roles, interactions, recognizing PII, privacy safeguarding requirements, privacy policies and privacy controls (5.1). A PII principal can be identified indirectly, for example through an account identifier or a combination of attributes, and is still the PII principal for that set of PII (5.2.2). A PII controller determines the purpose and means of processing and should ensure adherence to the privacy principles. A PII processor acts on behalf of a controller and observes the stipulated privacy requirements (5.2.3, 5.2.4).

Recognizing PII is treated in detail in Clause 5.4: identifiers, other distinguishing characteristics, information which is or can be linked to a PII principal, pseudonymous data, metadata, unsolicited PII and sensitive PII. Privacy safeguarding requirements come from legal and regulatory factors (5.5.2), contractual factors (5.5.3), business factors (5.5.4) and other factors (5.5.5). Privacy policies (5.6) and privacy controls (5.7) then put the requirements into practice.

Clause 6 gives the principles in order: consent and choice (6.2), purpose legitimacy and specification (6.3), collection limitation (6.4), data minimization (6.5), use, retention and disclosure limitation (6.6), accuracy and quality (6.7), openness, transparency and notice (6.8), individual participation and access (6.9), accountability (6.10), information security (6.11) and privacy compliance (6.12).

Key Elements

• Actors and roles (Clause 5.2)

PII principals, PII controllers, PII processors and third parties. A third party does not process PII on behalf of the controller and generally becomes a PII controller in its own right once it receives the PII.

• Interactions (Clause 5.3)

The interactions between the actors in the processing of PII.

• Recognizing PII (Clause 5.4)

Identifiers, other distinguishing characteristics, linkable information, pseudonymous data, metadata, unsolicited PII and sensitive PII.

• Privacy safeguarding requirements (Clause 5.5)

Legal and regulatory, contractual, business and other factors that an organization takes into account when processing PII.

• Privacy policies and controls (Clauses 5.6, 5.7)

Policies expressed by the PII controller, and controls that treat privacy risks by reducing their likelihood or consequences (Clause 3.12).

• Eleven privacy principles (Clause 6)

Consent and choice through privacy compliance, each with its own subclause 6.2 to 6.12.

• Privacy risk and impact assessment (Clause 3.18)

The process of identifying, analyzing, evaluating, consulting, communicating and planning treatment of potential privacy impacts, framed within the organization's risk management.

• Correspondence with ISO/IEC 27000 concepts (Annex A, informative)

A table showing how 29100 concepts correspond with the concepts of the ISO/IEC 27000 family.

What does it cover?

ISO/IEC 29100:2024 is applicable to natural persons and organizations involved in specifying, procuring, architecting, designing, developing, testing, maintaining, administering and operating ICT systems or services where privacy controls are required for the processing of PII (Clause 1). It covers PII within ICT systems. It is general in nature and places organizational, technical and procedural aspects in one overall privacy framework (Introduction). It has no normative references (Clause 2).

What are its objectives?

Clause 1 and the Introduction give four aims:

To specify a common privacy terminology (Clause 1).

To define the actors and their roles in processing PII (Clause 1).

To describe privacy safeguarding considerations, so organizations can define their privacy safeguarding requirements within an ICT environment (Clause 1; Introduction).

To provide references to known privacy principles for information technology (Clause 1).

Framework in Context

ISO/IEC 29100 underpins other ISO/IEC privacy standards. ISO/IEC 27701:2025 lists it as its only normative reference and maps its own controls to it in Annex C, and ISO/IEC 27018:2025 groups its extended controls in line with the 29100 privacy principles and takes its PII definitions from the 2024 edition. The Introduction is intended to enhance existing security standards by adding a focus on the processing of PII. The 2024 edition adds a normative references clause, changes "secondary use" to "secondary purpose" and updates the bibliography; ISO lists no revision project.

Common Framework Mappings

ISO/IEC 29100 is commonly mapped to the privacy laws and the privacy and security standards that build on its principles and terms, so one vocabulary can serve several programs.

Mapped frameworks include:

GDPR

ISO 27001:2022

ISO 27002:2022

ISO 27018

ISO 27701

ISO/IEC 29134

ISO/IEC 29151

NIST Privacy Framework v1.0