ISO/IEC 29100 — Privacy Framework

1. Overview of the ISO/IEC 29100 Privacy Framework

ISO/IEC 29100 provides a high-level privacy framework that establishes a common terminology, defines core privacy principles, and outlines the actors and roles involved in processing personally identifiable information (PII). Published as part of the ISO/IEC 27000 family of security and privacy standards, the framework is technology-neutral and applicable to any organization that processes PII, regardless of sector or jurisdiction. It serves as a foundational reference for organizations seeking to implement privacy programs that can demonstrate accountability and regulatory compliance across multiple legal regimes.

The standard identifies eleven fundamental privacy principles: consent and choice, purpose legitimacy and specification, collection limitation, data minimization, use retention and disclosure limitation, accuracy and quality, openness transparency and notice, individual participation and access, accountability, information security, and privacy compliance. These principles form the foundation upon which privacy-preserving systems should be designed and operated. Importantly, the principles are interrelated and must be considered holistically rather than in isolation — for example, data minimization directly supports information security by reducing the attack surface, while transparency enables individual participation by making processing activities visible to data subjects.

2. Actors, Roles, and Responsibilities in PII Processing

ISO/IEC 29100 defines five key actor categories: the PII principal (the data subject), the PII controller (the entity that determines purposes and means), the PII processor (the entity that processes on behalf of the controller), the third party (a separate entity that may receive PII), and the supervisor (a regulatory authority). Understanding these roles and their legal relationships is essential for designing compliant systems. The standard clearly delineates the responsibilities of each actor, establishing that the controller bears primary accountability for compliance, while the processor must follow the controller’s documented instructions and implement appropriate safeguards.

The framework also introduces the concept of a PII processing flow, which maps the lifecycle of PII from collection through use, storage, disclosure, and eventual destruction. Each stage in this flow carries specific obligations under the privacy principles. For example, the collection stage must implement consent mechanisms, while the disclosure stage must enforce purpose compatibility checks and data-sharing agreements. The processing flow concept is particularly valuable for engineering teams because it provides a structured framework for conducting privacy impact assessments and identifying control points where technical measures such as encryption, access control, and audit logging should be applied.

3. Engineering Design Insights for Privacy-Preserving Systems

Translating the ISO/IEC 29100 framework into engineering practice requires a systematic approach. Privacy by design must be embedded into the software development lifecycle from requirements gathering through deployment and operations. Key architectural patterns include attribute-based access control (ABAC) for fine-grained authorization decisions based on data sensitivity, differential privacy for analytics workloads that require statistical outputs without revealing individual records, homomorphic encryption for computation on encrypted data in untrusted environments, and privacy-enhancing identity management using verifiable credentials and zero-knowledge proofs.

A practical approach for implementing the framework is to map each privacy principle to specific technical controls in a requirements traceability matrix. For instance, the consent and choice principle maps to a consent management system with granular opt-in/opt-out capabilities, preference storage, and consent receipt generation. The data minimization principle maps to automated data retention schedules, purging routines, and data classification labels that trigger lifecycle management actions. This traceability approach ensures that no principle is overlooked during system design and provides clear evidence for regulatory audits.