Free readiness test
ISO/IEC 27701:2025 Lead Auditor: 40 free scenario questions
Audit privacy information management systems for PII controllers and processors, including GDPR and India DPDP Act mapping.
Reviewed by cyber security professionals with 25+ years of experience each.
Sign up free to startScenario
A payroll services company seeks PIMS certification and describes itself only as a 'PII processor' for its 600 employer clients. During stage 1 you find that it also runs a salary-benchmarking product that combines payroll data from all clients, decides which fields to use, sells the resulting reports to HR consultancies, and markets 'insights' to employees through a mobile app that collects location and device data. The company's records of processing list only payroll processing on clients' instructions. Its privacy notice for the app is a single paragraph copied from a template. The privacy manager says benchmarking is 'just analytics on anonymised data', but the reports allow filtering by employer, job title and city, and some cells contain fewer than three employees. Two clients have asked whether their data is used for anything other than payroll.
What should the lead auditor conclude at stage 1?
- AThe processor role is acceptable because the company signs processing agreements with all employers.
- BRoles are wrongly determined; it is a controller for some processing.
- CBenchmarking should be excluded because the data is anonymised.
- DThe company must stop the benchmarking product before the audit can continue.