Search Results

Back Up Next ISO/IEC TS 27570 ISO/IEC TS 27570:2021 — Privacy protection — Privacy guidelines for smart cities (first edition) Up Abstract ISO/IEC TS 27570 "takes a multiple agency as well as a citizen-centric viewpoint. It provides guidance on: smart city ecosystem privacy protection; how standards can be used at a global level and at an organisational level for the benefit of citizens; and processes for smart city ecosystem privacy protection. ...” [Source: ISO/IEC TS 27570:2021] Introduction Smart cities’ are emerging from the confluence of public wireless networks, mobile/portable devices, the I nternet o f T hings (both industrial and consumer), automation, cloud computing, smart devices with advanced automation and artificial intelligence/machine learning, big data and more. As disparate ICT system are increasingly and dynamically communicating within our cities, both opportunities and risks are opening up for individuals plus the commercial and governmental agencies providing various services (such as communications, energy, transportation, healthcare and law enforcement). Scope Although the guideline briefly mentions information security aspects such as safety and resilience, the guideline specifically concerns privacy in the context of smart cities including ‘smart city ecosystem privacy protection’. Rhetorical questions include: To what extent is it appropriate for individuals to be identified, tracked and monitored through their ICT devices and digital interactions as they go about their business in the city? Since privacy requirements and expectations vary between the authorities, businesses and individuals, how should those tensions be managed? Even though the collection, processing and disclosure of personal data may be restricted on privacy grounds, what (if anything) can/should be done to restrict correlation and inference being used as large quantities of information become available for sharing and analysis? Is it even feasible to support (an appropriate degree of) anonymity if individuals so desire, without excluding them and denying them the advantages of interaction between smart devices? There are social/societal aspects to this, as well as the technological and personal. Given the rapid pace of change in this area, the guideline cannot fully address all the issues at this time but instead seeks to establish a reference (conceptual) framework as a basis for the development of future standards. Structure Main clauses: 5: Privacy in smart cities 6: Guidance on smart city ecosystems privacy protection 7: Guidance on standards for smart city ecosystems privacy protection 8: Guidance on processes for smart city ecosystem privacy protection Annex A: Example of ecosystem privacy plan structure Annex B: Using video cameras in smart cities The guideline provides conceptual diagrams and explanations, emphasizing other applicable standards. Status The current first edition was published as a T echnical S pecification in 2021 and confirmed unchanged in 2024. Commentary This visionary, conceptual, innovative and remarkable standard was conceived way back in 2015. The issues it covers are still barely even recognised as such at this point, at least not outside the specialism. Better to influence the thinking and direction on privacy, governance and related matters now than to complain about constraints later on when it may be too late to achieve fundamental change. If only SC 27 had taken such a proactive stance on IoT security way back when it was in its infancy! Speaking as a former biologist and current pedant, frequent use of “ecosystem” (a contraction of eco logical system ) catches my beady eye. The standard is not talking about living organisms interacting with the natural environment, but conceptual linkages between IT systems, networks, organisations and individuals in the technology context. Surely there is a more accurate and appropriate term than ‘ecosystem’ - ‘technosystem’, perhaps, contracting techno logical system ? Up Up Up This page last updated: 12 February 2026

Back Up Next ISO/IEC TS 27568 ISO/IEC TS 27568 — Security and privacy of digital twins [PROPOSAL] Up Abstract ?? Introduction Digital twins are essentially analogues, realistic models of real-world situations used for various purposes. Scope The standard will address the security and privacy implications of digital twins, supporting other digital twinning standards as the field develops at pace. Structure ?? Status At P reliminary W ork I tem stage in 2025. Publication of the T echnical S pecification is planned for 2028. Commentary Blank look Tumbleweed Up Up Up This page last updated: 12 February 2026

