# ISO 31700 Standards and References

## Primary Standard

### ISO 31700-1:2023
Consumer protection — Privacy by design for consumer goods and services — Part 1: High-level requirements. Published February 2023. Contains 30 requirements across design (16), production (8), and disposal (6) phases. First international standard specifically dedicated to privacy by design.

### ISO 31700-2:2023
Consumer protection — Privacy by design for consumer goods and services — Part 2: Use cases. Provides practical examples of applying Part 1 requirements across e-commerce, IoT, mobile applications, cloud services, and other consumer product categories.

## Related ISO Standards

### ISO/IEC 27701:2019
Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management. Provides a certifiable framework for privacy management systems. Complementary to ISO 31700: 27701 focuses on organizational management systems; 31700 focuses on product/service design.

### ISO/IEC 27001:2022
Information security management systems — Requirements. Foundation for security controls that support ISO 31700 Requirement 8 (PII security).

### ISO/IEC 29100:2011
Privacy framework. Defines 11 privacy principles that align with ISO 31700 requirements: consent and choice, purpose legitimacy and specification, collection limitation, data minimization, use/retention/disclosure limitation, accuracy and quality, openness/transparency/notice, individual participation and access, accountability, information security, and privacy compliance.

### ISO/IEC 29134:2023
Guidelines for privacy impact assessment. Supports ISO 31700 Requirement 11 (privacy risk assessment) with a structured PIA methodology.

## GDPR Alignment

### Article 25(1) — Data Protection by Design
ISO 31700 directly operationalizes Article 25(1) by providing 30 specific, auditable requirements. Organizations achieving ISO 31700 certification can point to it as evidence of implementing "appropriate technical and organisational measures" under Article 25(1).

### Article 42 — Certification
GDPR Article 42 encourages the establishment of certification mechanisms for demonstrating compliance. ISO 31700 certification can serve as evidence of compliance with Article 25, though GDPR does not mandate any specific certification.

### Article 43 — Certification Bodies
Certification bodies issuing ISO 31700 certificates should be accredited per ISO/IEC 17065 (requirements for bodies certifying products, processes, and services).

## Ann Cavoukian's Privacy by Design Principles

ISO 31700 traces its conceptual lineage to Ann Cavoukian's seven foundational principles of Privacy by Design (2009):

1. Proactive not reactive; preventative not remedial
2. Privacy as the default setting
3. Privacy embedded into design
4. Full functionality — positive-sum, not zero-sum
5. End-to-end security — full lifecycle protection
6. Visibility and transparency — keep it open
7. Respect for user privacy — keep it user-centric