【前14篇免费】ISO/IEC 27701: 2019 标准详解与实施（195）8.5.6 用于处理个人身份信息（PII）的分包商的披露

原创

27001.CN
27001.CN

Sky的安全观

2026年1月3日 15:44
广东

在小说阅读器读本章

去阅读

点击上方蓝色字“Sky的安全观”关注我们

资料交流，请私“加群”

>>ISO系列标准解读合集<<

ISO/IEC 27001: 2022 标准详解与实施合集（共42篇）

ISO/IEC 27001: 2013 标准详解与实施合集（共47篇）

ISO/IEC 20000-1: 2018 标准详解与实施合集（共48篇）

ISO 22301: 2019 标准详解与实施合集（共38篇）

ISO 9001: 2015 标准详解与实施合集（共45篇）new!

ISO 14001: 2015 标准详解与实施合集（共26篇）new!

ISO 45001: 2018 标准详解与实施合集（共30篇）new!

>>更多精彩合集，敬请期待<<

ISO/IEC 27001: 2022 换版不求人

ISO/IEC 27001: 2022 咨询辅导服务内容

华为供应链信息安全审核应对方案

华为供应链网络安全审核应对方案

独家：ISO/IEC 27001: 2022全新文件提供和指导

【直播预告】企业信息安全负责人必修系列课程（第一季）


8 Additional ISO/IEC 27002 guidance for PII processors 附加到ISO/IEC 27002的个人身份信息（PII）处理者的指南/8.5 PII sharing, transfer, and disclosure 个人身份信息的共享，转移和披露/8.5.6 Disclosure of subcontractors used to process PII 用于处理个人身份信息（PII）的分包商的披露
8.5.6 Disclosure of subcontractors used to process PII 用于处理个人身份信息（PII）的分包商的披露 Control 控制 The organization should disclose any use of subcontractors to process PII to the customer before use. 组织应在使用前向顾客披露所有处理个人身份信息（PII）的分包商的使用。 Implementation guidance 实施指南 Provisions for the use of subcontractors to process PII should be included in the customer contract. 处理个人身份信息（PII）的分包商使用的规定宜被包含在顾客的合同中。 Information disclosed should cover the fact that subcontracting is used and the names of relevant subcontractors. The information disclosed should also include the countries and international organizations to which subcontractors can transfer data (see 8.5.2) and the means by which subcontractors are obliged to meet or exceed the obligations of the organization (see 8.5.7). 披露的信息宜涵盖分包被使用的事实和相应分包商的名称。披露的信息也宜包含分包商可以将数据转移到的国家和国际组织（见8.5.2），以及分包商有义务履行或超越组织义务的方法（见8.5.7）。 Where public disclosure of subcontractor information is assessed to increase security risk beyond acceptable limits, disclosure should be made under a non-disclosure agreement and/or on the request of the customer. The customer should be made aware that the information is available. 若经过评估，分包商信息的公开披露所增加的风险超出可接受的限度，披露宜在保密协议下进行，和/或应顾客的请求进行。宜让顾客指导这些信息是可获得的。 This does not concern the list of countries where the PII can be transferred. This list should be disclosed to the customer in all cases in a way that allows them to inform the appropriate PII principals. 此处不关注个人身份信息（PII）可能被转移到的国家的列表。在所有情形下，该列表宜被披露给顾客，并允许其通知到适宜的个人身份信息（PII）主体。

8 Additional ISO/IEC 27002 guidance for PII processors 附加到ISO/IEC 27002的个人身份信息（PII）处理者的指南/8.5 PII sharing, transfer, and disclosure 个人身份信息的共享，转移和披露/8.5.6 Disclosure of subcontractors used to process PII 用于处理个人身份信息（PII）的分包商的披露

8.5.6 Disclosure of subcontractors used to process PII 用于处理个人身份信息（PII）的分包商的披露 Control 控制 The organization should disclose any use of subcontractors to process PII to the customer before use. 组织应在使用前向顾客披露所有处理个人身份信息（PII）的分包商的使用。 Implementation guidance 实施指南 Provisions for the use of subcontractors to process PII should be included in the customer contract. 处理个人身份信息（PII）的分包商使用的规定宜被包含在顾客的合同中。 Information disclosed should cover the fact that subcontracting is used and the names of relevant subcontractors. The information disclosed should also include the countries and international organizations to which subcontractors can transfer data (see 8.5.2) and the means by which subcontractors are obliged to meet or exceed the obligations of the organization (see 8.5.7). 披露的信息宜涵盖分包被使用的事实和相应分包商的名称。披露的信息也宜包含分包商可以将数据转移到的国家和国际组织（见8.5.2），以及分包商有义务履行或超越组织义务的方法（见8.5.7）。 Where public disclosure of subcontractor information is assessed to increase security risk beyond acceptable limits, disclosure should be made under a non-disclosure agreement and/or on the request of the customer. The customer should be made aware that the information is available. 若经过评估，分包商信息的公开披露所增加的风险超出可接受的限度，披露宜在保密协议下进行，和/或应顾客的请求进行。宜让顾客指导这些信息是可获得的。 This does not concern the list of countries where the PII can be transferred. This list should be disclosed to the customer in all cases in a way that allows them to inform the appropriate PII principals. 此处不关注个人身份信息（PII）可能被转移到的国家的列表。在所有情形下，该列表宜被披露给顾客，并允许其通知到适宜的个人身份信息（PII）主体。

【标准理解】

（1）ISO/IEC 27701: 2019条款8.5是属于隐私信息的共享、转移和披露管理过程，因此可以将8.5中的所有子条款要求合并在一起进行实施。