Back Up Next ISO/IEC 27566-1 ISO/IEC 27566-1 :2025 — Information security, cybersecurity and privacy protection — Age assurance systems — Part 1: Framework [First edition] Up Abstract ISO/IEC 27566 part 1 "establishes a framework for age assurance systems and describes their core characteristics, including privacy and security, for enabling age-related eligibility decisions." [Source: ISO/IEC 27566-1:2025 ] Introduction This standard will lay out the core principles and a framework for determining someone’s age or age-range independently of their identity, for use in age-related eligibility decisions. Scope Age assurance framework Structure Main clauses: 4: Overview of age assurance 5: Functional characteristics - functional requirements 6: Performance characteristics - assurance and metrics 7: Privacy characteristics - privacy requirements 8: Security characteristics - cybersecurity requirements 9: Acceptability characteristics - nondiscrimination requirements 10: Practice statements - documenting the arrangements Status The standard development project set out in 2022. The current first edition was pubished in 2025 . Commentary Whereas self-assertion (e.g. “Click here if you are an adult”) is a simple and commonplace but clearly very weak control, the standard aims to standardise and where necessary strengthen the process of determining someone’s age or age-range without (necessarily) requiring them to disclose their identity and thereby risk compromising their privacy. The cunning plan is to develop and incorporate appropriate assurance controls into the framework indicating confidence in the determined age or age-range, giving policy- and law-makers options when defining age-related criteria for various purposes. In situations where age is particularly important, additional confidence in the age determination is warranted, even if that implies completing a more involved and lengthy process of age verification, perhaps utilising a third party age-verification service or aggregating multiple age indicators taking account of any contraindications, inconsistencies or doubts. Conversely, if age verification is relatively unimportant, simpler, quicker, cruder approaches may suffice. Spoofing (e.g . where an older person pretends or claims to be, and completes the age-verification process on behalf of, a youngster, or a child simply presents a fake credential) is just one of the challenges for this project. There are also identities, credentials, tokens and age-verification subsystems and services, plus individual rights and freedoms to protect (such as privacy and inclusivity), in a framework that allows communication and collaboration between age-verifiers. Up Up Up This page last updated: 12 February 2026

Back Up Next ISO/IEC TS 27564 ISO/IEC TS 27564:2025 — Privacy protection — Guidance on the use of models for privacy engineering [first edition] Up Abstract ISO/IEC TS 27564 "provides guidance on how to use modelling in privacy engineering. It describes categories of models that can be used, the use of modelling to support engineering, and the relationships with other references, including International Standards on privacy engineering and on modelling. It provides high-level use cases describing how models are used.” [Source: ISO/IEC TS 27564:2025 ] Introduction Modelling and other systems engineering approaches are useful when designing complex systems, such as IT systems plus their associated operating environments and processes. This standard is focused on using modelling and engineering to specify, design and embed suitable privacy arrangements/controls into complex [IT] systems that handle personal information. Determining requirements and incorporating privacy into the product lifecycle from the outset should reduce the issues that arise if privacy is neglected until later. Bolting-on privacy (or security or safety) late in the day is less than ideal (suboptimal), albeit still better than nothing. Scope Guidance on applying the M odel-B ased S ystems and S oftware E ngineering approach (as per ISO/IEC/IEEE 24641:2023 - Systems and Software engineering - Methods and tools for model-based systems and software engineering ) to design-in appropriate privacy controls for complex systems using conceptual models. Structure Main clauses: 5: Engineering with models - particularly MBSSE 6: Privacy engineering with models - more MBSSE 7: Guidance on the use of privacy models - and standards Annex A: Using models for privacy engineering - Examples Status The current first edition was published in 2025 . Commentary This standard explains the use of others such as ISO/IEC/IEEE 24641 , ISO/IEC 27555 (models for deletion of personal information), ISO/IEC 27556 (models for managing privacy preferences), ISO/IEC 27559 (models for de-identification) and ISO/IEC 27561 (POMME), for privacy engineering. The systems engineering approach involves determining and taking account of the context in which a complex system is to be used, as well as the complexities within, to develop a definitive model. The architectural model, in turn, drives a coordinated approach to the system development, with updates as things progress to keep everything aligned - in this case, aligned around privacy, specifically. It is published as a T echnical S pecification rather than a full International Standard, presumably because the subject matter is still in development. As such, it should (according to the ISO Directives ) be reviewed within just three years of the agreed “stability date” rather than the usual five years after publication. Up Up Up This page last updated: 12 February 2026

