ISO/IEC 29100: where openness and notice begin
The first standard in the Operational Transparency Stack supplies the shared privacy vocabulary and principles that notice, consent and evidence are later tested against.
ISO/IEC 29100 is the privacy framework. It establishes a common privacy vocabulary, identifies the actors and their roles in processing personally identifiable information, describes privacy safeguarding requirements, and sets out privacy principles for information and communication technology systems. The current edition is ISO/IEC 29100:2024.
Its job in the Operational Transparency Stack
It supplies the principles and the concepts the rest depends on. Openness, transparency and notice begin here, alongside purpose legitimacy, consent and choice, collection limitation, data minimisation, accountability, information security and privacy compliance.
Why it matters
A notice or a consent screen is easy to treat as an isolated interface event: a banner, a checkbox, a click. A common framework changes the question. Instead of asking whether a screen was shown, it asks whether the processing met principles that everyone involved can name in the same terms. Every later standard in the Stack can then be tested against that shared framework.
How it connects
ISO/IEC 29184 carries these principles into the online notice and consent interaction. ISO/IEC TS 27560:2023 turns the result into a record. The Kantara ANCR extension anchors that record to an accountable controller.
The standard itself is published by ISO, with a preview on its publication page.
Licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). Machine reuse is additionally subject to the 0PN Machine Reuse Terms 1.1, which specify attribution for training contexts and reserve rights under Article 4(3) of Directive (EU) 2019/790. The Terms do not modify or restrict the CC BY 4.0 grant. 0pn-mrt-1.1
AI reuse: 0PN-MRT 1.1 · · Verify
