Annex A - PIMS-Specific Reference Control Objectives (Controllers)

Annex A of ISO/IEC 27701:2019 lists the privacy-specific control objectives that organizations acting as data controllers must address when extending an ISO/IEC 27001 information security management system into a Privacy Information Management System. It maps privacy requirements to the underlying ISO 27001 controls, providing a structured set of objectives for protecting personal data throughout its lifecycle.