ISO 27001 A.5.34: Privacy and Protection of PII

Quick Reference: A.5.34 in 60 Seconds

What the Standard Actually Requires

ISO/IEC 27001:2022 A.5.34 Control Text

ISO 27001:2022 Annex A 5.34 asks organizations to identify and meet the requirements for protecting personally identifiable information (PII), in line with applicable laws and regulations.

This single sentence places a broad, principle-based obligation on the organization. It does not prescribe a specific law or methodology. Instead, it requires the organization to:

1. Identify all applicable privacy and PII protection requirements (statutory, regulatory, contractual).
2. Implement controls, processes, and organizational measures that satisfy those requirements.
3. Maintain those measures over time and demonstrate that PII is protected.

ISO/IEC 27002:2022 Implementation Guidance

ISO 27002 expands A.5.34 into practical implementation guidance. The key themes include:

"Shall" vs "Should" Analysis

What Auditors Actually Check

Why This Control Matters

The Business Risk Narrative

Personal data is among the most valuable and sensitive assets a B2B technology company handles. It fuels customer onboarding, payment processing, identity verification, support, analytics, and AI training. But every collection point is also a potential liability. A single misconfigured S3 bucket, an over-broad data-sharing clause, or a delayed breach notification can convert a growth story into a regulatory, legal, and reputational crisis.

For Indian organizations and global companies serving Indian data principals, A.5.34 is no longer a "nice-to-have" compliance add-on. It is a board-level control that directly intersects with revenue, customer trust, investor diligence, and regulatory survival.

Indian Regulatory Context

India has moved from a patchwork of sectoral privacy rules to a complete data protection law and tightened sectoral guidance.

Consequences of Non-Compliance

impact of Non-Compliance, By the Numbers

• IBM's 2024 impact of a Data Breach Report placed the global average breach overhead at USD 4.88 million; breaches involving personally identifiable information consistently rank among the highest-impact categories because of notification, legal, and regulatory response overhead.
• Indian organizations report that regulatory scrutiny and customer due diligence are now the top two drivers for privacy spending, ahead of pure security risk.
• A single DPDP Act penalty at the upper limit can exceed the annual privacy budget of many growing Indian SaaS companies, making proactive compliance a financial imperative.

Why B2B Tech Companies Are Especially Exposed

B2B tech firms often process PII at scale on behalf of customers (as processors) while also collecting employee, website visitor, and lead data (as controllers/fiduciaries). This dual role creates overlapping obligations:

• Controller/Fiduciary obligations: Notice, consent, data principal rights, breach notification.
• Processor obligations: Security, sub-processor governance, return/deletion of data, assistance with DSARs and breach response.
• Enterprise customer obligations: Contractual DPAs, audit rights, data localization, SOC 2 Type II privacy criteria, and GDPR Article 28 addenda.

A.5.34 is the ISO 27001 control that forces the organization to harmonize all of these obligations into a single, auditable operating model.

Scope and Applicability

What This Control Covers

A.5.34 applies to the entire lifecycle of personally identifiable information (PII), including:

• Collection and capture (web forms, mobile apps, APIs, integrations, offline channels)
• Storage and processing (databases, data lakes, CRM, HR systems, SaaS tools)
• Use and sharing (analytics, marketing, support, AI/ML, third-party processors)
• Retention and archival (backup systems, logs, long-term archives)
• Disposal and deletion (secure erasure, decommissioning, data subject deletion requests)

Who It Applies To

Size-Based Applicability

In-Scope Systems and Channels

Key Definitions and Terminology

Relationship to Other Controls

Detailed Implementation Guidance

Figure · Tiers

Maturity levels for privacy and protection of pii

This section provides a practical, step-by-step implementation path for A.5.34. The steps are designed for Indian B2B technology companies but can be adapted to any sector or size.

Establish Privacy Governance

Privacy cannot be a side project. It needs clear ownership, authority, and resources.

Under the DPDP Act 2023, certain Data Fiduciaries (and all Significant Data Fiduciaries) must appoint a DPO based in India. Even if not legally required, ISO 27001 auditors expect a named privacy owner.

