ISO 27001 · Annex A controls · 2 min read

ISO 27001 A.5.34: personal data protection, explained for startups

What A.5.34 asks of a small company, and what an auditor samples.

Protect the personal data you hold in line with privacy laws and expectations. Handle people’s information responsibly across its whole life cycle.

Why it exists: to handle personal information the way privacy law and its customer commitments require.

A.5.34 Privacy and protection of PII

Personally identifiable information (PII) is handled the way privacy laws and your customer promises require. What proves it: a record of the personal data you process, the agreements that cover it, and how you answer privacy requests.

A certification auditor samples records of processing, data processing agreements and the request log. A file that usually does the job: a record of processing activities, signed data processing agreements, and a log of access and deletion requests.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.5.34 walks you through it in this order.

List the personal data you hold, why you hold it and where it lives.
Sign data processing agreements with customers and suppliers.
Set up a way to receive and answer access and deletion requests, and log each one.

The free ISO 27001 readiness assessment asks one question that evidences it:

Do you keep a register of the laws, regulations and contract terms that set security requirements for you?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Legal, Regulatory and Contractual Compliance Policy covers A.5.34. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criteria that cover this ground: C1.1, confidential data handling and CC6.7, data in transit.

Organizational controls

A.5.34 is one of the 37 organizational controls in Annex A. How the company runs security: policies, roles, suppliers, incidents, continuity and legal duties. Most of these are written decisions and the records that show you follow them.

Nearby controls in the same theme:

Before it: A.5.33, protecting records. After it: A.5.35, independent security review. Every control, by theme, is on the Annex A controls page.

Questions

What does ISO 27001 A.5.34 require?

Protect the personal data you hold in line with privacy laws and expectations. Handle people’s information responsibly across its whole life cycle.

What evidence does an auditor want for A.5.34?

A record of the personal data you process, the agreements that cover it, and how you answer privacy requests. A certification auditor samples records of processing, data processing agreements and the request log.

Get ready for ISO 27001 certification.

The readiness assessment is free, with no payment and no card. ISO 27001 is part of Constellation, at $10,800 a year: everything in Orbit plus the management system, the policies, the evidence and the management review for ISO 27001, and your SOC 2 Type 2 audit is included in every contract year. You contract the certification body directly.

The internal audit is priced separately: Polara arranges it with an independent internal auditor from our partner network who works in the platform, and quotes it for your company.

Take the free assessment

Polara Labs is not a certification body. Certification audits are performed by independent accredited certification bodies.