Back Up Next ISO/IEC TR 27563 ISO/IEC TR 27563:2023 — Security and privacy in artificial intelligence use cases — Best practices (first edition) Up Abstract ISO/IEC TR 27563 "outlines best practices on assessing security and privacy in artificial intelligence use cases, covering in particular those published in ISO/IEC TR 24030. The following aspects are addressed: an overall assessment of security and privacy on the AI system of interest; security and privacy concerns; security and privacy risks; security and privacy controls; security and privacy assurance; and security and privacy plans. Security and privacy are treated separately as the analysis of security and the analysis of privacy can differ.” [Source: ISO/IEC TR 27563:2023 ] Introduction This T echnical R eport analyses and elaborates on the information security and privacy aspects of the 132 use cases for A rtificial I ntelligence/M achine L earning systems published in ISO/IEC TR 24030:2021 “Information technology - Artificial Intelligence (AI) - use cases”, and provides four additional use cases developed specifically for this TR. Scope The standard offers information security and privacy best practice guidance following analysis of ISO/IEC 24030 ’s use cases. Structure Main clauses: 5: Analysis of security and privacy 6: Templates for analysis 7: Supporting information Annex A: Additional use cases The information security and privacy implications for related groups of AI/ML use cases have been systematically analysed. The results are summarised in bar charts, followed by tables elaborating on the analyses in a standard format. Status The current first edition was published in 2023 . Commentary Cue tumbleweed ... Up Up Up This page last updated: 12 February 2026

Back Up Next ISO/IEC 27562 ISO/IEC 27562:2024 — Information technology — Security techniques — Privacy guidelines for fintech services (first edition) Up Abstract ISO/IEC 27562 "provides guidelines on privacy for fintech services. It identifies all relevant business models and roles in consumer-to-business relations and business-to-business relations, as well as privacy risks and privacy requirements, which are related to fintech services. It provides specific privacy controls for fintech services to address privacy risks. [ISO/IEC 27562] is based on the principles from ISO/IEC 29100, ISO/IEC 27701, and ISO/IEC 29184, the privacy impact assessment framework described in ISO/IEC 29134, and the risk management guideline described in ISO 31000. It also provides guidelines focusing on a set of privacy requirements for each stakeholder. [ISO/IEC 27562] can be applicable to all kinds of organizations such as regulators, institutions, service providers and product providers in the fintech service environment.” [Source: ISO/IEC 27562:2024 ] Introduction ”Fintech” (a contraction of fin ancial tech nology, formally defined by the standard as “digital innovations and technology-enabled business model innovations in the financial sector” ) refers to the use of information and communications technology within the financial services industry - banking, insurance, investment etc . - in particular, for financial services delivered digitally. A significant amount of personal information is processed by fintech. Personal information is subject to an array of privacy laws and regulations as well as corporate privacy policies and ethical considerations, all of which help ensure the trustworthiness necessary to earn the trust of data subjects (customers). Modern fintech architectures increasingly involve novel technologies such as cloud-based microservices with A pplication P rogramming I nterfaces, blockchain and A rtificial I ntelligence/M achine L earning. In addition to the usual data/IT/cyber security risks and controls, privacy concerns must also be identified, evaluated and addressed Scope The standard addresses the privacy aspects of fintech. Structure Main clauses: 5: Stakeholders and general considerations for fintech services 6: General principles applicable to fintech services 7: Actors in fintech services 8: Privacy risks to actors 9: Privacy controls for actors 10: Privacy guidelines for actors Annex A: Purpose of collecting and processing PII Annex B: Examples of international and regional regulations Annex C: Example of open platform architecture for fintech service providers Annex D: Use cases for fintech services Annex E: List of common vulnerabilities and privacy risks Annex F: Characteristics of AI-related PII processing for fintech services Status The current first edition was published in 2024 . Commentary I am unclear whether/why the financial services technology industry requires specific guidance on privacy that is not already available in other standards, laws and regulations. What makes fintech privacy special, I wonder? Should we anticipate similar privacy standards for healthtech, govtech, agritech and othertech? Even within fintech, what about safety, information security, security generally and governance, aside from privacy? Where does it all end? A particular concern for the already heavily-regulated financial services industry is the potential additional compliance burden if regulators start using this standard as a mandatory set of privacy control requirements. There are lots of controls in this standard, some quite complex and costly to design, implement, operate, manage and maintain. The details are devilish. On the upside, guidance on the application of AI/ML technologies within financial services is timely. Up Up Up This page last updated: 12 February 2026

