Introduction

We often talk about protecting “data,” but behind every record is a real person an employee, a customer, a partner.

When you collect personal information, you take on a responsibility that goes beyond security it’s about trust.

That’s why ISO 27001 Control 5.35 Privacy and Protection of Personally Identifiable Information (PII) exists.
It ensures organizations handle personal data with care, accountability, and compliance reducing the risk of breaches, lawsuits, and loss of reputation.

Why This Control Matters

Personal data is everywhere in HR systems, CRMs, logs, emails, and even backups.
When mishandled, it can lead to identity theft, regulatory fines, or public backlash.

Control 5.35, defined in ISO/IEC 27002:2022 Section 5.35, is an Organizational control that’s both preventive and corrective.
It protects Confidentiality and Integrity through the Protect and Comply cybersecurity concepts.

It connects ISO 27001 with privacy frameworks such as:

• ISO 27701 – Privacy Information Management

• ISO 27018 – Cloud Privacy

• GDPR / PIPEDA – Data protection and consent-based governance

What This Control Involves

1. Identify Personal Data

Understand what personal data your organization collects, stores, or processes.

2. Define Purpose and Consent

Collect only what’s necessary, and make sure data subjects know why.

3. Apply Security Controls

Encrypt, restrict access, and monitor how personal data moves across systems.

4. Limit Retention and Access

Store data only as long as needed — then securely delete or anonymize it.

5. Respond to Privacy Incidents

Have clear processes for breach notification and subject access requests (SARs).

6. Review and Improve

Conduct privacy impact assessments (PIAs) and regular reviews of handling practices.

Common Privacy Pitfalls

🚫 Collecting more data than needed (“just in case”)
🚫 Storing unencrypted PII in test or backup environments
🚫 No clear consent tracking or deletion process
🚫 Assuming “compliance = security” (they’re not the same)

Canadian Cyber’s Take

At Canadian Cyber, we help organizations go beyond compliance checkboxes toward privacy by design.

We work with clients to map data flows, minimize collection, and implement controls that balance business needs with individual rights.

Our team also supports compliance with ISO 27018 and ISO 27701, bridging the gap between cybersecurity and data privacy.

Because protecting personal data isn’t just a legal obligation it’s a promise.

Takeaway

Privacy is the human side of security.
ISO 27001 Control 5.35 ensures organizations treat personal data with the care, transparency, and protection it deserves.

It’s how businesses earn trust and keep it.

How Canadian Cyber Can Help

At Canadian Cyber, we provide:

ISO 27001 and ISO 27701 Implementation Support

Privacy Impact Assessments (PIAs)

ISO 27018 Cloud Privacy Guidance

Internal Audit and Readiness Reviews

👉 Ready to strengthen privacy within your ISMS? Book a free consultation here.

🔗 Stay connected with the latest privacy and security insights:
LinkedIn, Instagram, Facebook, and YouTube.

• Share the blog on: