# PIMS Statement of Applicability: [Organization name]

> Statement of Applicability (SoA) for a privacy information management
> system (PIMS) under ISO/IEC 27701:2025. It records, for every control
> in the standard's control sets for PII controllers, PII processors and
> information security for PII, whether the control applies, why, its
> implementation status, its owner and its evidence, with an example
> mapping to GDPR articles. Control references are left as
> `[27701 control ref]` placeholders: fill them from your copy of the
> standard. Replace every `[bracketed]` value and every row marked
> *Example*. This is a documentation format, not legal advice.

<!--
Guidance: How to use this template
- Build the PIMS SoA after the scope and role decisions in
  `isms/pims-27701-scope-roles` (DOC-ISMS-100) and after the privacy
  risk assessment. The role per processing activity decides which
  control set is even in play: a pure processor still reviews the
  controller set and justifies each "No".
- Fill section 4 (column rules) first, then copy every control
  reference from the official ISO/IEC 27701:2025 into sections 6 to 8,
  one row per control. This template does not list the controls or
  their numbering, because the official numbering and wording are
  copyrighted and must be taken from the purchased standard.
- Main pitfall: excluding controller controls because "we are a
  processor". Most processors are controllers for staff, customer
  contacts and marketing data, so many controller controls apply.
- If an ISMS also runs, link the security rows to the ISMS SoA
  (`compliance/statement-of-applicability`, DOC-ISMS-011) and collect
  evidence once.
- Related templates: `compliance/gdpr-ropa`, `compliance/dpia`,
  `compliance/data-subject-request-procedure`,
  `compliance/personal-data-breach-assessment`,
  `isms/cloud-pii-27018-processor`, `compliance/risk-register`.
-->

## Document control

<!-- Guidance: The PIMS SoA is a controlled document and the certification body cites its version on the certificate. Every change of a control decision is a new version with a new approval. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-101 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@privacy-lead] |
| Approvers/reviewers | [@dpo], [@isms-manager], [@legal-counsel], [@ceo] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal / Confidential] |
| Standard and edition | ISO/IEC 27701:2025 |
| Next scheduled review | YYYY-MM-DD (at least every 12 months and after any scope, role or risk change) |
| PIMS scope reference | DOC-ISMS-100, PIMS scope and roles, version [x.y] |
| Roles covered | [PII controller / PII processor / both] |
| Privacy risk assessment reference | [Risk register DOC-ISMS-016, assessment dated YYYY-MM-DD] |
| ISMS SoA reference (if any) | [DOC-ISMS-011, version x.y / Not applicable] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| PIMS owner | [@privacy-lead] | [Prepared] | YYYY-MM-DD |
| Data protection officer | [@dpo] | [Reviewed] | YYYY-MM-DD |
| ISMS manager | [@isms-manager] | [Reviewed] | YYYY-MM-DD |
| Top management | [@ceo] | [Approved / Approved with changes] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | YYYY-MM-DD | [@privacy-lead] | First approved PIMS SoA for Stage 1 |
| 1.1 *(Example)* | YYYY-MM-DD | [@privacy-lead] | Controller row CTL-ROW-004 changed to Applicable after telemetry purpose was approved (RISK-044) |
| [x.y] | YYYY-MM-DD | [@author] | [Change summary] |

## Contents

<!-- Guidance: Sections 1 to 5 set the rules, sections 6 to 8 are the matrices auditors walk row by row, sections 9 to 13 keep the SoA defensible and current. -->

1. Purpose and scope
2. How the ISO/IEC 27701:2025 control sets are organized
3. Decision rules
4. Columns and values
5. Summary
6. PII controller controls
7. PII processor controls
8. Information security controls for PII
9. Justification of exclusions
10. Example mapping to GDPR articles
11. Size tiers
12. Records and evidence
13. Review and maintenance
14. References

## 1. Purpose and scope

<!-- Guidance: State which PIMS scope and which roles this SoA covers. Pitfall: an SoA that covers only the processor service while the PIMS scope includes controller activities. -->

This SoA records the decision on every control in ISO/IEC 27701:2025
for the PIMS of [Organization name] defined in DOC-ISMS-100. For each
control it gives the decision, the reason, the implementation status,
the owner and where the evidence is kept. It is used to:

- show the certification body which controls the organization claims to
  operate and why others are excluded;
- give control owners one list of what they must keep running;
- connect privacy risks, legal duties and customer commitments to
  concrete controls;
- support customer and regulator questions about privacy practice.

