ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 11(1) GDPR:

7.4.5 PII de-identification and deletion at the end of processing

Control

The organization should either delete PII or render it in a form which does not permit identification or re-identification of PII principals, as soon as the original PII is no longer necessary for the identified purpose(s).

Implementation guidance

The organization should have mechanisms to erase the PII when no further processing is anticipated. Alternatively, some de-identification techniques can be used as long as the resulting de-identified data cannot reasonably permit re-identification of PII principals.

ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraphs to article 11(2) GDPR:

7.3.2 Determining information for PII principals

Control

The organization should determine and document the information to be provided to PII principals regarding the processing of their PII and the timing of such a provision.

Implementation guidance

The organization should determine the legal, regulatory and/or business requirements for when information is to be provided to the PII principal (e.g. prior to processing, within a certain time from when it is requested, etc.) and for the type of information to be provided.

Depending on the requirements, the information can take the form of a notice. Examples of types of information that can be provided to PII principals are:

— information about the purpose of the processing;

— contact details for the PII controller or its representative;

— information about the lawful basis for the processing;

— information on where the PII was obtained, if not obtained directly from the PII principal;

— information about whether the provision of PII is a statutory or contractual requirement, and where
appropriate, the possible consequences of failure to provide PII;

— information on obligations to PII principals, as determined in 7.3.1, and how PII principals can benefit from them, especially regarding accessing, amending, correcting, requesting erasure, receiving a copy of their PII and objecting to the processing;

— information on how the PII principal can withdraw consent;

— information about transfers of PII;

— information about recipients or categories of recipients of PII;

— information about the period for which the PII will be retained;

— information about the use of automated decision making based on the automated processing of PII;

— information about the right to lodge a complaint and how to lodge such a complaint;

— information regarding the frequency with which information is provided (e.g. “just in time” notification, organization defined frequency, etc.).

The organization should provide updated information if the purposes for the processing of PII are changed or extended.

7.3.3 Providing information to PII principals

Control

The organization should provide PII principals with clear and easily accessible information identifying the PII controller and describing the processing of their PII.

Implementation guidance

The organization should provide the information detailed in 7.3.2 to PII principals in a timely, concise, complete, transparent, intelligible and easily accessible form, using clear and plain language, as appropriate to the target audience.

Where appropriate, the information should be given at the time of PII collection. It should also be permanently accessible.

NOTE Icons and images can be helpful to the PII principal by giving a visual overview of the intended processing.