ISO 27701 PIMS Audit Checklist and Records

A working kit for auditing and running a privacy information management system (PIMS) to ISO/IEC 27701. The checklist follows the PIMS from scope and leadership through privacy risk, the statement of applicability, controller and processor duties, rights requests, breaches and improvement, so every finding can be traced to a requirement. The records document gives you the registers an auditor asks to see first.

What is inside

ISO 27701 PIMS Internal Audit Checklist — 82 checks across the PIMS, each written as a statement you can find evidence for, with Yes / No / N/A boxes and space for the evidence you saw.

PIMS Records Templates — scope and roles register, record of processing activities, privacy impact assessment screening and register, data subject request log, personal data breach log, processor and third-party register, and a PIMS statement of applicability extract.

Both documents as a designed, print-ready PDF and as an editable Word file.

Who it is for

Privacy officers and data protection officers, information security managers extending an ISO/IEC 27001 system to privacy, internal auditors, and consultants preparing an organisation for an ISO/IEC 27701 certification or surveillance audit.

How to use it

Audit by processing activity, not by clause: pick one activity from the record of processing, follow the personal data from collection to deletion, and use the checklist to make sure no requirement is missed along the way. Decide first whether the organisation acts as a PII controller, a PII processor or both for that activity, because different sections of the checklist apply. Record evidence for every check, and for each No write a nonconformity that states the requirement, the evidence and why it does not conform.

ISO/IEC 27701 has been revised since its 2019 edition. Check which edition applies to you and which edition your certification body audits against. Nothing in this kit is legal advice: check the privacy and data-protection laws that apply to your organisation.