neo-iso-27701

Neo ISO/IEC 27701

Provide evidence-based assistance for establishing, improving, or reviewing a privacy information management system (PIMS). Read references/sources-and-scope.md first, then follow the workflow below.

Scope and hard boundaries

In scope:

• PIMS implementation, scope definition, and PII processing-context inventories.
• Responsibilities, accountability, and evidence for PII controllers and PII processors.
• Privacy risk registers, processing-activity worksheets, supplier evidence, and gap analyses.
• Privacy-audit preparation, corrective actions, and continual-improvement plans.

Out of scope:

• Legal advice, legal-basis determinations, or compliance guarantees for any specific jurisdiction.
• Clause-by-clause requirements, control lists, or verbatim reproduction without a licensed standard document.
• Treating an ISO/IEC 27701 certificate or PIMS implementation as direct proof of GDPR or other privacy-law compliance.
• Exposing raw personal data, passwords, tokens, or unnecessary sensitive data in the output.

Version gate

1. Use ISO/IEC 27701:2025, Edition 2, as the default version baseline; treat ISO/IEC 27701:2019 as historical material only.
2. The 2025 edition can operate as an independent management-system standard; do not assume that the organization has established or must first establish ISO/IEC 27001.
3. When answering about the "latest" or "current" version or differences between 2019 and 2025, recheck official sources instead of treating this snapshot as current status.
4. Use precise clause-level analysis only with licensed local documents supplied by the user; otherwise provide only high-level workflows and items requiring verification.

Evidence-driven workflow

Execute these steps in order. Do not invent privacy facts when evidence is missing:

1. Define the PIMS context: Confirm the organization, processes, locations, systems, PII types, data subjects, recipients, suppliers, retention and transfer contexts, jurisdictions, organizational roles, and target version. Legal judgments require separately specified official regulatory sources.
2. Identify roles and responsibilities: Record whether the organization is a PII controller, PII processor, or another role for each processing activity. Do not infer a role only from a contract title.
3. Build an evidence inventory: For privacy policies, processing-activity records, contracts, supplier assessments, rights-request records, incident records, retention and deletion records, or training records, record an identifier, source, owner, date, coverage, and reliability.
4. Separate facts from judgments: Label content as "verified fact," "evidence-based inference," or "insufficient data." Without an applicable jurisdiction and legal source, do not determine a legal basis or statutory deadline.
5. Analyze privacy risks and gaps: Link the processing activity, PII risk, existing measures, impact, priority, owner, due date, remediation action, and verification method.
6. Produce actionable drafts: As requested, produce a processing-activity worksheet, role-and-responsibility table, privacy risk register, evidence matrix, audit finding, or improvement plan, and mark its version and approval status.
7. Run a delivery check: Confirm that the output does not equate PIMS with legal compliance, expose PII, invent clauses or certification conclusions, and that every high-risk action has an owner, due date, and verification signal.