# ISO 27701 PIMS Gap Assessment Template

## Organization Information

| Field | Value |
|-------|-------|
| Organization Name | [Organization Name] |
| Assessment Date | [YYYY-MM-DD] |
| Assessor(s) | [Names and Roles] |
| Organization Role | [ ] PII Controller  [ ] PII Processor  [ ] Both |
| ISO 27001 Status | [ ] Certified (Cert #: ___) [ ] Implemented (not certified) |
| ISMS Scope | [Description of ISMS scope] |
| PIMS Scope | [Description of intended PIMS scope] |
| Certification Body | [If applicable] |

## Clause 5 Assessment: PIMS-Specific Requirements

### 5.2.1 Understanding the Organization and its Context

| Assessment Item | Status | Notes |
|----------------|--------|-------|
| External privacy issues identified (regulations, court decisions) | [ ] FI [ ] PI [ ] NI | |
| Internal privacy issues identified (governance, processing decisions) | [ ] FI [ ] PI [ ] NI | |
| Controller/processor role determination documented | [ ] FI [ ] PI [ ] NI | |

**Current State**: [Description]
**Gap**: [Description]
**Remediation**: [Action items]

### 5.2.2 Understanding Needs and Expectations of Interested Parties

| Assessment Item | Status | Notes |
|----------------|--------|-------|
| PII principals identified as interested parties | [ ] FI [ ] PI [ ] NI | |
| Supervisory authorities identified | [ ] FI [ ] PI [ ] NI | |
| Customer privacy expectations documented | [ ] FI [ ] PI [ ] NI | |
| Employee privacy expectations documented | [ ] FI [ ] PI [ ] NI | |

**Current State**: [Description]
**Gap**: [Description]
**Remediation**: [Action items]

### 5.2.3 PIMS Scope

| Assessment Item | Status | Notes |
|----------------|--------|-------|
| PIMS scope defines processing types | [ ] FI [ ] PI [ ] NI | |
| Controller/processor roles per activity | [ ] FI [ ] PI [ ] NI | |
| Categories of PII and PII principals defined | [ ] FI [ ] PI [ ] NI | |
| Organizational units in scope identified | [ ] FI [ ] PI [ ] NI | |

**Current State**: [Description]
**Gap**: [Description]
**Remediation**: [Action items]

### 5.4.1.2 Privacy Risk Assessment

| Assessment Item | Status | Notes |
|----------------|--------|-------|
| Risk assessment addresses risks to PII principals | [ ] FI [ ] PI [ ] NI | |
| Privacy-specific threats identified | [ ] FI [ ] PI [ ] NI | |
| Impact assessed from PII principal perspective | [ ] FI [ ] PI [ ] NI | |
| Privacy risk register maintained | [ ] FI [ ] PI [ ] NI | |

**Current State**: [Description]
**Gap**: [Description]
**Remediation**: [Action items]

### 5.4.1.3 Privacy Risk Treatment

| Assessment Item | Status | Notes |
|----------------|--------|-------|
| SoA includes Annex A controls (if controller) | [ ] FI [ ] PI [ ] NI | |
| SoA includes Annex B controls (if processor) | [ ] FI [ ] PI [ ] NI | |
| Justification for control inclusion/exclusion | [ ] FI [ ] PI [ ] NI | |

**Current State**: [Description]
**Gap**: [Description]
**Remediation**: [Action items]

## Annex A Control Assessment (PII Controllers)

*Complete this section if the organization acts as a PII controller.*

### A.7.2 — Conditions for Collection and Processing

| Control ID | Control Title | Status | Current State | Gap | Remediation | Owner | Target Date |
|-----------|--------------|--------|--------------|-----|-------------|-------|-------------|
| A.7.2.1 | Identify and document purpose | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.2.2 | Identify lawful basis | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.2.3 | Determine when/how consent obtained | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.2.4 | Obtain and record consent | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.2.5 | Privacy impact assessment | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.2.6 | Contracts with PII processors | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.2.7 | Joint PII controller | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.2.8 | Records related to processing PII | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |

### A.7.3 — Obligations to PII Principals

| Control ID | Control Title | Status | Current State | Gap | Remediation | Owner | Target Date |
|-----------|--------------|--------|--------------|-----|-------------|-------|-------------|
| A.7.3.1 | Obligations to PII principals | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.3.2 | Determining information for PII principals | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.3.3 | Providing information to PII principals | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.3.4 | Mechanism to modify/withdraw consent | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.3.5 | Mechanism to object to processing | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.3.6 | Access, correction and/or erasure | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.3.7 | Obligations to inform third parties | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.3.8 | Providing copy of PII processed | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.3.9 | Handling requests | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.3.10 | Automated decision making | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |

### A.7.4 — Privacy by Design and Default

| Control ID | Control Title | Status | Current State | Gap | Remediation | Owner | Target Date |
|-----------|--------------|--------|--------------|-----|-------------|-------|-------------|
| A.7.4.1 | Limit collection | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.4.2 | Limit processing | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.4.3 | Accuracy and quality | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.4.4 | PII minimization objectives | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.4.5 | De-identification and deletion | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.4.6 | Temporary files | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.4.7 | Retention | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.4.8 | Disposal | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.4.9 | PII transmission controls | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |

### A.7.5 — PII Sharing, Transfer, and Disclosure

| Control ID | Control Title | Status | Current State | Gap | Remediation | Owner | Target Date |
|-----------|--------------|--------|--------------|-----|-------------|-------|-------------|
| A.7.5.1 | Basis for transfer between jurisdictions | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.5.2 | Countries/orgs for transfer | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.5.3 | Records of disclosure to third parties | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |
| A.7.5.4 | Notification of disclosure requests | [ ] FI [ ] PI [ ] NI [ ] NA | | | | | |

## Summary

### Gap Assessment Summary

| Category | Fully Implemented | Partially Implemented | Not Implemented | Not Applicable |
|----------|------------------|-----------------------|-----------------|----------------|
| Clause 5 | | | | |
| Annex A (Controller) | | | | |
| Annex B (Processor) | | | | |
| Clause 6 | | | | |
| **Total** | | | | |

### Implementation Rate

**Overall Implementation Rate**: ____%

### Remediation Roadmap Summary

| Phase | Timeline | Key Actions | Owner |
|-------|----------|-------------|-------|
| Phase 1: Critical Gaps | Months 1-3 | | |
| Phase 2: High Priority | Months 3-6 | | |
| Phase 3: Medium Priority | Months 6-9 | | |
| Phase 4: Pre-Certification | Months 9-12 | | |

### Approval

| Role | Name | Signature | Date |
|------|------|-----------|------|
| DPO/CPO | | | |
| CISO | | | |
| Senior Management | | | |

---
*Legend: FI = Fully Implemented, PI = Partially Implemented, NI = Not Implemented, NA = Not Applicable*