We help organizations organize responsibilities, methods and traceable evidence for personal-data inventories, processing purposes, retention periods, rights requests and incident handling.
Service classification and standard position
Management system auditing (MS)
BSI's official catalogue lists BS 10012:2017+A1:2018 as withdrawn on 24 April 2026. This service focuses on reviewing an existing system, clarifying personal-data responsibilities and assessing alignment with ISO/IEC 27701. It does not promise a new certificate against the withdrawn edition.
Who should consider this and when
Suitable for organizations establishing PIMS processes, responding to customer requirements or preparing for external review. Confirm the intended use, organizational role, sites and reporting scope before selecting criteria.
Advisory focus
- Personal-data inventory: identify data categories, owners, locations and records.
- Processing purposes: document why data is collected and how it is used.
- Retention periods: define retention and disposal rules with responsible owners.
- Rights requests and incidents: establish processes, responsibilities, response records and escalation routes.
Support approach
- Confirm scope and criteria: discuss purpose, applicable requirements, boundaries and stakeholder expectations; record assumptions and exclusions.
- Review current state and gaps: examine data inventories, purposes, retention, rights requests and incident-handling records.
- Prepare documents and pilot: organize procedures, forms and an evidence index, then test the approach on a real request or incident scenario.
- Simulate review and improve: check consistency and evidence sufficiency against agreed criteria and track improvements. Confirm any independent third-party body and scope separately.
Information to prepare
- Organization and site details, personal-data processing activities and intended use.
- Data inventories, purpose records, retention schedules, request and incident records, and current procedures.
- Customer and applicable legal requirements, plus previous audit or review findings.
- Responsible departments, available staff, data gaps and target schedule.
Possible deliverables
Depending on scope: a gap list, work procedures, responsibility assignments, record forms, evidence index and improvement tracking. Technical reports and independent review are agreed separately at project start.
Timing and fees
Assessment depends on the number of sites, data quality, processing complexity and review scope. Existing information is reviewed first, then deliverables, resources and milestones are agreed.
Frequently asked questions
Does advisory support mean a certificate or assurance statement will be issued?
Advisory support helps prepare systems and evidence. Any certificate, verification or validation opinion is decided by a qualified and independent body under the applicable program. The withdrawn edition is not presented as a basis for a new certificate.
Must an existing system be rewritten?
First check whether current procedures and evidence remain applicable. Retain effective practices and revise identified gaps.