The rules this is built from, and the law around them
The product publishes a 28-record reading of ISO 30301:2019, written from our own analysis of the published standard. The four markets below are the jurisdictions a records owner usually has to read beside it. The frameworks are named, with a link; this product does not state the text of a law or a privacy regime it does not read. Clause 4.1.2 is where your own legal register records the duty.
The 25 clause records and 3 annex records that apply today
Context of the organization
- 4.1.1 Understanding the organization and its context
- 4.1.2 Records requirements
- 4.2 Understanding the needs and expectations of interested parties
- 4.3 Determining the scope of the MSR
- 4.4 Management system for records
Leadership
Planning
Support
- 7.1 Resources
- 7.2 Competence
- 7.3 Awareness
- 7.4 Communication
- 7.5.1 Documented information: general
- 7.5.2 Creating and updating documented information
- 7.5.3 Control of documented information
Operation
- 8.1 Operational planning and control
- 8.2 Determining records to be created
- 8.3 Designing and implementing records processes, controls and systems
Performance evaluation
Improvement
Annex A: operational requirements
Four markets, named
Federal information and privacy controls
NIST SP 800-53 Rev 5 (audit and accountability, access control, media protection), the NIST Privacy Framework and FISMA for federal systems. Named only. Record the duty that applies to each site in your clause 4.1.2 register.
Clause 4.1.2 records requirementsData protection and electronic communications
The GDPR (records of processing, retention, erasure, access) and the the ePrivacy Directive 2002/58/EC. Named only. The national implementation is what an auditor will ask you to evidence.
Clause 7.5.3 control of documented informationUK data protection
The UK GDPR, the Data Protection Act 2018 and PECR. Named only. A UK site meets the ISO requirement through its own legal register.
Clause 4.1.2 records requirementsPrivacy and government data governance
The Privacy Act 1988 and the Australian Privacy Principles, the Australian Government Data Governance Framework for Commonwealth agencies and the OAIC Privacy Management Framework. Named only.
Clause 4.1.2 records requirementsThe rules this is built from
Every line names its source. The 25 clause-level records and the 3 Annex A records for the requirements that apply today are written from the published ISO 30301:2019, in our words; the evidence and the common gaps are our reading, cited to the clause. The revision layer is read from the public ISO stage record and the committee's published comparison. Where the record is silent, the page says so. Read from the real rules, not invented.
ISO 30301:2019, clause by clause
Each clause page states the requirement in our words, the evidence, the gaps and what to do before the revision lands.
Open the clause indexAnnex A, normative
Processes, controls and systems. Requirements, not guidance, and each one has its own page.
Open Annex AWhat changed in 2019
The committee's own comparison of the 2011 and 2019 editions, with the old clause and its new home.
Read the comparisonThe ISO 30301:2019 text is not reproduced. The ISO/PRF 30301 text is not public and is not reproduced. The record this site reads is linked on the standards page.