Structured privacy controls
A recognised set of controls for personal data.
Implementation & guidance
ISO/IEC 29151 PII Protection
Current edition: ISO/IEC 29151:2017 · code of practice
A code of practice for protecting personally identifiable information. It extends ISO/IEC 27002 controls with a set of PII protection controls, based on the ISO/IEC 29100 privacy principles, for organisations that act as PII controllers.
What the guidance covers
PII protection controls
ISO/IEC 29151 gives guidance on protection controls for PII across its life cycle.
Consent and choice
How consent is obtained, recorded and withdrawn.
Purpose specification
Purposes defined and communicated before processing.
Collection limitation
PII collected only as needed for the purpose.
Data minimisation
PII processing kept to the minimum necessary.
Use and retention
Use, retention and disclosure limited to the purpose.
Accuracy and quality
PII kept accurate and up to date.
Openness and access
Transparency and individuals' access to their PII.
Accountability
Responsibilities for PII protection assigned and evidenced.
Why organisations implement it
What applying ISO/IEC 29151 delivers
Regulatory support
Controls that support data protection obligations.
Customer trust
Evidence that personal data is protected by design.
Builds on your ISMS
Extends existing ISO/IEC 27001 controls.
Path to certification
Feeds directly into an ISO/IEC 27701 PIMS.
Consistent practice
The same privacy controls across systems and teams.
How we work
Path to applied PII controls
One AEC methodology from first assessment to applied controls, delivered by registered lead auditors.
- AssessGap assessment against ISO/IEC 29151, scope and roadmap
- DesignProcesses, risk register, policy and documented information
- ImplementProcesses embedded with coaching for process owners
- TrainAwareness for all staff and internal auditor development
- VerifyInternal audit, management review and mock certification audit
- Certify & sustainStage 1 and Stage 2 support, then surveillance readiness
Control extension
We add PII controls to your ISO/IEC 27001 risk treatment.
Typically 2 to 3 monthsPIMS build
We use ISO/IEC 29151 controls within an ISO/IEC 27701 system.
Typically 4 to 6 monthsReadiness review
We test your privacy controls against customer or regulator expectations.
Typically 1 month
How it is recognised
Applied within a certifiable system
ISO/IEC 29151 is a code of practice and is not certifiable on its own. Its controls are applied within an ISO/IEC 27001 ISMS or an ISO/IEC 27701 privacy information management system, which accredited certification bodies certify.
Practical
Controls designed to fit how you process personal data.
Certifiable route
Where certification is needed, the route is ISO/IEC 27701 or ISO/IEC 27001.
No guarantees
We prepare you thoroughly and never promise an outcome only an independent auditor can decide.
Where it applies
ISO/IEC 29151 by industry
Healthcare · patient data
Finance · customer data
Education · student data
IT services · platform and customer data
Related standards
Questions
ISO/IEC 29151 FAQ
Can we be certified to ISO/IEC 29151?
No. It is a code of practice. Its controls are applied within an ISO/IEC 27001 or ISO/IEC 27701 system, which can be certified.
ISO/IEC 29151 or ISO/IEC 27701?
ISO/IEC 27701:2025 is a certifiable privacy management system. ISO/IEC 29151 provides additional guidance on PII protection controls that can be used within it.
How does it differ from ISO/IEC 27018?
ISO/IEC 27018 is for public cloud providers acting as PII processors. ISO/IEC 29151 is broader and focuses on PII controllers.
Does AEC issue certificates?
No. Certification of the ISMS or PIMS is carried out by an accredited certification body. AEC prepares your controls and evidence.
Strengthen your PII protection
Tell us how you process personal data and your current controls. We reply with a proposal covering control design and integration with your ISMS or PIMS.
Certification, where sought, is carried out by independent, accredited certification bodies. AEC prepares organisations and does not guarantee audit outcomes.