ISO 27001 | 18.2.2 | Turvallisuuspolitiikkojen ja -standardien noudattaminen

The organization shall publish the contact details of the data protection officer (e.g. on the organisation's website) and inform the supervisory authority.

See an example process description from task's page

Connected other frameworks and requirements:

37. Designation of the data protection officer

GDPR

6.1.1: Information security roles and responsibilities

ISO 27001

18.2.2: Compliance with security policies and standards

ISO 27001

18.1.4: Privacy and protection of personally identifiable information

Following security guidelines can be monitored either technically or directly by asking / testing employees.

See an example process description from task's page

Connected other frameworks and requirements:

T11: Turvallisuuskoulutus ja -tietoisuus

29. Processing under the authority of the controller or processor

GDPR

18.2.2: Compliance with security policies and standards

ISO 27001

5.36: Compliance with policies, rules and standards for information security

ISO 27001

5.37: Documented operating procedures

ISO 27001

The ISMS should monitor the implementation of the tasks and guidelines recorded therein.

The task owner should regularly review the implementation status of the ISMS as a whole.

See an example process description from task's page

Connected other frameworks and requirements:

18.2.2: Compliance with security policies and standards

ISO 27001

5.36: Compliance with policies, rules and standards for information security

ISO 27001

4.4: Information security management system

ISO 27001

The purposes of the processing of personal data will change as the business develops. Privacy communications should stay up-to-date and reflect the actual state of processing.

We regularly make sure that all processing purposes are mentioned in communications (e.g. privacy statements), that the processing is accurately described, and that communications are provided to data subjects within the required time limits.

See an example process description from task's page

Connected other frameworks and requirements:

12. Transparent information, communication and modalities for the exercise of the rights of the data subject

GDPR

18.2.2: Compliance with security policies and standards

ISO 27001

18.1.4: Privacy and protection of personally identifiable information

A.7.3.2: Determining information for PII principals

ISO 27701

The idea behind the certification mechanisms is to demonstrate that data processing follows good data processing practices and good practices in general. Example of a security certificate is for example: ISO27001.

See an example process description from task's page

Connected other frameworks and requirements:

18.2.2: Compliance with security policies and standards

ISO 27001

Notification of the Data Protection Officer

Connected other frameworks and requirements:

Monitoring compliance with security guidelines

Connected other frameworks and requirements:

Regular internal monitoring of the implementation of the information security management system

Connected other frameworks and requirements:

Ensuring the timeliness of privacy communication

Connected other frameworks and requirements:

Data protection certifications

Connected other frameworks and requirements:

Subscribe to Academy today

Webinars

Videos

Helps

Blogs

Content library