Overview
ISO/IEC 29101:2018 - Privacy architecture framework defines a high-level architecture for safeguarding personally identifiable information (PII) in information and communication technology (ICT) systems. It specifies the concerns that must be considered when processing PII, lists components for implementing privacy-aware systems, and provides multiple architectural views (component, actor/deployment, interaction) to contextualize those components. The standard is intended for entities involved in specifying, procuring, architecting, designing, testing, maintaining, administering and operating ICT systems that interact with PII principals.
Key technical topics and requirements
- Privacy concerns and principles: Builds on ISO/IEC 29100 by mapping privacy principles and defining privacy safeguarding requirements specific to ICT systems that process PII.
- PII lifecycle coverage: Addresses lifecycle phases including collection, transfer, use, storage, and disposal of PII.
- Architecture layers and components: Organizes privacy-related functionality into layers (for example, privacy settings, identity and access management, and the PII layer) and describes components relevant to each layer.
- Actors and deployment views: Describes ICT systems from the perspectives of the PII principal, PII controller, and PII processor, and shows how PII flows between these actors.
- Interaction view: Illustrates component-to-component interactions and how privacy controls operate across system boundaries.
- Privacy-enhancing technologies (PETs): Shows how PETs can be used as privacy controls within the architecture.
- Correspondence and mapping: Provides mapping tables tying concerns to viewpoints and components to help implementers trace requirements to architecture.
- Standards alignment: Uses ISO/IEC/IEEE 42010 for architecture description and explicitly ties to privacy management practices and information security engineering.
Practical applications - who uses this standard
- System architects and privacy engineers - design privacy-aware ICT architectures and select appropriate components/PETs.
- Security architects and developers - integrate identity, access management and data protection controls into system designs.
- Procurement and vendors - specify and evaluate privacy requirements in product RFPs and procurements.
- Compliance officers and auditors - map organizational privacy safeguarding requirements to technical architecture.
- Operations and IT administrators - implement, test, and maintain privacy controls across deployment environments.
Related standards and further reading
- ISO/IEC 29100 - Privacy framework (principles and stakeholders)
- ISO/IEC/IEEE 42010 - Systems and software engineering - Architecture description
- Use ISO/IEC 29101 to bridge privacy policy/management decisions with concrete architectural controls and PETs when building or evaluating systems that process PII.
Keywords: ISO/IEC 29101:2018, privacy architecture framework, PII, PETs, ICT systems, privacy safeguarding, identity and access management, privacy engineering.
