Kit de PIMS ISO/IEC 27701
Amplía el SGSI a un sistema de gestión de la privacidad: alcance y roles del PIMS, RoPA, SoA 27701, EIPD, privacidad desde el diseño, controles de encargado 27018, solicitudes de interesados, brechas y transferencias.
10 plantillas en 3 pasos, en el orden en que se usan. Abre cualquier plantilla en el editor, complétala y expórtala a PDF, DOCX o HTML.
Planteamiento
PIMS Scope and Roles Template (ISO/IEC 27701:2025)
CompletaPIMS framing for ISO/IEC 27701:2025: privacy context, role per processing activity, scope statement, policy links, ISMS relationship, certification route
ISO/IEC 27701:2025 (cited only); ISO/IEC 27706:2025; ISO/IEC 17021-1:2015; ISO/IEC 29100:2024Management System Scope Statement Template
EstándarManagement system scope (cl. 4.3): 4.1 issues incl. climate and AI role, 4.2 parties, scope sentence (QMS and ISO 42001 examples), interfaces, exclusions
ISO harmonized structure cl. 4.1 to 4.3 incl. Amd 1:2024 (ISO 9001:2026, ISO/IEC 27001:2022 + Amd 1:2024, ISO/IEC 27701:2025, ISO/IEC 42001:2023)GDPR Record of Processing Activities (ROPA) Template
CompletaGDPR Art. 30 record: controller fields (1)(a)-(g), processor fields (2)(a)-(d), lawful basis, classification, retention rule, Chapter V transfers
GDPR Art. 30; Chapter V (Art. 44-49)
Planificación
PIMS Statement of Applicability Template (ISO/IEC 27701:2025)
CompletaPIMS SoA for ISO/IEC 27701:2025: controller, processor and security control matrices, decision rules, exclusions, GDPR article mapping example
ISO/IEC 27701:2025 (cited only); GDPR as example mappingData Protection Impact Assessment (DPIA) Template
CompletaGDPR Art. 35 DPIA: WP248 screening, processing description, necessity, scored risk register, measures, DPO advice, Art. 36 prior consultation, review
GDPR Art. 35-36; WP248 rev.01 (EDPB-endorsed); EDPB DPIA template v1.0 (2026)Privacy-by-Design Review Template (GDPR Art. 25, ISO 31700-1)
CompletaScope, data inventory, consumer privacy requirements, default decisions, minimisation, user controls, notice and consent, lifecycle, third parties, evidence
GDPR Art. 25; EDPB Guidelines 4/2019 v2.0; ISO 31700-1:2023
Operación
Public Cloud PII Processor Controls Template (ISO/IEC 27018:2025)
CompletaISO/IEC 27018:2025 for cloud PII processors: customer commitments, transparency, sub-processors, deletion, disclosure requests, breach notice, control table
ISO/IEC 27018:2025 (cited only); ISO/IEC 27002:2022; ISO/IEC 29100:2024Data Subject Request Procedure Template (GDPR DSAR, CCPA)
CompletaDSAR procedure: rights by regime, intake, identity checks, search plan, GDPR and CCPA deadlines, exemptions, per-right checklists, letters, log, metrics
GDPR Arts 12-23; EDPB Guidelines 01/2022 v2.1; CCPA Civ. Code 1798.100 ff.; CCPA Regulations (eff. 2026-01-01)Personal Data Breach Assessment Template (GDPR Art. 33 and 34)
CompletaBreach triage, awareness and 72-hour clock, risk to individuals, Art. 33/34 notification decision, authority and data subject texts, breach log entry
GDPR Arts 33-34; EDPB Guidelines 9/2022 v2.0Transfer Impact Assessment (TIA) Template, GDPR Chapter V
EstándarEDPB six-step TIA for one Art. 46 transfer: transfer facts, tool, destination law, supplementary measures, procedural steps, re-evaluation, UK and US notes
EDPB Recommendations 01/2020 v2.0; SCCs (EU) 2021/914