Privacy

October 27 2025

ISO/IEC 27701:2025 – A Major Step Forward for Privacy Management

Saritha KPrivacy, Privacy Risk

AI & Privacy - Slider Images - Axiom - Privacy Management - Axiom Solutions

AI & Privacy - Slider Images - Axiom - Axiom Solutions - Privacy Management

AI & Privacy - Slider Images - Axiom - Privacy Management Slider 3 - Axiom Solutions

Blog Author - Saritha - Axiom Solutions - 1

Saritha K

Introduction

ISO has refreshed its global privacy standard with the release of ISO/IEC 27701:2025 on October 14, 2025. This latest update strengthens how organizations manage and protect personal data, ensuring better alignment with today’s privacy and security expectations.

A Standalone Privacy Standard

The most significant update is that ISO 27701 is now a standalone Privacy Information Management System (PIMS) standard. Unlike the 2019 edition, it no longer requires ISO 27001 as a prerequisite. Organizations can now directly pursue privacy certification without needing a full Information Security Management System in place.

Clearer Privacy Roles and Structure

The new edition reinforces clear privacy roles and responsibilities for both PII controllers and PII processors. The structure is redesigned to align with the Annex SL framework used by other ISO management system standards, making integration simpler and supporting compliance with regulations like GDPR and CCPA. It also reflects evolving technology environments such as cloud and AI-driven processing.

Updated Annexes for Guidance

The 2025 edition includes:

Annex A – PIMS control objectives and controls for PII controllers and processors
Annex B – Implementation guidance for applying these controls effectively

Transition Planning

Certification bodies will soon announce the official transition timelines for organizations currently certified under ISO 27701:2019. This is the right time to review current practices, identify gaps, and prepare for a smooth transition.

Conclusion

ISO/IEC 27701:2025 brings stronger clarity, flexibility, and accountability to privacy management. With heightened global focus on personal data protection, this update helps organizations build trust and stay compliant. Planning early will ensure a seamless shift to the updated standard and continued confidence in privacy governance.

May 30 2025

Understanding AI and Privacy Risks

Saritha KPrivacy, Privacy Risk

Saritha K

Let’s be honest—Artificial Intelligence (AI) isn’t some far-off, futuristic concept anymore. It’s already woven into the fabric of our everyday lives and workplaces. Whether it’s your favourite music app suggesting a new playlist, your email finishing your sentences, or your virtual assistant setting reminders, AI is quietly doing a lot behind the scenes.

And while it’s exciting (and honestly, pretty convenient), there’s something we all need to talk about: privacy.

AI Is Everywhere – Even If You Don’t Realize It.

Most of us use AI without even thinking about it. Siri, Alexa, Netflix, Google Maps—yep, all powered by AI. And in the workplace, it’s popping up in even more places:

Screening job applications
Handling customer service chats
Detecting fraud
Analysing business data
Summarizing long documents or generating content

The thing is, AI doesn’t just run on code—it runs on data. And some of that data can be very personal. Where Privacy Risks Creep In!!!

Here are a few ways AI can put your privacy at risk, often without you even realizing it:

1. You might be sharing Private Data: People accidentally share confidential information when using a chatbot to make our job easy which may include work email or personal email for drafting, health report for interpretation, our travel report for summarizing, our biodata for formatting or improving. The AI chatbot works only with huge data which we upload.

2. Your data might not be fully anonymous: Even if names and emails are stripped out, clever AI systems might still find a piece of information to find someone. Example: Barcode on the report, UHID, Location etc.,

We would sometimes even paste something into an AI tool to just to get a quick answer. Using unapproved AI tools at work without official oversight can lead to serious data leaks.

3. AI-generated data or reports are not always accurate. A few of our trainees uploaded case studies into an AI tool and received completely incorrect responses. One of my friends used the tool to interpret a lab report and ended up with a wrong diagnosis. Another friend requested a personalized diet chart, but the AI-generated plan did not meet her specific needs. These outputs are often generalized, based on historical data from the AI’s repository, and lack the customization required for individual cases.

So, what should we do?