In-scope roles: [controller for PA-002, PA-003, PA-004, PA-005;
processor for PA-001] *(Example, activity IDs from DOC-ISMS-100)*.

## 2. How the ISO/IEC 27701:2025 control sets are organized

<!-- Guidance: Describe the control sets only at the level confirmed in your copy of the standard. Published summaries of the 2025 edition describe three control tables (controller, processor, security for PII) with matching implementation guidance and informative mapping annexes. Several summaries report 31, 18 and 29 controls (78 in total, in Annex A, with guidance in Annex B and mapping annexes after it); count them in your own copy before you rely on any number, and record the counts in section 5. -->

The 2025 edition groups its controls by the role in which PII is
processed, plus a set of information security controls that apply to
all PII processing:

| Control set | Applies when | Section of this SoA | Reference in the standard |
|---|---|---|---|
| PII controller controls | The organization decides purposes and means for at least one activity | 6 | [27701 annex ref] |
| PII processor controls | The organization processes PII on behalf of a customer or another controller | 7 | [27701 annex ref] |
| Information security controls for PII | Any PII processing in scope, whatever the role | 8 | [27701 annex ref] |

Write the official control reference in the "27701 ref" column and a
short label of your own in the "Label" column. Do not copy control
titles or control text into this document. Where the standard gives
implementation guidance for a control, read it before deciding
applicability, and record in the justification column how your
implementation meets the intent.

## 3. Decision rules

<!-- Guidance: Explain the rules once so each row can stay short. Questions to answer: who decides, on what basis, and who approves an exclusion? Pitfall: justifications like "best practice" or "required", which explain nothing. Auditors test that each Yes traces to a basis and each No to a reason. -->

A control is **applicable** when at least one basis applies to a
processing activity in scope. A control is **not applicable** only when
no basis applies, and the reason is written in section 9.

| Code | Basis | Typical source |
|---|---|---|
| R | Treats an assessed privacy or security risk | Risk register ID, for example RISK-044 |
| L | Legal or regulatory requirement | Legal register row in DOC-ISMS-014 |
| C | Contractual requirement | Customer data processing agreement, joint controller arrangement |
| B | Business decision or adopted good practice | Policy decision, management review minute |
| ROLE | Applies because of the role determined in DOC-ISMS-100 | Activity ID, for example PA-001 |

```mermaid
flowchart TD
  A["Control from the official standard"] --> B{"Is the role for this control set in scope?"}
  B -- "No" --> C["Not applicable: role not performed, cite DOC-ISMS-100"]
  B -- "Yes" --> D{"Does a risk, law, contract or decision require it?"}
  D -- "Yes" --> E["Applicable: record basis codes"]
  D -- "No" --> F["Not applicable: write a testable reason"]
  E --> G["Record status, owner and evidence"]
  C --> H["Exclusion approved by PIMS owner and DPO"]
  F --> H
  G --> I["SoA approved by top management"]
  H --> I
```

The PIMS owner proposes decisions. The DPO reviews every exclusion and
every controller decision that affects data subjects. Top management
approves the SoA as a whole.

