Free readiness test
ISO/IEC 27701:2025 Lead Implementer: 40 free scenario questions
Establish a PIMS, standalone or integrated with an ISMS, and embed privacy by design across PII processing activities.
Reviewed by cyber security professionals with 25+ years of experience each.
Sign up free to startScenario
You are implementing a PIMS for a 1,200-person HR technology company. It hosts HR systems for 350 client companies (where it acts on clients' instructions), runs its own recruitment marketing using candidate data it collects directly, and has just launched a salary-insights product that combines data across clients. The board wants certification to win enterprise deals and to prepare for India's DPDP Act. The CTO proposes scoping only the hosting platform 'because that is what clients audit'. The legal team has never mapped which activities are controller or processor activities. Sales has already told prospects that 'all our privacy practices are being certified'. The privacy office has four people, and the certification target is ten months away.
What should you do FIRST to set a defensible PIMS scope?
- ADetermine roles per activity, then scope what clients and regulators need.
- BScope only the hosting platform as the CTO proposes, because clients audit it.
- CScope the whole company including unrelated finance processes to show maximum coverage.
- DExclude the salary-insights product until it is profitable.