UNE-EN ISO/IEC 29151:2026

This Recommendation | International Standard establishes controls, purpose, and guidance for implementingcontrols, to meet the requirements identified by a risk and impact assessment related to the protection ofpersonally identifiable information (PII).In particular, this Recommendation | International Standard specifies guidance based on ISO/IEC 27002,taking into consideration the controls for processing PII that can be applicable within the context of anorganization's information security risk environment(s).This Recommendation | International Standard is applicable to all types and sizes of organizations acting asPII controllers (as defined in ISO/IEC 29100), including public and private companies, government entitiesand not-for-profit organizations that process PII, in particular, organizations that do not establish or operatea privacy information management system.