Build a PII Inventory and Data-Flow Map

A PII inventory is the foundation of every privacy program. Without it, notices are incomplete, DSARs are guesswork, and breach response is slow.

Step-by-step data-mapping process:

1. Identify data collection points: Web forms, mobile screens, API endpoints, onboarding flows, support channels, marketing landing pages, HR portals, and IoT devices.
2. Catalog PII categories: Contact data, identity documents, financial data, health data, biometrics, location, behavioral data, employment data, and inferred data.
3. Map systems and owners: For each PII category, document the system of record, data owner, engineering owner, and business owner.
4. Trace data flows: Draw flows from collection → processing → storage → sharing → retention → deletion. Include internal systems, third-party integrations, and cross-border transfers.
5. Document lawful basis: Under DPDP Act, document whether processing relies on consent or a legitimate use (e.g., employment, legal obligation). For GDPR-facing data, document Article 6 basis.
6. Define retention periods: Align retention to legal requirements, business need, and contractual obligations. Avoid "indefinite."
7. Classify sensitivity: Public, Internal, Confidential, Restricted. Apply corresponding security controls.

Sample PII inventory columns:

Map Applicable Privacy Requirements

Organizations operating in India often face overlapping obligations. A requirements register prevents gaps.

Update the register whenever a new product, market, customer segment, or regulation emerges.

Publish Privacy Notices and Manage Consent

Privacy notice essentials:

• Identity and contact details of the Data Fiduciary (and DPO)
• Categories of personal data collected
• Purposes of processing
• Legal basis / legitimate use
• Recipients or categories of recipients, including processors
• Cross-border transfers and safeguards
• Retention periods or criteria
• Data principal rights and how to exercise them
• Grievance officer / complaint mechanism
• Cookie and tracking disclosures
• Date of last update

Consent management best practices:

• Use granular consent options (not bundled terms).
• Record timestamp, version of notice, mechanism of consent, and scope.
• Make withdrawal as easy as giving consent.
• Re-obtain consent if the purpose changes materially.
• Do not rely on consent when a statutory or employment legitimate use applies.

Operationalize Data Subject Rights (DSARs)

The DPDP Act 2023 grants data principals rights to access, correction and erasure, grievance redressal, and nomination. Build a workflow:

For GDPR, the response SLA is 30 days (extendable). For DPDP Act, timelines will be specified in rules; until then, align with customer contracts and internal SLA.

Conduct Data Protection Impact Assessments (DPIAs)

A DPIA is mandatory for high-risk processing. In India, Significant Data Fiduciaries will be required to conduct DPIAs. Even before rules are finalized, DPIAs are audit expectations for A.5.34.

DPIA stages:

1. Describe the processing purpose and data flows.
2. Assess necessity and proportionality.
3. Identify risks to data principals (unauthorized access, discrimination, identity theft, reputational harm).
4. Evaluate existing controls.
5. Identify residual risks and mitigation actions.
6. Obtain sign-off from DPO and business owner.
7. Monitor and re-assess on material change.

Trigger DPIAs for: large-scale biometric processing, employee monitoring, automated decision-making, children's platforms, health/financial data integration, and new cross-border data flows.

Apply Privacy by Design and Default

Implement Data Minimization and Purpose Limitation

• Review forms and API schemas to remove non-essential fields.
• Disable collection of unused data fields.
• Define and enforce allowed purposes in code and database access policies.
• Use field-level encryption or tokenization for sensitive identifiers.
• Delete or anonymize data when the original purpose is fulfilled.

Manage Retention and Secure Deletion

When a deletion request is received, delete from production, backups (or schedule deletion at end of backup lifecycle), caches, logs where feasible, and third-party integrations.

Govern Processors and Sub-processors

For each processor that handles PII:

• Execute a Data Processing Agreement (DPA) with security, confidentiality, breach notification, sub-processor, audit, and return/deletion clauses.
• Maintain a processor register with location, data categories, and security certifications.
• Conduct risk-based due diligence before onboarding.
• Review annually or on material change.
• Require notification of new sub-processors with right to object.
• Verify SOC 2, ISO 27001, or equivalent assurance.

