Privacy by Design Is Now an International Standard

In February, the International Organization for Standardization (ISO) adopted a new standard to protect privacy throughout the lifecycle of a consumer product. The new standard is based on the Privacy by Design principles, and they set out 30 requirements for embedding data privacy into consumer products and services. And, while US companies aren’t required to comply with them, the new standard can serve as a compliance benchmark or set of best practices.  

 What are the ISO standards?  

The ISO is an independent, non-government organization that develops consensus-based standards for technology, management, and manufacturing.  

What do the ISO standards mean for California Companies? 

There is no obligation or requirement for California companies to comply with or implement the ISO Standards. They simply offer guidance about good privacy practices. They may indicate the direction of future privacy laws, however. So, working towards them can help to ‘future-proof’ your privacy program.  

What do the ISO standards for Privacy by Design cover?  

Some of the new ISO standards include guidance and examples of:  

• How designers and engineers can make choices that empower consumers to enforce their privacy rights.  
• Procedures for responding to consumer complaints.  
• Better documentation procedures.  
• Guidance to measure efficiency and effectiveness.  
• Relevant organizational roles and accountabilities.  
• Conducting (better) privacy risk assessments.  
• Operationalization privacy controls and data management throughout the data lifecycle.  
• Preparing for (and recovering from) data breaches.  

Key Takeaways for California Companies 

OneTrust outlined these seven key takeaways:  

1. Ensure your designers implement measures for the different life cycles of consumer personally identifiable information and the product/service life cycles.  
2. Reference the ISO/IEC 27701 and the NIST Privacy Framework in developing a privacy information management system.  
3. Empower consumers to exercise their privacy rights through control and choice.  
4. Ensure someone is accountable for privacy by design implementation and management.  
5. Communicate transparently with consumers about privacy.  
6. Conduct (thorough) Privacy Impact Assessments as needed.  
7. Ensure your privacy controls are implemented (and being followed) at the operational and product life levels.  

What’s Next?  

Your company can purchase the high-level standards (with examples) and the use-case documents here.  

Alternatively, if you’d like assistance improving your company’s privacy, reach out. Our privacy attorneys would love to help.

• Privacy