ISO/IEC 29134:2023 情報技術 — セキ​​ュリティ技術 — プライバシー影響評価のガイドライン | ページ 6

3.1

acceptance statement

formal management declaration to assume responsibility for risk ownership, risk treatment and residual risk

3.2

asset

things that have value to anyone involved in the processing of personally identifiable information (PII)

Note 1 to entry: In the context of a privacy risk management process, an asset is either PII or a supporting asset.

3.3

assessor

person who leads and conducts a privacy impact assessment (3.7)

Note 1 to entry: The assessor may be supported by one or more other internal and/or external experts as part of their team.

Note 2 to entry: The assessor may be an expert internal or external to the organization.

3.4

process

set of interrelated or interacting activities which transforms inputs into outputs

[SOURCE:ISO/IEC 27000:2018, 3.54]

3.5

device

combination of hardware and software, or solely software, that allows a user to perform actions

3.6

privacy impact

anything that has an effect on the privacy of a PII principal and/or group of PII principals

Note 1 to entry: The privacy impact can result from the processing of PII in conformance or in violation of privacy safeguarding requirements.

3.7

privacy impact assessment

PIA

overall process of identifying, analysing, evaluating, consulting, communicating and planning the treatment of potential privacy impacts with regard to the processing of personally identifiable information, framed within an organization’s broader risk management framework

[SOURCE:ISO/IEC 29100:2011, 2.20, modified — Note 1 to entry has been deleted.]

3.8

privacy risk map

diagram that indicates the level of impact and likelihood of privacy risks identified

Note 1 to entry: The map is typically used to determine the order in which the privacy risks should be treated.

3.9

programme

group of projects managed in a coordinated way to obtain benefits not available from managing them individually

[SOURCE:ISO 14300-1:2011, 3.2]

3.10

project

unique process, consisting of a set of coordinated and controlled activities with start and finish dates, undertaken to achieve an objective conforming to specific requirements, including the constraints of time, cost and resources

[SOURCE:ISO 9000:2015, 3.4.2]

3.11

organization

person or group of people that has its own functions with responsibilities, authorities and relationships to achieve its objectives

Note 1 to entry: The concept of organization includes but is not limited to sole-trader, company, corporation, firm, enterprise, authority, partnership, charity or institution, or part or combination thereof, whether incorporated or not, public or private.

[SOURCE:ISO/IEC 27000:2018, 3.50]

3.12

severity

estimation of the magnitude of potential impacts on the privacy of a PII principal

3.13

system

information system

set of applications, services, information technology assets, or other information handling components

[SOURCE:ISO/IEC 27000:2018, 3.36, modified —"system" has been added as a preferred term.]

3.14

stakeholder

person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity

Note 1 to entry: Includes personally identifiable information principals, management, regulators and customers.

Note 2 to entry: Consultation with stakeholders is integral to a privacy impact assessment.

[SOURCE:ISO 37000:2021, 3.3.1, modified — Notes 1 and 2 to entry have been modified.]

3.15

technology

hardware, software, and firmware systems and system elements including, but not limited to, information technology, embedded systems, or any other electro-mechanical or processor-based systems

[SOURCE:ISO/IEC 16509:1999, 3.3]