A Gestão da Privacidade nas Organizações - O papel do standard ISO/IEC 27701 na garantia de conformidade com o Regulamento Geral de Proteção de Dados

December 9, 2022

The digital era in which we live enhances a continuous increase in the volume of personal data processed, resulting in a higher risk for organisations and in a threat to the Privacy of data subjects in general. Ensure a secure personal data processing is still a challenge for organisations that must act in accordance with legal and regulatory requirements in this matter, especially the General Data Protection Regulation (GDPR), which introduced a set of requirements to store, process and collect personal data aiming to claim the fundamental right of data protection. In order to adapt to the requirements of this Regulation, and avoid the defined penalties, organisations had to invest in implementing practices in line with its demands and have been faced with the need to interpret a legal document that does not specify, in practice, which solutions should be implemented. The ISO/IEC 27701:2019 standard provides guidance for the establishment of a Privacy Management System, aligned with ISO/IEC 27001:2013 for Information Security management, whose data protection requirements are much in line with those established in the GDPR. To understand the role of ISO/IEC 27701:2019 in ensuring compliance with GDPR’s requirements, a comparative analysis was carried out between the requirements of both documents, which was proven in a real case study in the company Celfocus, S.A, whose Privacy Management System has recently obtained certification in the standard in study.

Authors in the community:

• 

  C

  Catarina Conde Nogueira

  ist198534

Supervisors of this institution:

• 

  C

  Carlos Manuel Costa Lourenço Caleiro

  ist13222

mathematics - Mathematics

por - Portuguese

Instituto Superior Técnico