We don’t have to stop using AI—but we should use it responsibly. Here are some simple but powerful ways to protect your privacy:

1. Increase your awareness: Understand how AI tools work, what kind of data they collect, potential risks. A little awareness goes a long way. Create a digital hygiene practice.

2. Use Approved Tools or Licensed versions: If you’re using AI at work, make sure it’s been vetted by your organization or get the licensed copies. Avoid copying sensitive data into random free tools.

3. Be Smart About Your Data: Before you share anything with an AI platform, ask yourself: “Would I be okay if this got out?” If the answer is no, don’t share it.

4. Be Aware of the Regulations: AI vendors use your data to train future models. Always read the privacy policies. And follow regulations like GDPR, HIPAA or DPDP Act.

5. Use AI—But Use It Wisely: AI can be your good friend. It can save you time, reduce manual work, and even spark creativity.

6. Treat AI suggestions as a starting point and not the final answer. Human supervision is essential.

7. Always Verify with experts especially for medical, legal, or technical decisions.

By staying informed and mindful, we can enjoy the benefits of AI without putting our data or anyone else’s at risk.

Because in the end, it’s not just about technology. It’s about trust.

March 25 2024

Importance of Privacy Policy

Saritha KPrivacy, Privacy Policy

Privacy Policy - Blog - Axiom Solutions - 1

Privacy Policy - Blog - Axiom Solutions - 2

Privacy Policy - Blog - Axiom Solutions - 3

Saritha K

In today’s digital age, privacy has become a crucial aspect for individuals and organizations. As an auditor and consultant of privacy policies I have observed two prevailing approaches at two different extremes with the likelihood of jeopardising the privacy at some level. One approach is to consider all privacy-related risks as accepted risks and not implement any controls, while the other approach is to mask all data without understanding its purpose, which may not be healthy for the organization. In this article, we will discuss the importance of striking a balance between protecting personal information and providing access to data for business purposes.

The Importance of a Privacy Policy:

A privacy policy is an essential part of any organization that deals with personal information/data. Its purpose is to keep the information/data accurate and accessible only to authorized people and prevent unauthorized use or disclosure. A privacy policy helps stakeholders at three different levels – to understand what, why, and how data is collected; to act as a guidance manual for the protection of privacy, and to manage, update, export, and delete information/data.

However, the implementation of privacy standards is often driven by individual consultants’, level of understanding and ease of implementing standards, which can lead to flawed practices. Therefore, organizations need to consider the type and extent to which privacy standards could be applied based on their business nature, type of clients, legal requirements, and contractual obligations.

Balancing Privacy and Business Needs:

It is essential to establish a privacy approach that strikes a balance between protecting personal information and providing access to data for business purposes.

If an organization neglects to prioritize privacy protection for logistical and practical convenience, it can lead to severe repercussions. The risks include data breaches that compromise sensitive information, erosion of customer trust, legal and regulatory issues resulting in fines and penalties, financial consequences such as legal expenses and compensation pay-outs, limited business opportunities and partnerships, employee dissatisfaction and ethical concerns.

Protecting privacy while ensuring access to information for business operations requires implementing a thoughtful approach to data handling and ensuring compliance with privacy regulations.

Some of the measures that could help in materializing this are discussed below:

Organizations may opt for data minimization by refraining from storing excessive or unnecessary personal information that could pose a privacy risk.
Implementing data security measures which includes encryption, access controls, firewalls, intrusion detection systems, and regular security audits could be a salient measure.
Conducting periodic audits and privacy impact assessments to evaluate data handling practices, identify potential vulnerabilities, and ensure compliance with privacy regulations is also vital.
Training employees on privacy best practices which includes data handling and security measures and fostering a culture of organizational privacy among the employees is also identified as a sustainable solution.

Therefore a strong and comprehensive privacy policy is vital to protect personal information/data while providing access to it for business purposes. It can help organizations prevent fraud and discrimination, and ensure fair treatment of individuals.

Conclusion:

In conclusion, a privacy policy which is tailored for establishing an equilibrium between protecting personal information and providing access to data for business purposes can facilitate the organizations to achieve their business goals while maintaining their customers’ trust and protecting them from potential risks. A comprehensive approach that ensures the accuracy, quality, accessibility, and management of information/data will result in developing a robust privacy policy for an organization.