Sign in

ISO 29100

ISO/IEC 29100 Privacy Framework — ISO/IEC JTC 1/SC 27

Also known as: ISO/IEC 29100, ISO 29100:2024, ISO 29100:2011, ISO IEC 29100, Privacy Framework

Official site Official change log Subscribe to ISO 29100 (RSS)

This is a paid standard. We publish the fact of a change, its version and date, and a link to the publisher — the text itself is not reproduced.

Current version
ISO/IEC 29100:2024
Published 16 February 2024. source
Status
In force
Next deadline
None announced
Who must comply
People and organizations that specify, procure, design, develop, test, operate or maintain ICT systems or services where privacy controls are needed for processing PII. source
How it is assessed
A framework of privacy terms, roles and principles, applied through other standards such as ISO/IEC 27018. source
Written by
Published jointly by ISO and IEC (committee ISO/IEC JTC 1/SC 27, working group 5) as voluntary guidance. source source source
Enforced by
A voluntary standard; it sets no contractual, legal or statutory requirements. source
Last change
None recorded yet

The vocabulary layer of the ISO privacy family: it names the actors (PII principal, controller, processor) and the privacy principles that ISO 27701 and ISO 29134 then build on. Cited far more often than it is read, because it is what the other privacy standards mean by their own terms.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates
  1. ISO/IEC 29100:2024 is published and the 2011 edition is withdrawn

Version history

  1. ISO/IEC 29100:2024 Major versionCurrent

    Second edition; replaced the 2011 edition and its 2018 amendment. source

  2. ISO/IEC 29100:2011/Amd 1:2018 Amendment

    Amendment 1 to the 2011 edition, titled "Clarifications". source

  3. ISO/IEC 29100:2011 Major version

    First edition; withdrawn on 16 February 2024. source

Who it applies to

Anyone who builds, buys or runs ICT systems that process personal data and need privacy controls. It is voluntary guidance.

What it provides
A common privacy terminology, the actors and their roles in processing PII, privacy safeguarding considerations and references to known privacy principles for IT. source
Who it is for
Natural persons and organizations involved in specifying, procuring, architecting, designing, developing, testing, maintaining, administering and operating ICT systems or services that process PII. source
Used by
ISO/IEC 27018 sets its cloud controls in line with the privacy principles of ISO/IEC 29100. source
Legal status
ISO standards are voluntary and contain no contractual, legal or statutory requirements; national laws take precedence. source

How compliance is assessed

A framework of privacy terms, roles and principles, applied through other standards such as ISO/IEC 27018.

Framework
It specifies a common privacy terminology, defines the actors and their roles in processing PII and references known privacy principles. source
Applied through
ISO/IEC 27018 builds its guidelines for public cloud PII processors on the ISO/IEC 29100 privacy principles. source

Enforcement and penalties

A voluntary standard; it sets no contractual, legal or statutory requirements.

Legal force
ISO standards are voluntary and contain no contractual, legal or statutory requirements. source

Documents

  1. Standard ISO/IEC 29100:2024 (catalogue entry; paid standard)
  2. Standard ISO/IEC 29100:2011/Amd 1:2018 Clarifications (withdrawn, catalogue entry)

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to ISO 29100 (RSS)