Free PECB ISO/IEC 27701 Foundation Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB ISO/IEC 27701 Foundation practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1What is the central purpose of a privacy information management system (PIMS)?

   1. A.To manage personally identifiable information responsibly within a structured frameworkCorrect answer: A
   2. B.To manage information security risks across all information assets
   3. C.To process individual transactions without ongoing privacy governance
   4. D.To set privacy obligations without managing their implementation

   Explanation: ISO describes a PIMS as "A privacy information management system (PIMS) is a structured framework for managing PII responsibly and in line with privacy laws and standards." The framework manages PII responsibly, rather than focusing solely on all information assets, individual transactions, or policy setting without implementation.

   Reference: ISO/IEC 27701:2025 — Privacy information management systems — FAQ, What is a PIMS?

2. 2How can an organization implement a PIMS under ISO/IEC 27701:2025 in relation to an ISO/IEC 27001 information security management system?

   1. A.As a standalone PIMS that must remain separate from an ISMS
   2. B.As a PIMS that depends on an ISO/IEC 27001-based ISMS
   3. C.As a standalone management system that can still align with ISO/IEC 27001Correct answer: C
   4. D.As an ISMS in place of a privacy management system

   Explanation: PECB states that "The 2025 edition of ISO/IEC 27701 introduces a stand-alone PIMS, no longer requiring ISO/IEC 27001-based security management." It also describes continuing alignment with management system structure, so independence does not prohibit integration.

   Reference: ISO/IEC 27701 Privacy Information Management System – Training Courses — What is ISO/IEC 27701?

3. 3In privacy terminology, who is the PII principal?

   1. A.The organization that determines why PII is processed
   2. B.The natural person to whom the PII relatesCorrect answer: B
   3. C.The provider that processes PII for a controller
   4. D.The authority that supervises privacy compliance

   Explanation: The ISO glossary defines the principal as the "natural person to whom the personally identifiable information (PII) (3.1.21) relates". The controller determines purposes and means, while a processor acts on a controller's behalf.

   Reference: SC 27 Committee Document 6: Glossary of IT Security Terminology — page 126, glossary entry: PII principal

4. 4In ISO/IEC 27701:2025, what is the main function of Annex A?

   1. A.To specify only the controls for PII processors
   2. B.To provide implementation guidance for PIMS reference controls
   3. C.To map PIMS requirements to the ISO/IEC 29100 privacy framework
   4. D.To supply reference control objectives and controls for PII controllers and processorsCorrect answer: D

   Explanation: PECB identifies Annex A as containing "the PIMS reference control objectives and controls for PII controllers and PII processors". The annex addresses both roles, not processors alone.

   Reference: Navigating the Transition: From ISO/IEC 27701:2019 to ISO/IEC 27701:2025 — ISO 27701:2025, Annex A (normative)

5. 5A company processes customer information on behalf of another organization and follows that organization's instructions. Which privacy role does the company perform for that processing?

   1. A.PII principal
   2. B.PII controller
   3. C.PII processorCorrect answer: C
   4. D.Privacy supervisory authority

   Explanation: ISO defines a processor as a "privacy stakeholder that processes personally identifiable information (PII) (3.7) on behalf of and in accordance with the instructions of a PII controller (3.8)". The company in the question performs that role for the specified processing.

   Reference: SC 27 Committee Document 6: Glossary of IT Security Terminology — page 127, glossary entry: PII processor

6. 6For a PIMS team using the reference controls in Annex A, what role does Annex B serve under ISO/IEC 27701:2025?

   1. A.It provides implementation guidance for the Annex A controlsCorrect answer: A
   2. B.It maps PIMS requirements to privacy principles in ISO/IEC 29100
   3. C.It supplies separate reference controls solely for processors
   4. D.It maps PIMS provisions to the General Data Protection Regulation

   Explanation: PECB says Annex B "provides implementation guidance for the PII controller and processor controls found in Annex A". It is guidance on implementing those controls rather than a processor-only list of control objectives.

   Reference: Navigating the Transition: From ISO/IEC 27701:2019 to ISO/IEC 27701:2025 — ISO 27701:2025, Annex B (normative)

7. 7What is the function of a privacy control in managing privacy risk?

   1. A.Identify and describe privacy risk sources and events
   2. B.Estimate the likelihood and impact of privacy risks
   3. C.Compare estimated risks with risk acceptance criteria
   4. D.Reduce the likelihood or consequences of privacy risksCorrect answer: D

   Explanation: The ISO glossary defines a privacy control as a "measure that treats privacy risks by reducing their likelihood or their consequences". Estimating likelihood and impact belongs to assessment, whereas a control is a treatment measure.

   Reference: SC 27 Committee Document 6: Glossary of IT Security Terminology — page 133, glossary entry: privacy control

8. 8When interpreting the ISO/IEC 27701:2025 Annex E mapping to other standards, what limitation should an organization keep in mind?

   1. A.The mapping establishes equivalence between corresponding provisions
   2. B.The mapping is indicative and does not imply equivalent provisionsCorrect answer: B
   3. C.The mapping prescribes a mandatory sequence for implementing controls
   4. D.The mapping determines the organization's complete legal obligations

   Explanation: PECB explains that the Annex E "mapping is indicative and does not imply equivalence between provisions". A correspondence between entries is therefore not proof of equivalence or automatic legal compliance.

   Reference: Navigating the Transition: From ISO/IEC 27701:2019 to ISO/IEC 27701:2025 — ISO 27701:2025, Annex E (informative)

9. 9Under ISO/IEC 29100, what does an opt-in process require the PII principal to do?

   1. A.Take an action to express explicit prior consent for a particular purposeCorrect answer: A
   2. B.Take an action to withdraw consent after processing has begun
   3. C.Allow processing unless the person files a separate objection
   4. D.Receive information about the processing without expressing a choice

   Explanation: ISO describes opt-in as requiring an "action to express explicit, prior consent (3.4) for their PII to be processed for a particular purpose". The action expresses consent beforehand; withholding or withdrawing consent is associated with opt-out.

   Reference: SC 27 Committee Document 6: Glossary of IT Security Terminology — Opt-in, ISO/IEC 29100:2024, 3.6

10. 10When defining the context of a PIMS, which factors should an organization consider?

    1. A.Internal policies and governance obligations, without external issues
    2. B.External legal and regulatory issues, without internal factors
    3. C.Relevant internal and external factors, including applicable governance obligationsCorrect answer: C
    4. D.Interested-party preferences, independently of the organization's context

    Explanation: PECB describes the need to consider "internal and external factors such as legal, regulatory, and governance obligations" when defining PIMS context. A context based on only one side or detached from the organization omits relevant factors.

    Reference: Navigating the Transition: From ISO/IEC 27701:2019 to ISO/IEC 27701:2025 — ISO 27701:2025, 4. Context of organisation