BSI announces global certification scheme to futureproof privacy information management

BSI has launched a global certification scheme to help organizations establish, implement and maintain a Privacy Information Management System (PIMS).

Accenture plc, Alibaba Cloud Computing Ltd., Alibaba.com Singapore E-Commerce Private Limited., Beijing Microlive Vision Technology Co., Ltd, Blackhawk Network Inc., Huawei Software Technologies Co., Ltd HUAWEI MOBILE SERVICES, HUAWEI CLOUD, Lotte Duty Free, PwC Mauritius, and Ribose Group Inc are the first organizations to achieve this certification with BSI.

Organizations are facing a dual-challenge - to collect and process an increasing volume of data, whilst ensuring compliance to the new and growing list of privacy regulation and new legislation being developed across the globe. This new scheme, is based on BS ISO/IEC 27701:2019 Security techniques — Extension to ISO/IEC 27001. The standard, which was published in August, provides organizations with guidance on the operational controls to support the response to new privacy requirements such as the EU General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA) and Brazil Lei Geral de Proteção de Dados Pessoais (LGPD). The standard is an extension to an ISO IEC 27001 Information Security Management System (ISMS).

To achieve certification to the standard, organizations undergo an independent assessment including a rigorous on-site audit covering all the requirements of BS ISO/IEC 27701. An organization complying with the requirements of the standard will generate documentary evidence of how it handles the processing of Personally Identifiable Information (PII). Such evidence can be used to facilitate agreements with business partners where the processing of PII is mutually relevant. In order to achieve certification, organizations must be certified to ISO/IEC 27001.

Ahmad Alkhatib, Assurance Business Development Director at BSI comments, “In order to remain resilient, organizations must protect the personal data that they gather, store, access and use. This is becoming increasingly challenging given the growing volume of data that organizations have to manage and the new data privacy legislation that is increasing around the globe. By achieving certification to this new standard, organizations can demonstrate that they are taking a proactive approach to data protection, helping to build trust and transparency with their stakeholders. We’re delighted to present certification to these organizations as part of our global early adopters programme, which is a huge achievement.”

Organizations have been presented with their certificates at the BSI drinks reception as part of the IAPP Data Protection Congress 2019 in Brussels.