## 4. Columns and values

<!-- Guidance: Keep the columns identical in sections 6, 7 and 8 so the rows can be filtered and counted. Pitfall: free text in the status column, which makes the summary impossible to count. -->

| Column | Content | Allowed values or format |
|---|---|---|
| Row ID | Stable ID for this SoA row | CTL-ROW-NNN (controller), PRC-ROW-NNN (processor), SEC-ROW-NNN (security) |
| 27701 ref | Official control reference from the standard | `[27701 control ref]` until filled |
| Label | Short description written by you | Up to about eight words |
| Applicable | Decision | Yes / No |
| Basis | Why it applies | R, L, C, B, ROLE (one or more) |
| Justification | Short, testable reason for the decision and how it is met | One or two sentences |
| Status | Implementation status | Implemented / Partial / Planned / Not applicable |
| Owner | Accountable control owner | [@role] |
| Evidence | Record that proves operation | Record name and location, linked in DOC-ISMS-033 |
| Links | Risks, ROPA activities, ISMS controls, external mapping | IDs |

Status meanings: **Implemented** means operating with evidence for at
least one full cycle; **Partial** means designed and partly operating,
with the remaining work in the risk treatment plan (DOC-ISMS-013);
**Planned** means approved but not yet operating, with a due date;
**Not applicable** means excluded with a reason in section 9.

## 5. Summary

<!-- Guidance: Fill the counts after the matrices are complete. Enter the number of controls per set from your copy of the standard; the totals must reconcile, or a row is missing or duplicated. -->

| Control set | Controls in the standard | Applicable | Not applicable | Implemented | Partial | Planned |
|---|---|---|---|---|---|---|
| PII controller controls | [n from the standard] | [n] | [n] | [n] | [n] | [n] |
| PII processor controls | [n from the standard] | [n] | [n] | [n] | [n] | [n] |
| Information security controls for PII | [n from the standard] | [n] | [n] | [n] | [n] | [n] |
| **Total** | [n] | [n] | [n] | [n] | [n] | [n] |

Check: for each set, Applicable plus Not applicable equals the controls
in the standard, and Implemented plus Partial plus Planned equals
Applicable.

## 6. PII controller controls

<!-- Guidance: One row per controller control in the official standard, in the standard's order. The example rows below show the expected depth for typical controller topics; replace them with the real references and labels. A processor that is also a controller for staff or marketing data will find most rows applicable. -->

| Row ID | 27701 ref | Label | Applicable | Basis | Justification | Status | Owner | Evidence | Links |
|---|---|---|---|---|---|---|---|---|---|
| CTL-ROW-001 *(Example)* | [27701 control ref] | Purposes identified and documented | Yes | L, ROLE | Each controller activity in the ROPA states its purpose | Implemented | [@privacy-lead] | ROPA controller part | PA-002 to PA-005 |
| CTL-ROW-002 *(Example)* | [27701 control ref] | Lawful basis determined per purpose | Yes | L | Basis recorded per activity and reviewed annually | Implemented | [@dpo] | ROPA lawful basis column | GDPR Art. 6 |
| CTL-ROW-003 *(Example)* | [27701 control ref] | Consent obtained and recorded where relied on | Yes | L | Marketing consent captured with timestamp and wording version | Partial | [@head-of-marketing] | Consent log export | PA-005, RISK-041 |
| CTL-ROW-004 *(Example)* | [27701 control ref] | Privacy impact assessed for high-risk processing | Yes | L, R | DPIA screening for every new purpose, full DPIA when screening says so | Implemented | [@dpo] | DPIA register, `compliance/dpia` | PA-004, RISK-044 |
| CTL-ROW-005 *(Example)* | [27701 control ref] | Information provided to data subjects | Yes | L | Public notice and staff notice approved and versioned | Implemented | [@dpo] | Notice versions | GDPR Art. 13, 14 |
| CTL-ROW-006 *(Example)* | [27701 control ref] | Rights requests handled within deadlines | Yes | L | Requests logged and answered within the legal period | Implemented | [@privacy-lead] | Request log | `compliance/data-subject-request-procedure` |
| CTL-ROW-007 *(Example)* | [27701 control ref] | Collection limited to what is needed | Yes | L, R | Form and schema reviews in design | Partial | [@head-of-product] | Privacy by design reviews | `compliance/privacy-by-design-review` |
| CTL-ROW-008 *(Example)* | [27701 control ref] | Cross-border transfers assessed and documented | Yes | L | Transfer mechanism and assessment per destination | Planned | [@legal-counsel] | Transfer assessments | `compliance/transfer-impact-assessment` |
| [CTL-ROW-NNN] | [27701 control ref] | [Label] | [Yes / No] | [Codes] | [Reason] | [Status] | [@owner] | [Record] | [IDs] |

