I thought the ISO 27001 Register of Requirements should contain only laws and regulations on information and data security such as Personal Data Protection. I have seen examples of Companies Act, Employment Act, Taxation Act, etc. included in the Register. Why are these included as they do not relate directly to information security?
Assign topic to the user
ISO 27001 DOCUMENTATION TOOLKIT
Step-by-step implementation for smaller companies.
Find out more 
ISO 27001 DOCUMENTATION TOOLKIT
Step-by-step implementation for smaller companies.
Find out more
ISO 27001 DOCUMENTATION TOOLKIT
Step-by-step implementation for smaller companies.
Find out more
Please note that information security is not related only to personal information. Some examples of information that also may require to be protected can be related to business information (e.g., strategic plans, product R&D information), and financial information (e.g., tax payment records).
Considering that, depending upon the Information Security Management System scope, besides Personal Data protection laws/regulations, organizations also may have to be compliant with other legal requirements (laws, regulations, or contracts) related to information, like the ones you mentioned.
Our recommendation is for you to consult a legal advisor in your country.
For further information, see:
- How to identify ISMS requirements of interested parties in ISO 27001 https://advisera.com/27001academy/blog/2017/02/06/how-to-identify-isms-requirements-of-interested-parties-in-iso-27001/
Comment as guest or Sign in
Dec 23, 2022