Do companies have to create an internal privacy policy (not a privacy notice) under the ISO 29100 privacy framework?

One of the provisions in the ISO 29100 privacy framework is that the top management of an organization should “establish a privacy policy” that, among other things:

• Provides an internal organizational framework for setting objectives,

• Includes a commitment to satisfy applicable privacy safeguarding requirements,

• Includes a commitment to continual improvement.

The privacy policy envisioned under the ISO 29100 is not the same as public-facing privacy notices that are posted on company websites that explain to the public how personal information is collected, shared, and processed. Instead, it would be an internal company policy that is communicated within an organization and governs how the organization will handle personal information. The privacy policy is designed to be supplemented by more detailed rules and obligations, created by various stakeholders internally.

How does the terminology of the ISO 29100 privacy framework relate to the data privacy laws?

The terminology used by the ISO 29100 privacy framework arguably most closely aligns with the terminology used under the GDPR. The following chart provides a side-by-side comparison of commonly used terms and concepts as they appear in the European GDPR, the California CCPA, and the newly passed Virginia Consumer Data Protection Act.

Does the ISO 29100 privacy framework tell companies how to score themselves?

Unlike other privacy frameworks that recommend that companies be scored or self-score, using a maturity model (e.g., a score from one to four), the ISO 29100 privacy framework does not identify a specific methodology for assessing compliance or maturity.