## 7. PII processor controls

<!-- Guidance: One row per processor control in the official standard. If the organization is never a processor, mark each row Not applicable with the reason "processor role not performed (DOC-ISMS-100)" and keep the rows. For public cloud services, also complete `isms/cloud-pii-27018-processor`. -->

| Row ID | 27701 ref | Label | Applicable | Basis | Justification | Status | Owner | Evidence | Links |
|---|---|---|---|---|---|---|---|---|---|
| PRC-ROW-001 *(Example)* | [27701 control ref] | Processing agreement with each customer | Yes | C, L, ROLE | Standard DPA signed before production data is accepted | Implemented | [@legal-counsel] | Contract register | `legal-lite/dpa`, GDPR Art. 28 |
| PRC-ROW-002 *(Example)* | [27701 control ref] | Processing only on documented instructions | Yes | C, ROLE | Service terms and DPA define instructions; new uses need customer agreement | Implemented | [@cto] | DPA, change records | PA-001 |
| PRC-ROW-003 *(Example)* | [27701 control ref] | Customer assisted with rights and DPIAs | Yes | C | Support runbook for rights requests forwarded by customers | Implemented | [@head-of-support] | Ticket records | GDPR Art. 28(3) |
| PRC-ROW-004 *(Example)* | [27701 control ref] | Sub-processors disclosed and changes notified | Yes | C | Public sub-processor list, 30 days notice *(Example)* before changes | Implemented | [@legal-counsel] | Sub-processor list history | DOC-ISMS-066 |
| PRC-ROW-005 *(Example)* | [27701 control ref] | Return or deletion at end of service | Yes | C, L | Export on request, deletion within the period stated in the DPA | Partial | [@cto] | Deletion certificates | RISK-047 |
| PRC-ROW-006 *(Example)* | [27701 control ref] | Customer informed of legally binding disclosure requests | Yes | C | Requests reviewed by legal, customer told unless prohibited | Implemented | [@legal-counsel] | Disclosure request log | `isms/cloud-pii-27018-processor` |
| [PRC-ROW-NNN] | [27701 control ref] | [Label] | [Yes / No] | [Codes] | [Reason] | [Status] | [@owner] | [Record] | [IDs] |

## 8. Information security controls for PII

<!-- Guidance: One row per security control in the official standard. Where an ISMS runs, link each row to the matching ISMS SoA control and reuse its evidence; write the ISO/IEC 27001 Annex A number with your own short label. Pitfall: answering "see ISMS" without checking that the ISMS scope covers the same PII. -->

| Row ID | 27701 ref | Label | Applicable | Basis | Justification | Status | Owner | Evidence | Links |
|---|---|---|---|---|---|---|---|---|---|
| SEC-ROW-001 *(Example)* | [27701 control ref] | Access to PII restricted by role | Yes | R | Role-based access with quarterly reviews | Implemented | [@isms-manager] | Access review records | ISMS A.5.15, DOC-ISMS-041 |
| SEC-ROW-002 *(Example)* | [27701 control ref] | PII encrypted in transit and at rest | Yes | R, C | Cryptography standard applied to all PII stores | Implemented | [@cto] | Configuration evidence | ISMS A.8.24, `security/cryptography-standard` |
| SEC-ROW-003 *(Example)* | [27701 control ref] | Logging of access to PII | Yes | R | Access logs kept and reviewed | Partial | [@security-lead] | Log review records | ISMS A.8.15 |
| SEC-ROW-004 *(Example)* | [27701 control ref] | Personal data breaches managed | Yes | L, C | Incident process includes breach assessment and notification | Implemented | [@dpo] | Incident register DOC-ISMS-021 | ISMS A.5.24 to A.5.28 |
| SEC-ROW-005 *(Example)* | [27701 control ref] | Test data does not use live PII without approval | Yes | R | Masked data sets for test environments | Planned | [@head-of-engineering] | Test data approvals | ISMS A.8.33, DOC-ISMS-062 |
| [SEC-ROW-NNN] | [27701 control ref] | [Label] | [Yes / No] | [Codes] | [Reason] | [Status] | [@owner] | [Record] | [IDs] |

