Compliance Iso27701

---
name: compliance-iso27701
description: Assess ISO 27701 privacy information management (PIMS) compliance — controller and processor controls, mapped to GDPR articles and CCPA sections. Use when the user has or is pursuing ISO 27001 and wants to assess how far their own privacy program is from a certifiable ISO 27701 PIMS.
metadata:
  argument-hint: "[project] [--skip-checks]"
  workflow: compliance
  phase: 1
  artifact: 01-assess/
---

# ISO 27701 Assessment

Assess ISO/IEC 27701:2019 Privacy Information Management System (PIMS) compliance for "$ARGUMENTS". Evaluate PIMS requirements, controller-specific and processor-specific controls, and map controls to GDPR articles and CCPA sections.

**Arguments.** `$ARGUMENTS` may contain the project name and optional flags. Take the first token as `<project>` and treat `--skip-checks` as a flag; never include flags in file paths. All paths below use `<project>`. If `--skip-checks` is present, skip the prerequisite check and, **before writing any artifact**, append one line to `.singularskills/log.jsonl`: `{"ts":"<ISO timestamp>","skill":"compliance-iso27701","workflow":"compliance","phase":1,"project":"<project>","event":"skipped","artifact":"01-assess/","note":"<reason or \"none given\">"}`.

## Prerequisites

**Part of a workflow.** This skill is phase 1 (Assess) of the GRC Lifecycle workflow (`compliance`); cross-domain workflows run it too. First check `.singularskills/log.jsonl` for an open run for this project: a `run-started` line with `"project":"<project>"` and no later `run-finished` line for the same `workflow` and `project`. If one exists, the conductor is running you: continue here. Otherwise, if the user asked to start, run, continue or resume a process or workflow rather than this one step, do not continue here: invoke the `workflow` skill with the workflow the user asked for, or `compliance` when they named none, followed by `<project>`; it runs this phase in order, asks before it writes and records the run. Otherwise continue here: a later phase runs on its own, behind its gate.

Run this skill's gate before writing: `sh <this skill's folder>/scripts/gate.sh <project> <project root>`, where `<project root>` is the folder that contains `.singularskills/` (use `.` when you are already there). If it exits non-zero, stop and tell the user what it printed, unless `--skip-checks` was given (see Arguments). On a refusal, before you stop, append this line to `.singularskills/log.jsonl` (create the folder and file if missing): `{"ts":"<ISO timestamp>","skill":"compliance-iso27701","workflow":"compliance","phase":1,"project":"<project>","event":"refused","artifact":"01-assess/","note":"<what the gate printed>"}`. Once the gate has passed, or under `--skip-checks` once you have appended the `skipped` line, append this line before you start work: `{"ts":"<ISO timestamp>","skill":"compliance-iso27701","workflow":"compliance","phase":1,"project":"<project>","event":"started","artifact":"01-assess/","note":""}`.

Read `.singularskills/compliance/<project>/00-scope.md`. If this file does not exist, tell the user:

> Phase 0 (Scope) has not been completed for "<project>". Run `/compliance-regulatory-landscape <project>` first, or use `--skip-checks` to bypass.

## Process

1. **Read context files:**
   - Read `references/grc-lifecycle-guide.md` for GRC methodology reference
   - Read `references/assessment-template.md` for output structure
   - Read `.singularskills/compliance/<project>/00-scope.md` for scope and control framework context

2. **PIMS scope and context:**
   - Determine organization's role(s): PII controller, PII processor, or both
   - Identify PII processing activities and data flows
   - Map interested parties and their privacy requirements
   - Review existing ISO 27001 ISMS scope for PIMS extension alignment

3. **PIMS requirements assessment (Clauses 5-8):**
   - **Clause 5: PIMS-specific requirements related to ISO 27001** — assess context, leadership, planning, support, operation, performance evaluation, improvement with privacy extensions
   - **Clause 6: PIMS-specific guidance related to ISO 27002** — assess privacy-specific implementation guidance for applicable ISO 27002 controls
   - **Clause 7: Additional ISO 27002 guidance for PII controllers** — assess controller obligations
   - **Clause 8: Additional ISO 27002 guidance for PII processors** — assess processor obligations
   - Score each clause: Conforming / Minor nonconformity / Major nonconformity