Back Up Next ISO/IEC 27561 ISO/IEC 27561:2024 — Information security, cybersecurity and privacy protection — Privacy operationalisation model and method for engineering (POMME) ( first edition) Up Abstract “This guidance document [ISO/IEC 27561] describes a model and method to operationalize the privacy principles specified in ISO/IEC 29100 into sets of controls and functional capabilities. The method is described as a process that builds upon ISO/IEC/IEEE 24774. [ISO/IEC 27561] is designed for use in conjunction with relevant privacy and security standards and guidance which impact privacy operationalization. It supports networked, interdependent applications and systems. [ISO/IEC 27561] is intended for engineers and other practitioners developing systems controlling or processing personally identifiable information.” [Source: ISO/IEC 27561:2024] Introduction The standard presents a systematic approach for engineering IT systems to satisfy privacy and personal data protection requirements, drawing on the 11 privacy principles expressed in ISO/IEC 29100 privacy framework plus ISO/IEC TR 27550 and ISO/IEC TR 27555 privacy engineering for system lifecycle processes. Scope The standard is intended to help ‘privacy engineers’ (or system architects or technical managers) interpret and satisfy the privacy requirements expressed in policies etc . plus those that emerge in the course of further analysis and development. It lays out a structured analytical method and model based on OASIS, emphasising functional architecture and practical implementation of privacy engineering. The process involves elaborating on privacy risks and designing controls, capabilities required plus the functions and mechanisms to deliver them. Structure Main clauses: 5: Context of privacy operationalization - background to the model and approach. 6: Initial information inventory process - an iterative personal information inventory process including determination of the domains, processes, systems and data flows. 7: Privacy controls, privacy control requirements, capabilities, risk assessment and iteration process - determination and documentation of the required controls, functions, mechanisms etc. 8: Privacy capabilities - essentially the governance arrangements for addressing privacy. Annex A: Mapping of the privacy principles from ISO/IEC 29100 to POMME capabilities. Annex B: Lifecycle process example involving a PII controller and a solution provider. Annex C: POMME capability functions and mechanisms in a consumer application use case. Status The current first edition was published in 2024 . Commentary Despite the contrived title and nasty neologism ‘operationalization’, the standard’s systematic, structured approach should prove useful for privacy specialists. Up Up Up This page last updated: 12 February 2026

Back Up Next ISO/IEC TS 27560 ISO/IEC TS 27560:2023 — Privacy technologies — Consent record information structure (first edition) Up Abstract ISO/IEC TS 27560 "specifies an interoperable, open and extensible information structure for recording PII principals' consent to PII processing. [ISO/IEC TS 27560] provides requirements and recommendations on the use of consent receipts and consent records associated with a PII principal's PII processing consent, aiming to support the: provision of a record of the consent to the PII principal; exchange of consent information between information systems; management of the life cycle of the recorded consent.” [Source: ISO/IEC TS 27560:2023] Introduction This T echnical S pecification specifies an interoperable, open and extensible information structure for recording and potentially sharing PII Principals' (data subjects') consent to data processing. Scope In addition to the specification, the standard provides requirements and recommendations on the use of consent receipts and consent records associated with a PII Principal’s data processing consent to support the: Provision of a record of the consent to the PII Principal; Exchange of consent information between information systems; and Management of the lifecycle of the recorded consent. The standard does not specify an exchange protocol for receipts and records, nor an exact data structure for such exchanges. Structure Main clauses: 5: Overview of consent records and consent receipts 6: Elements of a consent record and consent receipt Annex A: Examples of consent records and receipts Annex B: Example of consent record life cycle Annex C: Performance and efficiency considerations Annex D: Consent record encoding structure Annex E: Security of consent records and receipts Annex F: Signals as controls communicating PII principal's preferences and decisions Annex G: Guidance on the application of consent receipts in the context of privacy information management systems Annex H: Mapping to ISO/IEC 29184 Status The first edition was published as a T echnical S pecification in 2023 . ISO made the downloadable standard free of charge in 2025 to encourage uptake and so promote the sharing of privacy consents. See https://www.iso.org/standard/80392.html An early revision is ongoing with an expanded scope to encompass the former ISO/IEC TS 27569 project (which has presumably been cancelled?). The second edition has passed a vote at C ommittee D raft stage. It has a new title: "Structure of personally identifiable information (PII) processing records." Commentary If only ISO would release all the ISO27k infosec standards free of charge, encouraging everyone to improve security for all! I missed the announcements about the current revision project e.g . its scope and purpose. Up Up Up This page last updated: 12 February 2026