Manage Cross-Border Data Transfers

Under the DPDP Act 2023, personal data may be transferred to countries notified by the Central Government. Until notifications are issued, organizations should:

• Map all cross-border data flows.
• Assess whether the destination jurisdiction provides adequate protection.
• Use contractual clauses (SCCs) and technical safeguards (encryption, pseudonymization).
• Document transfer impact assessments.
• Watch for sectoral localization requirements (e.g., RBI payment data localization).

Apply Security Safeguards to PII

Detect, Respond to, and Report Breaches

A PII breach response playbook must address both security containment and regulatory notification.

Train and Raise Awareness

Monitor, Audit, and Continuously Improve

• Schedule quarterly privacy self-assessments against the legal requirements register.
• Include privacy controls in the internal audit program.
• Track KPIs (see Section 12) and report to the Privacy Steering Committee.
• Update policies, notices, and consents when laws or processing change.
• Conduct tabletop exercises for breach response and DSAR surge scenarios.

Tools, Technologies, and Solutions

The privacy technology market has matured significantly. Indian organizations can choose between global enterprise suites, Indian compliance platforms, and cloud-native security tools. The right mix depends on data volume, regulatory complexity, and integration needs.

Selection Criteria

Policy and Procedure Templates

The following templates are designed to be adapted to your organization. They are intentionally detailed because A.5.34 requires both policy direction and operational procedure.

PII Protection and Privacy Policy

PERSONAL DATA / PII PROTECTION AND PRIVACY POLICY
[Organization Name]
Version: 1.0
Effective Date: [Date]
Review Date: [Date + 12 months]
Classification: Internal
Owner: Data Protection Officer
Approved by: [CEO / Managing Director]

1. PURPOSE
This policy establishes the principles, roles, and controls for the protection
of personally identifiable information (PII) and personal data processed by
[Organization Name] in compliance with ISO 27001:2022 A.5.34, the Digital
Personal Data Protection Act 2023, the IT Act 2000, and other applicable laws.

2. SCOPE
This policy applies to all employees, contractors, consultants, suppliers,
and third parties who process PII on behalf of [Organization Name]. It covers
all systems, applications, databases, physical records, and communication
channels used to collect, store, process, transmit, or destroy PII.

3. POLICY STATEMENTS

3.1 Lawfulness and Fairness
   • PII shall be processed lawfully, fairly, and transparently.
   • A valid lawful basis or legitimate use shall be documented before processing.

3.2 Data Minimization
   • Only PII necessary for the specified purpose shall be collected.
   • Unnecessary fields in forms and APIs shall be disabled or removed.

3.3 Purpose Limitation
   • PII shall not be used for purposes incompatible with the original notice.
   • New purposes require legal review and, where required, renewed consent.

3.4 Accuracy
   • PII shall be kept accurate and up to date.
   • Data principals may request correction of inaccurate PII.

3.5 Storage Limitation
   • PII shall be retained only as long as required by law, contract, or
     documented business need.
   • Secure deletion shall occur at the end of the retention period or upon
     valid deletion request.

3.6 Integrity and Confidentiality
   • PII shall be protected by appropriate technical and organizational
     security measures, including encryption, access control, monitoring,
     and secure disposal.

3.7 Accountability
   • [Organization Name] maintains records of processing activities,
     privacy impact assessments, and compliance evidence.
   • The DPO is accountable for privacy governance and regulatory liaison.

4. ROLES AND RESPONSIBILITIES

4.1 Board / Top Management
   • Approve privacy policy and strategy.
   • Provide resources for privacy compliance.

4.2 Data Protection Officer (DPO)
   • Maintain the privacy program, legal register, and PII inventory.
   • Oversee DSAR, breach, and DPIA processes.
   • Report privacy risk to top management.