4. **Controller-specific controls assessment (Annex A):**
   - **Legal basis** — assess documentation and validation of legal bases for processing (consent, contract, legitimate interest, legal obligation)
   - **Consent management** — assess consent collection, granularity, withdrawal mechanisms, consent records
   - **Data subject rights** — assess right to access, rectification, erasure, portability, restriction, objection
   - **Privacy by design and default** — assess data protection impact assessments (DPIAs), privacy-by-design principles
   - **Data sharing and transfer** — assess third-party data sharing agreements, cross-border transfer mechanisms (SCCs, BCRs, adequacy decisions)
   - Score each area: Implemented / Partially Implemented / Not Implemented

5. **Processor-specific controls assessment (Annex B):**
   - **Processing only on instruction** — assess controls ensuring processing only per controller instructions
   - **Sub-processor management** — assess sub-processor authorization, notification, contractual flow-down, due diligence
   - **Data breach notification** — assess processor-to-controller breach notification procedures, timeline, content
   - **Data return and deletion** — assess data return/deletion upon contract termination, deletion verification
   - **Audit support** — assess support for controller audits, information provision
   - Score each area: Implemented / Partially Implemented / Not Implemented

6. **GDPR mapping:**
   - Map ISO 27701 controls to GDPR articles (Articles 5-49)
   - Identify controls that directly satisfy GDPR requirements
   - Highlight GDPR requirements not fully covered by ISO 27701 controls
   - Assess GDPR-specific requirements: DPO, records of processing, DPIAs, lead supervisory authority

7. **CCPA mapping:**
   - Map ISO 27701 controls to CCPA sections (California Consumer Privacy Act / CPRA)
   - Identify controls satisfying consumer rights (right to know, delete, opt-out, non-discrimination)
   - Highlight CCPA-specific requirements not covered (sale of personal information, financial incentives, service provider obligations)

8. **Privacy program overlap assessment:**
   - Identify existing privacy program elements that already satisfy ISO 27701
   - Assess gap between current privacy program and ISO 27701 requirements
   - Document where ISO 27701 certification would provide incremental value beyond existing compliance

9. **Write the artifact** to `.singularskills/compliance/<project>/01-assess/iso27701.md` following the assessment template structure with:
   - **PIMS Scope** — roles, data flows, interested parties
   - **PIMS Requirements Assessment** — Clauses 5-8 scored with findings
   - **Controller Controls** — Annex A controls scored with findings
   - **Processor Controls** — Annex B controls scored with findings
   - **GDPR Mapping** — control-to-article mapping with coverage analysis
   - **CCPA Mapping** — control-to-section mapping with coverage analysis
   - **Privacy Program Overlap** — existing coverage and incremental value
   - **Overall Compliance Score** — score = (Implemented + 0.5 × Partially Implemented) ÷ assessed Annex A/B areas, as a percentage, alongside the count of minor and major clause nonconformities; show it with a heatmap
   - **Remediation Priorities** — ranked list of gaps to address

## Output

The ISO 27701 assessment written to `.singularskills/compliance/<project>/01-assess/iso27701.md`. Present a summary to the user highlighting:
- Organization role (controller/processor/both) and PIMS scope
- Overall PIMS compliance score
- GDPR coverage percentage via ISO 27701 controls
- Top 3 privacy control gaps
- Overlap with existing privacy program

**Record the run.** After you have written the artifact, append this line to `.singularskills/log.jsonl` (the `started` line of Prerequisites, with `"event":"finished"`): `{"ts":"<ISO timestamp>","skill":"compliance-iso27701","workflow":"compliance","phase":1,"project":"<project>","event":"finished","artifact":"01-assess/","note":""}`.

Open the artifact with this frontmatter (`agent` is the agent you run in, or `unknown`; `gate` is `passed` when the gate ran clean and `skipped` under `--skip-checks`):

```yaml
---
skill: compliance-iso27701
workflow: compliance
phase: 1
project: <project>
started: <ISO timestamp>
finished: <ISO timestamp>
agent: <the agent you run in, or "unknown">
gate: <passed|skipped>
---
```

End the artifact with `## Decisions` and `## Open questions`, in this shape:

```markdown
## Decisions
- <what was chosen> — <why> — <what was rejected>

## Open questions
- <what the next phase or a reviewer must settle>
```

End the artifact with this paragraph, verbatim:

> **Not legal or audit advice.** This artifact supports preparation for compliance work; certification, attestation and regulatory conclusions require a qualified auditor or counsel.