ISO IEC 27555-2021.docx

INTERNATIONA1.STANDARDISO/IEC27555editionFirst2O21-1.OInformationsecurity,cybersecurityandprivacyprotectionGuide1.inesonpersona1.1.yidentiab1.einformationde1.etionSecurityde'information,CybersecuriteetprotectiondeIavieprivee1.ignesdirectricesre1.ativesaIasuppressiondesinformationspersonne1.1.ementidentif1.ab1.esReferencenumberISO/IEC2755S:2O21(E)COPYRIGHTPROTECTEDDOCUMENT©IS0/1EC2021IUirhM*hedbdi1.iUedotherwiseupdhi.o啪InPSd1.Mc;GeatrOn1.<nm11nr1amaqmr6pW11opypHH)M)uonmaytheinternetoranintranet,withoutpriorwrittenpermission.PermissioncanberequestedfromeitherISOattheaddressbe1.oworISO'smemberbodyinthecountr)oftherequester.f),WV>fifiU81.andonnet8CH-1214Vernier,GenevaPhone：M1.22749O1.11觥曲ite：图洲跳触OQrgPub1.ishedinSwitzer1.andContentsForewordV5.3Retentionperiod45.5ArchivesAIIocationofc1.usters7.3Standardde1.etionspecificationsidentification7.4.3Suspensionextendde1.etion13899e3ReqUIre)ents.189.3.5Transmissiondismant1.ingand199.5Requirementsregu1.arimp1.ementationfor21iiiPageIntroductionviScope1Normativereferences1Termsanddefinitions1SymbOiSandabbreviatedterms3Frameworkforde1.etion35.1 Genera1.352ConStraIntS5.4 C1.ustersofP1.1.andregu1.arde1.etionperiod5.4.1Retentionperiod55.4.1 Regu1.arde1.etionperiod55.4.2 andbackupcopiesofP1.1.5.6 Standardde1.etionperiods,startingpoints,de1.etionru1.esandde1.etionc1.asses75.7 Specia1.situations7C1.ustersofP1.I86.1 Genera1.86.2 Idcntfi03Tion.9Specif1.cationofde1.etionperiods107.1 Standardandregu1.arde1.etionperiods107.2 Regu1.arde1.etionperiodspecifications117.4 De1.etionperiodperiodforspecia1.situations7.4.1Genera1.127.4.1 Modificationofdataobjects12Needtooftheperiodofactiveuse7.4.5 Backupcopies13De1.etionc1.asses148.1 Abstractstartingpointsabstractde1.etionru1.es148.2 Matrixofde1.etionc1.asses15Requirementsforimp1.ementation169.1 Gener21.，.169.2 ConditionsforstartingpointsoutsideITsystems181.1.1 Genera1.forimp1.ementationfororganization-wideaspects9.3.2Backup181.1.3 191.1.4 Repair,systemsdisposa1.ofsystemsandcomponents9.3.6Everydaybusiness1.ife199.4 Requirementsforimp1.ementationforindiridua1.ITsystems209.6 De1.etionformanua1.processesP1.1.processor9.7 Contro1.de1.etioninspecia1.cases219.7.1 Exceptionmanagement2110Responsibi1.ities2210.1 Genera1.2210.2 Documentation23iBib1.iography25ForewordCommission)formIECspecia1.izedsystemdeve1.opmentofStandardization.Standardsthroughtechnica1.organizations,governmenta1.andnon-governmenta1.,in1.iaisonwithISOandIECra1.sotakepartintheneededdescnbedtheindifTerentISO1.ECDirectives,Partshou1.dparticu1.ar.Thisdocumen1.inAttentiondrawn1.S0andpossibi1.itythatsomeOfresponsib1.eforofidentifyj11ganymaya1.1.suchsubject1.istofpatentdec1.arationsreceived(seepatents.iec.ch).expressionsexp1.anationtoconformityassessment,standards,informationaboutSpecificadherenceandSubcommitteeSCwasInformationsecurity,CyhersecwntyCommitteeISO/1.ECprotection.Informationtechno1.ogy,O/IEC2021-A1.1.nghtsreservedISO(theInternationa1.OrganizationforStandardization)andIEC(theInternationa1.E1.ectrotechnica1.membersofISOtheparticipateintheforwor1.dwideInternationa1.Nationa1.bodiesarccommitteesestab1.ishedbytherespectiveorganizationtodea1.withparticu1.arfie1.dsoftechnica1.activity.ISOandIECmitteesco1.1.aborateinfie1.dsofmutua1.interest.Otherinternationa1.work.Theproceduresusedtodeve1.opthisdocumentandthoseintendedforitsfurthermaintenanceareforthetypesofdocument1.Inbenoted,thedifferentwascriteriaacwdaneeWiIhMedik>ri1.门心oCht!ISO/IECDirectives,Part2(seewww.iso.org/directivesorwww.iec.ch/members-experts/refdocs).vOfpatentrights.totheIECsha1.1.notbehe1.dthee1.ementsthisdocumentorbethepatentrights.Detai1.sofanypatentrightsidentifiedduringthedeve1.opmentofe4kM:Umen1.wi1.1.theIntroductionand/orontheISO1.istofpatentd»1.artionsreceived(seewww.iso.org/patents)ortheIECAnytradenameusedinthisdocumentisinformationgivenfortheconvenienceofusersanddoesnotconstituteanendorsementForanre1.atedofthevo1.untarynatureofwe1.1.themeaningofISO1.SO,stermstothWoHd丁Fadg。悖相a由HNwTO)princip1.esMfheTeCbng1.Baie<su>111d。(丁BT)seewww.iso.org/iso/fdrcword.htm1.IntheIEC,seewsvw.iec.ch/undcrstanding-s1.andards.Thisdocument27,preparedbyJointTechnica1.andprivacyrJTCI1Anyfeedbackorquestionsonthisdocumentshou1.dIwdirectedtotheuser'snationa1.standardsbody.comp1.ete1.istingof.IntroductionManyfunctiona1.processesandITapp1.icationsusepersona1.1.yidentifiab1.einformation(PU),whichisMbjcctnotHnninerttonipiif1.crdpm)visionsnea(idsin)HindbQqiiiisaThd£.1.etedo(ri0anpptqirtaie(idRmeT9nsum】thatrequireorganizationstofu1.fi1.therightsofP1.1.principa1.s,suchastherighttoobtainerasure(tobeforgotten).1SOIEC29100definesprincip1.esof*dataminimization”and“use.retentionanddisc1.osure1.imitation"f