4.3 System / Data Owners
   • Ensure PII in their systems is classified, protected, and disposed of correctly.
   • Respond to DSAR and breach requests within SLA.

4.4 All Employees
   • Handle PII only as authorized.
   • Report suspected breaches immediately.
   • Complete privacy awareness training.

5. CONSENT AND NOTICE
   • Privacy notices shall be published for all data collection points.
   • Consent shall be freely given, specific, informed, and unambiguous.
   • Consent records shall include timestamp, scope, mechanism, and version.

6. DATA SUBJECT RIGHTS
   • Requests shall be logged, identity-verified, and fulfilled within the
     documented SLA.
   • Responses shall be secure and, where required, redacted to protect
     others' privacy.

7. THIRD-PARTY PROCESSORS
   • Processors shall be assessed and governed by written data processing
     agreements.
   • Sub-processors require prior notification and, where contractually
     required, approval.

8. BREACH RESPONSE
   • Suspected PII breaches shall be escalated to the DPO and CISO immediately.
   • Notifications to regulators and affected principals shall be made within
     statutory timeframes.

9. TRAINING AND AWARENESS
   • All personnel shall receive privacy training at onboarding and annually.
   • Role-specific training shall be provided for engineering, support, HR,
     sales, and marketing.

10. POLICY REVIEW
    This policy is reviewed annually and whenever significant legal, technical,
    or organizational changes occur.

APPROVED BY:
[Name, Title]                    Date:
[Name, Title]                    Date:

Privacy Notice Template

PRIVACY NOTICE — [Organization Name]
Last Updated: [Date]

1. WHO WE ARE
[Organization Name] is the Data Fiduciary responsible for your personal data.
Contact: [DPO email and postal address].

2. WHAT DATA WE COLLECT
We may collect: name, email, phone, company name, job title, IP address,
cookie identifiers, payment information, identity documents (where required
by law), support transcripts, and usage data.

3. HOW WE USE YOUR DATA
• To provide our products and services
• To process transactions and send invoices
• To communicate updates, security alerts, and marketing (where consented)
• To comply with legal and regulatory obligations
• To improve our products and detect fraud or abuse

4. LEGAL BASIS / LEGITIMATE USE
We process data based on your consent, contractual necessity, legal obligation,
or legitimate business interests, as permitted under applicable law.

5. WHO WE SHARE DATA WITH
• Service providers (hosting, payment, analytics, support)
• Regulators and law enforcement when legally required
• Affiliates and business partners (only with appropriate safeguards)

6. INTERNATIONAL TRANSFERS
Your data may be transferred to countries outside India. We use contractual
safeguards and encryption to protect such transfers.

7. YOUR RIGHTS
You may request access, correction, erasure, restriction, or portability of
your personal data, and withdraw consent where applicable. Contact us at
[dpo@company.com].

8. RETENTION
We retain personal data for as long as necessary to fulfill the purposes
outlined above and to comply with legal obligations.

9. SECURITY
We use encryption, access controls, and monitoring to protect your data.

10. CHANGES TO THIS NOTICE
We may update this notice. The latest version will be posted on our website
with the effective date.

DSAR Handling Procedure

DATA SUBJECT ACCESS REQUEST (DSAR) PROCEDURE
Version: 1.0 | Owner: DPO

1. INTAKE
   • Accept requests via privacy portal, email, or in writing.
   • Record date, channel, requester identity evidence, and request type.

2. VERIFICATION
   • Verify identity using account credentials, OTP, or government-issued ID.
   • For third-party agents, verify authorization (e.g., power of attorney).

3. SCOPING
   • Confirm requested right: access, correction, erasure, restriction,
     portability, objection, or complaint.
   • Identify systems and time range involved.

4. DATA COLLECTION
   • System owners extract relevant PII.
   • Exclude data that reveals other individuals' PII or is legally privileged.

5. REDACTION AND REVIEW
   • Redact third-party PII and confidential business information.
   • DPO reviews completeness and legal exceptions.

6. RESPONSE
   • Provide response via secure channel (encrypted email or portal download).
   • Include explanation of rights and grievance mechanism.

