PIMS context — Clauses 4-5 management system context and leadership
Primary statement
PIMS context per ISO 27701 Clauses 4-5: determine external/internal issues, interested parties, scope, role determination (controller/processor/joint), leadership commitment, roles assignment. DPDPA grievance redressal (DPDP.10) layered on top.
Audit-fatigue payoff
A single PIMS context document + scope statement + role determination + leadership commitment evidence satisfies the foundational requirements for ISO 27701 certification audit.
Strictness matrix
Scope
Scope: external and internal issues + interested parties + PII processing landscape determined and documented.
Ceiling source: iso27701:4.1
Rationale: ISO 27701 4.1 sets the foundational scope.
Threshold
Threshold: PIMS scope documented with role determination (controller, processor, or joint). Role determination is the binary qualifier driving subsequent Annex A control selection.
Ceiling source: iso27701:4.3
Rationale: ISO 27701 4.3 role determination is the binary threshold.
Method
Method: top management leadership commitment + privacy policy + PIMS objectives + organisational role assignment (5.3) + grievance officer publication (DPDPA DPDP.10).
Ceiling source: iso27701:5.1
Rationale: ISO 27701 5.x with DPDPA DPDP.10 grievance officer is the most prescriptive.
Frequency
Context review: annual minimum + on material change. Leadership commitment: continuous.
Ceiling source: iso27701:4.1
Rationale: Annual context review is the floor.
Evidence
Required evidence: PIMS scope document with role determination, context analysis, interested parties register, leadership commitment minutes, organisational roles, grievance officer publication.
Ceiling source: iso27701:4.3
Rationale: ISO 27701 4.3 evidence is comprehensive for certification.
Auditor test pattern
Step 1: Inspect PIMS scope and role determination. Step 2: Verify context analysis. Step 3: Inspect leadership commitment evidence. Step 4: Verify roles assigned and communicated. Step 5: Verify grievance officer published per DPDPA.
Common findings
Common findings: (1) Role determination ambiguous; (2) Context analysis stale; (3) Leadership commitment formal not substantive; (4) Grievance officer details not publicly accessible.