## 9. Justification of exclusions

<!-- Guidance: Each exclusion needs a reason an auditor can test against facts. Good: "no processing based on consent (ROPA reviewed YYYY-MM-DD)". Bad: "not relevant". Pitfall: excluding a control because it is hard to implement, which is a risk acceptance decision, not an exclusion. -->

| Row ID | Reason for exclusion | Fact that supports it | Approved by | Date | Revisit trigger |
|---|---|---|---|---|---|
| PRC-ROW-0NN *(Example, controller-only organization)* | Processor role not performed | DOC-ISMS-100 lists no processor activity | [@dpo] | YYYY-MM-DD | Any new service for customers |
| CTL-ROW-0NN *(Example)* | No processing of children's data | Terms restrict users to adults; product does not target children | [@dpo] | YYYY-MM-DD | New consumer product |
| [Row ID] | [Reason] | [Fact] | [@approver] | YYYY-MM-DD | [Trigger] |

An exclusion is not a way to accept risk. If a control applies but the
organization chooses not to implement it fully, keep it Applicable with
status Partial or Planned and record the risk acceptance in
DOC-ISMS-019.

## 10. Example mapping to GDPR articles

<!-- Guidance: This is one example mapping, useful where GDPR applies. Replace or add columns for other laws in your legal register, for example US state privacy laws or other national laws. The standard contains its own informative mapping; use it to cross-check, but write your mapping in your own words and verify each article in the official consolidated text. -->

| Privacy topic | SoA rows | GDPR articles (example) | Supporting template |
|---|---|---|---|
| Principles and accountability | CTL-ROW-001, CTL-ROW-007 | Art. 5, Art. 24 | `compliance/gdpr-ropa` |
| Lawful basis and consent | CTL-ROW-002, CTL-ROW-003 | Art. 6, Art. 7, Art. 9 | `compliance/gdpr-ropa` |
| Transparency | CTL-ROW-005 | Art. 12, Art. 13, Art. 14 | `legal-lite/privacy-policy` |
| Data subject rights | CTL-ROW-006, PRC-ROW-003 | Art. 15 to Art. 22 | `compliance/data-subject-request-procedure` |
| Privacy by design and by default | CTL-ROW-007 | Art. 25 | `compliance/privacy-by-design-review` |
| Processor contracts and instructions | PRC-ROW-001, PRC-ROW-002, PRC-ROW-004 | Art. 28, Art. 29 | `legal-lite/dpa` |
| Records of processing | CTL-ROW-001 | Art. 30 | `compliance/gdpr-ropa` |
| Security of processing | SEC-ROW-001 to SEC-ROW-005 | Art. 32 | `compliance/statement-of-applicability` |
| Breach notification | SEC-ROW-004 | Art. 33, Art. 34 | `compliance/personal-data-breach-assessment` |
| Impact assessment | CTL-ROW-004 | Art. 35, Art. 36 | `compliance/dpia` |
| International transfers | CTL-ROW-008 | Art. 44 to Art. 49 | `compliance/transfer-impact-assessment` |
| Return and deletion | PRC-ROW-005 | Art. 28(3)(g) | `data/data-retention-deletion-standard` |

A control can support several articles, and an article can need several
controls. Mapping a control to an article does not prove compliance with
that article: compliance depends on how the control is operated.

