What is a PIMS? The privacy information management system explained

A PIMS (privacy information management system) is a fixed way of working that keeps you in control of all the personal data that passes through your organisation. It is not a software package. It is a set of processes, roles and agreements: who processes which data, for what purpose, with what protection, and how do you check that everything works? ISO 27701 sets out what a PIMS should look like. You can find the standard at ISO  and via NEN . What the standard requires is set out on requirements of ISO 27701. You can read about the relationship with the Algemene Verordening Gegevensbescherming (AVG, General Data Protection Regulation) on the page on GDPR and ISO 27701.

Want to support the processes digitally? Look at the selection guide for PIMS software, with practical scenarios for testing registers, requests and evidence recording.

On this page

What is a PIMS, exactly?

Compare a PIMS with an ISMS. An ISMS (information security management system) gives you a structure to protect information. A PIMS gives you a structure to process personal data correctly and respect the rights of data subjects.

A PIMS is not a document or system that you create once. It is a living whole that runs on the Plan-Do-Check-Act cycle. You plan what you will do, carry it out, check whether it works, and improve where needed.

A concrete example. An HR SaaS company processes salary data of employees of its clients. For its PIMS, that means:

• A processing register with all categories of salary data and the related lawful bases
• A privacy policy that describes how you process and protect data
• A procedure through which a data subject can request access or erasure
• Processor agreements with clients and sub-processors (payroll processors, accounting software)
• Privacy training for staff who have access to the data
• An internal audit to check each year that everything still works

These are not separate documents. They are connected and managed as one system.

Parts of a PIMS

The PDCA cycle in a PIMS

ISO 27701 is built on the Plan-Do-Check-Act cycle. That is what makes the difference between a system that lives and a document that stagnates.

Plan: You set objectives. You carry out a risk analysis and decide which controls to take. You record who is responsible.

Do: You implement the controls. You train staff. You put the procedures in place.

Check: You test whether it works. You carry out an internal audit. You hold a management review. Were incidents handled properly? Were data subject requests answered within the deadline?

Act: You improve. Findings from the audit are acted on. New processing is added to the register. Policy is adjusted to changed legislation.

Every year you go through this cycle. That is also why annual surveillance audits make sense: they keep the system sharp.

PIMS vs. ISMS: what is the difference?

The two systems overlap. Good security is also good for privacy. But they are not the same. You can secure data perfectly and still breach privacy law, for example by collecting data without a lawful basis. Conversely, you can have a careful privacy procedure and secure the data poorly.

Already have an ISMS? Then you build the PIMS on top of it. You add the privacy-specific parts: the processing register, the privacy risk analysis and the controls for your role. Read how that works on ISO 27701 vs. ISO 27001.

How a PIMS connects to the GDPR

The GDPR requires you to process personal data lawfully, transparently and for a specified purpose. It also requires you to be able to demonstrate that you do so (the accountability obligation). That is exactly where a PIMS helps.

That makes ISO 27701 valuable for organisations that want to structure their GDPR practice and make it demonstrable. But it is not a legal GDPR certificate. Read why on GDPR and ISO 27701.

Next steps

Sources

• ISO/IEC 27701 at ISO : International Organization for Standardization
• NEN, information security and privacy : Netherlands Standardisation Institute (NEN)