ISO/IEC 27701:2025, your own certification as a processor

Where relevant, the contract to process personal data must address the organization's role in assisting the customer with the customer's own obligations, taking account of the nature of processing and the information available to it, covering as relevant privacy by design and by default, achieving security of processing, notifying breaches to a supervisory authority and to customers and individuals, conducting privacy impact assessments, and assuring assistance where prior consultation with a protection authority is needed, with some jurisdictions also requiring the contract to state the subject matter and duration of processing, its nature and purpose, the type of data and the categories of individuals.

The organization must provide the ability to return, transfer or dispose of personal data securely and must make its policy available to the customer, managing the capability securely whether the outcome is return to the customer, transfer to another organization or controller, deletion, destruction, de-identification or archiving, providing the assurance the customer needs that data processed under the contract is erased by the organization and its subcontractors from wherever it is stored including backup and business continuity copies as soon as it is no longer necessary for the customer's identified purposes, and covering in the policy the retention period before disposal after contract termination so the customer is protected from losing data through an accidental lapse.

The organization must inform the customer in a timely manner of the basis for transfers of personal data between jurisdictions and of any intended changes, so the customer can object or terminate, documenting compliance with the legislation and regulation that applies depending on origin and destination, informing the customer of transfers to suppliers, other parties and other countries or international organizations, giving advance notice of changes within an agreed timeframe, setting the limits of any contractual allowance to make changes without informing the customer, and identifying the instruments relied on for international transfer together with the countries involved and the circumstances in which they apply.

The organization must disclose to the customer any use of subcontractors to process personal data before that use, with provisions included in the customer contract, disclosing that subcontracting is used and the names of the relevant subcontractors, the countries and international organizations to which they can transfer data, and the means by which they are obliged to meet or exceed the organization's own obligations, and where public disclosure of subcontractor information would increase security risk beyond acceptable limits, making the disclosure under a non disclosure agreement or on request while making the customer aware the information is available, the list of countries always being disclosed so the customer can inform the individuals concerned.

The organization must engage a subcontractor to process personal data only according to the customer contract, obtaining written authorization from the customer before the subcontractor processes the data, whether through appropriate clauses in the customer contract or a specific one off agreement, holding a written contract with every such subcontractor that addresses implementation of the appropriate processor controls, requiring the subcontractor to implement them in light of the risk assessment and the scope of processing, with all such controls assumed relevant by default and any exclusion justified, responsibilities being allocable differently provided every control is considered and documented.

Where it holds a general written authorization, the organization must inform the customer of any intended change involving the addition or replacement of a subcontractor that processes personal data, giving the customer the opportunity to object, and where it changes the subcontractor carrying out some or all of the processing, written authorization from the customer is required before the new subcontractor processes the data, whether through appropriate clauses in the customer contract or a specific one off agreement.

Agreements with suppliers shall specify whether PII is processed and the minimum technical and organizational measures the supplier must meet for the organization to meet its information security and PII protection obligations, shall clearly allocate responsibilities between the organization, its partners, suppliers and applicable third parties taking account of the type of PII processed, shall provide a mechanism for ensuring the organization supports and manages compliance with applicable legislation and regulation, and shall call for independently audited compliance acceptable to the customer. When the organization is a PII processor, its contracts with suppliers shall specify that PII is processed only on its instructions.

For a PII controller, an incident that involves PII shall trigger a review to determine whether a breach involving PII requiring a response has occurred, an event alone not necessarily triggering it; when a breach has occurred the response shall include the relevant notifications and records, jurisdictions defining when the supervisory authority and PII principals must be notified, and a record with sufficient information for regulatory or forensic reporting shall be kept covering the incident, the period, the consequences, the reporter, to whom it was reported, the resolution steps and data recovered, whether it caused unavailability, loss, disclosure or alteration of PII, the PII compromised, and the notifications made. For a PII processor, the contract with the customer shall cover breach notification, how the organization will provide the information the customer needs to notify authorities, the exclusion of breaches caused by the customer or PII principal or within components they are responsible for, and the expected and externally mandated limits on notification response times; some jurisdictions require the processor to notify the controller without undue delay and some require direct notification of a regulatory authority.

Individuals operating under the organization's control with access to PII shall be subject to a confidentiality obligation, the agreement, whether part of a contract or separate, specifying the length of time the obligation lasts; when the organization is a PII processor, the confidentiality agreement in whatever form between the organization, its employees and its agents shall ensure they comply with the policy and procedures on data handling and protection.