Back Up Next ISO/IEC 27559 ISO/IEC 27559:2022 — Information security, cybersecurity and privacy protection — Privacy-enhancing data de-identification framework (first edition) Up Abstract ISO/IEC 27559 "provides a framework for identifying and mitigating re-identification risks and risks associated with the lifecycle of de-identified data.” [Source: ISO/IEC 27559:2022] Introduction This standard proposes a ‘principles-based’ framework/structure for identifying and mitigating privacy-related risks such as re-identification of supposedly de-identified data. It advises on properly de-identifying (anonymising) personal data in order to build trust with data subjects and comply with applicable privacy laws and regulations. Scope As data analytics increasingly relies on sharing and combining data sets containing supposedly de-identified (anonymized) data, the risks of re-identification are growing more significant. This standard provides guidance on the principles involved in recognizing and mitigating those risks. It stops short of the specific technologies and their implementation. Structure Main clauses: 5: Overview 6: Context assessment - essentially, determining the general concerns and hence main requirements in this area, using analytical approaches such as threat modelling. Understanding the business situations in which personal data are shared both within and without the organisation suggests the possibility of procedural and administrative controls (such as contracts and agreements) to be applied by data custodians 7: Data assessment - understanding the data structures to identify possible ‘attacks’ (unauthorised/inappropriate attempts to obtain personal information that would compromise privacy) 8: Identifiability assessment and mitigation - understanding how personal information might be gleaned from available/accumulated data that (whether individually or as a whole) has been inadequately anonymized, and mitigating the risks (e.g. applying the de-identification techniques described in ISO/IEC 20889) to an acceptable level (not necessarily zero!) 9: De-identification governance - directing and controlling the people involved in maintaining privacy, for example by determining and assigning appropriate roles and responsibilities, defining policies and procedures, managing and mopping-up after privacy breach incidents Annex A: Example identifiers Annex B: Example threshold identifiability benchmarks Status The current first edition was published in 2022 . Commentary As our personal information is increasingly obtained and shared both within and among organisations, this standard has a valuable role in setting the ground rules. It specifies how to do so without unnecessarily compromising the privacy of the individuals concerned, or exposing personal data to compromise by various means (e.g. data aggregation and inference attacks). As such, it facilitates the process by increasing the level of trust between providers and acquirers of personal information, supporting privacy arrangements in general. Up Up Up This page last updated: 12 February 2026

Back Up Next ISO/IEC 27556 ISO/IEC 27556:2022 — Information security, cybersecurity and privacy protection — User-centric privacy preferences management framework (first edition) Up Abstract ISO/IEC 27556 "provides a user-centric framework for handling personally identifiable information (PII), based on privacy preferences.” [Source: ISO/IEC 27556:2022] Introduction The standard lays out a “user-centric framework” (an architecture) to handle personal information in a controlled manner in accordance with the privacy-by-design and other requirements of applicable privacy laws and regulations. The standard outlines a mechanism for organisations handling personal data to comply with data subjects’ privacy requirements, even as those organisations share and collaborate on processing the data. Scope The standard describes a generic high-level system architecture without specifying the content and format of privacy preference information. The architecture, in turn, informs the design and implementation of IT systems handling personal information and communicating it between organisations, while managing the privacy preferences of data subjects (known as ‘PII Principals’ in the standard i.e. the people whose personal information is being handled). The standard expands upon ISO/IEC 29100’s “Privacy framework ”. Structure Main clauses: 5: User-centric framework for handling PII 6: Requirements and recommendations for the P rivacy P reference M anager (defined as “component providing a capability allowing PII principals to express privacy preferences and a capability to monitor PII processing according to these privacy preferences” - normally an IT system component, not a person) 7: Further considerations for the PPM in a P rivacy I nformation M anagement S ystem Annex A: Use cases of PII handling based on privacy preferences Annex B: Identifying an actor serving as a component for each example service Annex C: Guidance on configuration of privacy preferences management Annex D: Supporting the design of a privacy preference management Status The current first edition was published in 2022 . Commentary I appreciate the intent to standardise the handling and management of users’ privacy consents, perhaps allowing the preferences to be shared among systems. However, given strong commercial incentives for social media and related systems and companies to exploit every scrap of personal information they can obtain, it may take even stronger pressure from regulators and legislators on behalf of private individuals to see this widely adopted in practice. So, watch this space. Up Up Up This page last updated: 12 February 2026