7. CLOSURE AND RECORDING
   • Close ticket; retain audit record.
   • Track SLA and reasons for any extension.

EXCEPTIONS
   • Requests may be refused where manifestly unfounded, excessive, or
     prohibited by law. Document rationale.

Risk Assessment and Treatment

The following risk scenarios are specific to PII processing and A.5.34. Use your organization's likelihood and impact scales.

Residual risk target: All "High" risks treated to Medium or Low within 90 days; Medium risks accepted with documented rationale and monitoring.

Audit and Compliance Checklist

Use this checklist to prepare for internal audits, certification audits, and regulator inspections. Each item includes expected evidence and common red flags.

Metrics and KPIs

Privacy programs must be measurable. The following KPIs support A.5.34 and management review.

Common Pitfalls / Audit Failures & How to Avoid Them

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: Indian Fintech NBFC, From Regulatory Warning to Audit-Ready Privacy Program

Background: A Bengaluru-based NBFC offering personal loans and credit-line products processed PAN, Aadhaar (voluntarily collected for KYC), bank statements, employment details, and device data from over 2 million customers. The company had grown rapidly and relied on a generic privacy policy, manual DSAR responses via email, and ad-hoc processor contracts.

Challenge: Following an RBI thematic review, the NBFC received observations on:

• Lack of a data classification and PII inventory.
• Customer consent not demonstrably recorded for data sharing with analytics partners.
• No documented process for honoring deletion requests.
• Cross-border analytics flows to a US-based BI tool without transfer safeguards.

Solution: The NBFC engaged Singahi to implement an ISO 27001-aligned privacy program under A.5.34.

1. Governance: Appointed a full-time DPO reporting to the board; established a Privacy Steering Committee with Legal, Compliance, IT, Product, and Operations.
2. Inventory: Conducted a 4-week data-mapping sprint across mobile app, website, CRM, loan management system, document vault, and BI tools. Tagged all PII fields and assigned system owners.
3. Legal mapping: Built a requirements register covering DPDP Act 2023, RBI master direction, IT Act, SPDI Rules, and GDPR for NRI customers.
4. Consent and notices: Re-designed app onboarding with granular consent screens, consent logging to an immutable store, and an updated privacy notice in plain English, Hindi, and Tamil.
5. DSAR automation: Implemented a privacy portal integrated with the loan management system, reducing manual data extraction from 6 hours to 30 minutes per request.
6. Processor governance: Standardized DPA clauses; renegotiated contracts with 14 processors; created a sub-processor register with objection rights.
7. Cross-border transfers: Replaced US BI tool with an India-region instance for customer PII; executed Standard Contractual Clauses for analytics pseudonymized data.
8. Security: Enabled field-level encryption for Aadhaar/PAN, implemented DLP on document exports, and restricted support agents' access via dynamic masking.

Results:

• Cleared RBI observations within 90 days.
• Achieved ISO 27001:2022 certification in the next audit cycle with zero major nonconformities related to A.5.34.
• Reduced DSAR response time from 21 days to 4 days.
• Customer complaints related to data usage dropped by 62%.
• Won two large enterprise partnerships that previously stalled due to privacy due diligence.

Illustrative Scenario 2: Indian EdTech Scale-Up, Building Privacy by Design into a Global Product

Background: A Hyderabad-based EdTech company served K–12 students, college learners, and working professionals. Its platform collected names, emails, phone numbers, academic records, payment details, video recordings of classes, and behavioral analytics. The company planned expansion into the EU and Middle East and needed a privacy framework that satisfied multiple jurisdictions.

Challenge:

• Children's data was processed without age-verification or parental consent workflows.
• Recorded classes and chat logs were retained indefinitely.
• Marketing and admissions teams shared lead lists via spreadsheets and WhatsApp.
• No DSAR process existed; support agents manually searched multiple tools.
• The product roadmap had no privacy review gate.

Solution: The company implemented a privacy-by-design program aligned with A.5.34.

1. Role and governance: Hired a DPO and formed a cross-functional Privacy Council that met bi-weekly.
2. PII inventory: Mapped data across the LMS, video platform, CRM, payment gateway, marketing automation, and mobile app. Identified that recorded class videos contained minors' images and voices.
3. Children's data protection: Implemented age-gating, parental consent via email/OTP, and restricted profiling of users under 18. Added watermarks and download restrictions on recorded content.
4. Data minimization: Removed unnecessary fields from lead forms; stopped collection of permanent address unless required for certification delivery.
5. Retention and deletion: Automated deletion of recorded classes after 180 days unless downloaded by the student; implemented a soft-delete + cryptographic erasure workflow for account closure.
6. DSAR portal: Built a self-service portal where learners could request access, correction, and deletion. Integration with CRM, LMS, and video platform reduced manual effort by 80%.
7. Marketing controls: Replaced spreadsheet sharing with a CRM workflow; enforced consent tags and unsubscribe links; deployed a cookie consent manager.
8. Engineering integration: Added a "privacy review" ticket type in Jira; every new feature required sign-off from the DPO before release.
9. Training: Launched role-based privacy training for engineering, support, sales, and content teams, with quarterly refreshers.

Results:

• Launched successfully in the EU with GDPR compliance and in the GCC region with localized notices.
• Reduced PII-bearing systems from 34 to 21 by decommissioning shadow IT and consolidating marketing tools.
• DSAR volume surged to 300+ per month but was handled within 5 business days on average.
• Passed a customer-led SOC 2 Type II audit with privacy criteria and an ISO 27001 surveillance audit with no findings in A.5.34.
• Avoided an estimated in potential regulatory exposure from children's data and retention issues.

Multi-Framework Mapping

A.5.34 does not exist in isolation. Mapping it to other frameworks helps organizations use one set of controls for multiple audits and customer questionnaires.

Implementation Roadmap

The following 8-week roadmap is suitable for a growing Indian B2B tech company. Adjust the pace based on size, complexity, and regulatory pressure.

Post-Implementation Sustainment

FAQ

Q1: Is A.5.34 only about GDPR?
No. A.5.34 requires compliance with all applicable privacy and PII protection requirements. For Indian organizations, that includes the DPDP Act 2023, IT Act 2000 + SPDI Rules, CERT-In directions, RBI/SEBI/IRDAI rules, and contractual DPAs. GDPR applies only if you process EU residents' personal data.

Q2: Do all Indian companies need a DPO?
The DPDP Act 2023 currently requires a DPO for Significant Data Fiduciaries and may require one for other categories as rules are notified. Even without a legal mandate, ISO 27001 auditors expect a named privacy owner for A.5.34.

Q3: What is the difference between PII and personal data?
PII is the ISO 27001 terminology. Personal data is the term used in the DPDP Act 2023 and GDPR. They overlap heavily. Personal data is generally interpreted more broadly to include online identifiers and inferred data.

Q4: Can we rely on a single global privacy notice for India and other countries?
You can have a single notice if it accurately covers all jurisdictions, but it is often clearer to have a base notice with jurisdiction-specific sections (e.g., DPDP Act rights for India, GDPR rights for the EU). Avoid using only GDPR language for Indian users.

Q5: How do we handle DSARs when PII is spread across many SaaS tools?
Maintain a PII inventory that maps each PII category to the systems containing it. Use a DSAR workflow that assigns extraction tasks to system owners. For high-volume requests, consider a privacy tool with automated connectors.

Q6: What counts as a PII breach that must be reported?
A breach is any unauthorized access, disclosure, alteration, or destruction of PII. Reporting obligations depend on the law: CERT-In Directions require reporting certain incidents within 6 hours; the DPDP Act will require reporting to the Data Protection Board and, in some cases, data principals.

Q7: Do we need consent for every processing activity?
No. The DPDP Act 2023 allows processing under "legitimate uses" such as employment, legal claims, or state functions, in addition to consent. Document your lawful basis for each activity rather than defaulting to consent.