## 11. Size tiers

<!-- Guidance: Show how the SoA differs by size, using the library's working tiers. Pitfall: a small organization writing long justifications for every row when one shared reason covers a group of rows. -->

| Topic | Small: Quillmere Analytics Ltd | Medium: Quillmere Health Systems | Large: Quillmere Group |
|---|---|---|---|
| Roles covered | Processor for customer data, controller for 46 staff (38 employees, 8 contractors) and customer contacts | Processor for hospitals, controller for 320 staff and marketing data | Mainly controller across 6 sites in 4 countries, processor for some group services |
| SoA format | One spreadsheet or Markdown file, rows grouped by set | One SoA with a sheet per control set, linked to the ISMS SoA prepared for the 27001 audit | Group SoA plus site annexes listing local variations and owners |
| Typical exclusions | Few: controller set mostly applies to HR and contacts | Children's data in its own controller activities (staff and marketing), with patient data handled under the processor set *(Example)* | Rare; each site justifies local differences |
| Approval | Head of Engineering Operations (0.5 FTE ISMS manager) and CEO, external DPO reviews | ISMS manager, DPO, executive committee | CISO, group DPO, group executive with site sign-off |
| Timing | With the ISMS SoA, 6-month ISO/IEC 27001 target | In the year after the 27001 certificate (27001 target 10 months) | Phased by site after the group ISMS (27001 target 15 months) *(Example)* |

## 12. Records and evidence

<!-- Guidance: The SoA itself is evidence, but the auditor also expects the records listed in its evidence column. Link them in the control evidence matrix. -->

| Record | Proves | Owner | Location | Retention |
|---|---|---|---|---|
| Approved SoA versions | Decisions controlled and approved | [@privacy-lead] | [Document system] | Current plus [3] years *(Example)* |
| Exclusion approvals | Each exclusion reviewed by the DPO | [@dpo] | Section 9, approval records | Same as SoA |
| Evidence listed per row | Controls operate | Control owners | Linked in DOC-ISMS-033 | Per `data/data-retention-deletion-standard` |
| Risk treatment plan entries | Partial and Planned rows are tracked | [@isms-manager] | DOC-ISMS-013 | [3] years *(Example)* |
| Internal audit results on SoA rows | Rows tested independently | [@internal-auditor] | DOC-ISMS-084 | [3] years *(Example)* |

Add every evidence record to the control evidence matrix
(`isms/control-evidence-matrix`, DOC-ISMS-033), so internal audit and
the certification body can trace each row to proof.

## 13. Review and maintenance

<!-- Guidance: Name the triggers. Auditors check that a change in scope or a new risk led to a new SoA version. -->

Review the SoA at least every 12 months and when:

- the PIMS scope or a role in DOC-ISMS-100 changes;
- the privacy risk assessment adds, changes or closes a risk that a
  control treats;
- a law, regulator guidance or customer contract adds a requirement;
- an incident, audit finding or management review decision affects a
  control;
- a new edition or amendment of ISO/IEC 27701 is published.

## 14. References

<!-- Guidance: Cite only editions you checked. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27701:2025, https://www.iso.org/standard/85819.html | Second edition, 2025 | PIMS control sets and SoA requirement |
| ISO/IEC 27706:2025, https://www.iso.org/standard/82894.html | 2025 | PIMS certification bodies |
| ISO/IEC 29100:2024, https://www.iso.org/standard/85938.html | 2024 | Privacy principles |
| ISO/IEC 27001:2022 + Amd 1:2024, https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html | Current | ISMS SoA linkage |
| ISO/IEC 27018:2025, https://www.iso.org/standard/88150.html | 2025 | Public cloud PII processors |
| GDPR, Regulation (EU) 2016/679 | As amended; check the consolidated text | Example mapping in section 10 |
| Related templates | | `isms/pims-27701-scope-roles`, `compliance/statement-of-applicability`, `compliance/gdpr-ropa`, `compliance/dpia`, `compliance/data-subject-request-procedure`, `compliance/personal-data-breach-assessment`, `compliance/transfer-impact-assessment`, `isms/cloud-pii-27018-processor`, `isms/control-evidence-matrix` |

## Standard and licence note

Structure aligned with ISO/IEC 27701:2025, with links to ISO/IEC
27001:2022 + Amd 1:2024 and ISO/IEC 29100:2024. The column design,
decision rules, labels, example rows and GDPR mapping are original
text. No control text, control titles, numbering tables or guidance from
ISO/IEC standards are reproduced: control references are placeholders
that you fill from the official standard, which you need to implement
the requirements. Check the current edition of ISO/IEC 27701 and the
consolidated GDPR text before use.

Template licence: MIT.