Put the ISO 29100 privacy principles into practice with less effort

ISO 29100 (ISO/IEC 29100:2024) is the international privacy framework published by ISO and IEC. It gives organisations a common privacy vocabulary, defines the actors involved in processing personally identifiable information (PII), describes what shapes privacy safeguarding requirements and sets out eleven privacy principles, from consent and choice through to privacy compliance. It is high level and law-neutral, so it can underpin privacy programmes in any country.

The eleven principles in Clause 6 are: consent and choice; purpose legitimacy and specification; collection limitation; data minimisation; use, retention and disclosure limitation; accuracy and quality; openness, transparency and notice; individual participation and access; accountability; information security; and privacy compliance. Together they describe how PII should be handled throughout its life cycle, and they closely mirror the principles found in data protection laws such as GDPR.

No. ISO 29100 is a voluntary international standard, and there are no penalties for not following it. However, the data protection laws it reflects, such as UK GDPR and EU GDPR, are mandatory where they apply. Many organisations use ISO 29100 as a neutral reference when designing privacy programmes, and customers or partners may ask for alignment with its principles in contracts or due diligence.

No. ISO 29100 is a framework of terms and principles, not a certifiable management system standard. Organisations that want an independent certificate for privacy usually certify against ISO/IEC 27701, which extends an ISO 27001 information security management system with privacy controls. Aligning with ISO 29100 first gives a useful foundation for that work.

The 2024 second edition is a minor revision of ISO/IEC 29100:2011. It incorporates Amendment 1:2018, adds a normative references clause, updates cross-references, replaces the term "secondary use" with "secondary purpose" and updates the bibliography. The privacy principles themselves are unchanged, but they now sit in Clause 6 rather than Clause 5, so older mappings may need their clause numbers updating.

ISO 29100 provides the privacy terminology and principles that other standards build on. ISO 27001 covers information security management, which supports the information security principle. ISO 27701 adds certifiable privacy controls on top of ISO 27001. GDPR is a law with binding obligations whose principles overlap heavily with ISO 29100, so aligning with the framework helps but does not by itself demonstrate legal compliance.

It depends on the size of your organisation, how much personal data you process and how mature your existing privacy and security controls are. Organisations already working towards ISO 27001 or GDPR compliance often have much of the groundwork in place, because many controls overlap. Mapping your current controls against the eleven principles is the quickest way to see the remaining gaps.

Yes, on request. ISO 29100 is mapped in OneClickComply's control library, and we can enable it for your account. Its principles link to the same controls used for ISO 27001, ISO 27701 and GDPR, so evidence collected once counts across all of them. Policy generation, continuous monitoring and our in-house audit team help you show how each principle is applied.