Q8: How does A.5.34 relate to SOC 2 privacy criteria?
SOC 2 privacy criteria (P1.1–P7.1) cover notice, choice and consent, collection, use, retention, disposal, access, disclosure, quality, monitoring, and enforcement. A.5.34 plus the supporting controls in this guide directly satisfy those criteria.

Q9: What is the quickest way to show A.5.34 compliance to an auditor?
Present: (1) privacy policy and legal register, (2) PII inventory and data flows, (3) privacy notice and consent records, (4) DSAR procedure and closed tickets, (5) processor DPAs and register, (6) breach response playbook, and (7) training records.

Q10: Should children's data be treated differently?
Yes. The DPDP Act 2023 provides enhanced protections for children (persons under 18). You must obtain verifiable parental consent, avoid tracking, behavioral monitoring, or targeted advertising directed at children, and conduct a DPIA for such processing.

Q11: How do we balance privacy with security monitoring and logging?
Security logs are essential, but they should not retain unnecessary PII. Mask or truncate identifiers where possible, limit log access to authorized personnel, define retention periods, and conduct a proportionality assessment before deploying employee monitoring tools. Document the business necessity and alternative measures considered.

Q12: What should a privacy clause in an enterprise customer DPA include?
Key clauses include: processing instructions, permitted sub-processors and objection rights, security measures, DSAR assistance, breach notification timelines, audit rights, data localization or transfer safeguards, return/deletion obligations, and liability/indemnity. Align the clause with both ISO 27001 A.5.34 and the DPDP Act 2023.

Q13: Is pseudonymized data still considered PII?
Yes, in most cases. Pseudonymization reduces risk but does not make data anonymous because it can be re-identified with additional information. Continue to protect pseudonymized data as PII, and treat anonymized data as outside scope only after a rigorous irreversibility assessment.

Q14: How do we handle employee monitoring under privacy law?
Employee monitoring must be necessary, proportionate, and transparent. Inform employees through clear policies, limit monitoring to business purposes, avoid covert surveillance except in defined investigations, and consult the DPO and Legal before deploying BYOD, CCTV, keystroke, or productivity-monitoring tools.

Q15: What are Privacy Enhancing Technologies (PETs), and when should we use them?
PETs include differential privacy, federated learning, homomorphic encryption, secure multi-party computation, and synthetic data. Use them when you need to derive value from data while minimizing PII exposure, particularly in analytics, AI/ML, and cross-organizational research scenarios.

References and Further Reading

Standards

• ISO/IEC 27001:2022, Annex A, Control 5.34, Privacy and protection of PII.
• ISO/IEC 27002:2022, Section 5.34, Implementation guidance for privacy and protection of PII.
• ISO/IEC 27701:2019, Privacy Information Management System (PIMS), Requirements and guidelines.
• ISO/IEC 29100:2011, Privacy framework.
• ISO/IEC 29134:2023, Privacy impact assessment.

Indian Laws and Regulations

• Digital Personal Data Protection Act, 2023 (India).
• Information Technology Act, 2000 and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
• CERT-In Directions, 2022 (Indian Computer Emergency Response Team).
• Reserve Bank of India, Master Direction on Information Technology Framework for the NBFC Sector.
• Securities and Exchange Board of India, Cybersecurity and Cyber Resilience Framework for Stock Exchanges, Clearing Corporations, and Depositories; circulars for intermediaries.
• Insurance Regulatory and Development Authority of India, Guidelines on Information and Cyber Security for insurers.

International Frameworks

• General Data Protection Regulation (EU) 2016/679.
• NIST SP 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations.
• NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0.
• CIS Controls Version 8.
• COBIT 2019 Framework.
• AICPA Trust Services Criteria (SOC 2).
• PCI DSS v4.0.

Industry Reports and Resources

• IBM Security, impact of a Data Breach Report 2024.
• OECD Privacy Framework.
• Data Protection Board of India (notifications and guidance as issued).
• Singahi ISO 27001 Implementation Guides for related Annex A controls.

End of guide.