Privacy management on the same footing as security.
ISO/IEC 27701:2025 is a privacy information management system in its own right. The workspace runs it on the same registers as your ISMS, adds the records UU PDP (Law No. 27 of 2022) asks for, and tracks every privacy deadline in days or hours.
Supported in
- Book with Jakarta (WhatsApp)
Indonesia · Whitesec ID, Jakarta
Includes the UU PDP compliance register, for organisations processing personal data in Indonesia.
About the standard
ISO/IEC 27701 sets the requirements for a privacy information management system (PIMS) for organisations acting as PII controllers, PII processors or both. The 2025 edition is a management system standard in its own right, with Annex A controls for controllers, for processors, and for security that applies to both roles.
In Indonesia the same records answer Law No. 27 of 2022 on Personal Data Protection (UU PDP): records of processing, data protection impact assessments, data subject requests, breach notification within 3 x 24 hours and the conditions for transferring personal data abroad.
What the workspace does
PIMS readiness by clause
The privacy overview rates clauses 4 to 10 from fixed checks, such as a declared PII role, a named DPO, an approved PIMS Statement of Applicability, completed DPIAs, a signed DPA with every active processor, and no overdue request or breach notice.
Records of processing
Each activity with its purpose, lawful basis under UU PDP Article 20 or GDPR Article 6, data subjects and categories, specific personal data, role, retention, recipients and transfers outside Indonesia, reviewed every 12 months by default.
DPIAs that flag themselves
UU PDP Article 34 triggers such as specific data, large scale and systematic monitoring mark an assessment high-risk, a very high residual risk without prior consultation is flagged, and completion is approved by a second person.
Requests on the statutory clock
Deadlines are computed for you: 3 days under UU PDP for rectification, access, restriction and withdrawal of consent, otherwise 30 days, and no work starts until the subject's identity is verified.
Breach notification in hours
Each breach file opens a 72-hour (3 x 24 hours) clock from discovery for every notice that applies, to the agency and to data subjects under UU PDP and to the authority under GDPR, and closing the file needs a second person.
UU PDP compliance register
48 articles of Law No. 27 of 2022 across data subject rights, legal basis and consent, controller obligations, cross-border transfer and classification, each with a status, owner, actions and evidence, and a compliance percentage per chapter.
How the workspace runs it
Group by group, in the order the application presents them, with the pages each group contains.
- 01
Context
PIMS governance: the organisation's PII role as controller, processor or joint controller, the PIMS scope, and the privacy roles from DPO and privacy lead to legal counsel and an EU or UK representative.
- PIMS governance
- 02
Planning
Privacy risks drawn from the shared risk register wherever the impact on PII principals is above None, the PIMS Statement of Applicability for the 78 Annex A controls, and the DPIA register.
- Privacy risk assessment
- PIMS Statement of Applicability
- DPIA register
- 03
Registers
Records of processing, consent mechanisms and notice versions, retention schedules with a verified deletion log, cross-border transfers under UU PDP Article 56, and PII processors and DPAs read from the supplier register.
- Records of processing
- Consent and notices
- Retention and disposal
- Cross-border transfers
- PII processors and DPAs
- 04
Operations
Data subject requests with computed deadlines, privacy incidents from the shared incident register, and breach notification files with their hour-based clocks.
- Data subject requests
- Privacy incidents
- Breach notification
- 05
Assurance
Privacy audits drawn from the internal audit programme, and the UU PDP compliance register with its score per chapter.
- Privacy audits
- UU PDP compliance
Controls built into the workspace
Rules the application enforces, so the records stand up when an auditor tests them.
- A second person approves DPIA completion, each PIMS Statement of Applicability version, a rejected data subject request and the closure of a breach file.
- A deletion is verified by someone other than the person who deleted, and the date the subject was told is recorded.
- Work on a data subject request cannot start before the subject's identity is verified.
- A transfer that relies on consent must record how that consent was obtained.
- Viewers see data subject names, request details and contact details masked by the database.
What you hand the auditor
- Records of processing activities
- DPIA register with DPO opinion
- PIMS Statement of Applicability, versioned
- Data subject request register
- Breach notification files
- UU PDP compliance register
Shared with the other workspaces
Privacy risks come from the shared risk register, privacy incidents from the incident register, privacy audits from the internal audit programme, and PII processors from the supplier register the ISO 27001 and SOC 2 workspaces use.
Questions about ISO 27701
Does the workspace cover UU PDP as well as ISO 27701?
Yes. Records of processing, DPIAs, data subject requests, breach notification and transfers carry the UU PDP article they answer, and a separate register tracks 48 articles of Law No. 27 of 2022.
Does it record each individual's consent?
No. The consent register holds your consent mechanisms and notice versions, not each person's consent, which stays in the systems where it is collected.
We are a processor. Does that change anything?
Declare your role in PIMS governance. The Annex A tables for controllers, processors and both roles are all available, and each record of processing notes the controllers you serve and your sub-processors.
See your own registers in Whitesec One.
We walk through the workspaces for the frameworks you need, with the team in Jakarta or Perth.