Draft International Standard · edition 2 · 27 pages
ISO 27555 revision: what changes, and when
The draft second edition of the guidance on deleting personally identifiable information keeps the 2021 structure and rewrites the parts that matter to a deletion procedure. This is the free clause-level record, the change map, and a dated check you can run in a minute.
The obligation kit is USD 799 one off. The change watch is USD 49 a month. The record and the check stay free.
Not legal advice; does not certify. The planning date is an estimate from the ISO stage.
The short answer
A draft that keeps the structure and moves the work
ISO/IEC DIS 27555 is the draft second edition of the guidance for developing and running policies and procedures for deleting personally identifiable information. It is in the enquiry phase, with the DIS ballot closed on 22 August 2026. The ISO record says it will replace ISO/IEC 27555:2021, and it names no publication date.
The public contents keeps ten clauses and 45 subclauses. That is the first useful fact for a team that already has a procedure: the clause map carries across, so the update is a re-read, not a rebuild. The second useful fact is where the wording moved. The scope now excludes the suitability of deletion processes as well as mechanisms. The introduction adds deletion or suspension on individual requests. The notes to the term deletion no longer carry the technical detail; it moves to clause 5.1 and the end of 9.1. Clause 4 adds solid state and write once media. Clause 5.1 names the mechanism families. Clause 5.3 adds notes on clusters as containers. Clause 5.4.2 talks about the deletion process. Clause 7.4.3 changes its subject. Clause 9 gains about three pages.
None of that is a new certification deadline, because there is no certification scheme. The date that matters is the one an organisation sets for its own policy update, and the date its auditor or customer expects the published replacement to be cited. The record here plans to 16 September 2027 as an estimate and says so on every page.
What changed
Eleven held changes, with the consequence of each
| Change | Was | Now | What it means |
|---|---|---|---|
| The contents keeps ten clauses and 45 subclauses | Edition 1 had ten clauses and 45 subclauses across about 25 pages. | The DIS keeps the same ten top level clauses and the same subclause count across 27 pages. | The revision is not a rebuild of the framework. A team can map its existing clause references across, then re-read the text for the wording changes. |
| Clause 1 widens the exclusion to deletion processes | The scope excluded the dependability, security and fitness of the deletion tools. | The DIS excludes the same test for the deletion process as well as for the tool. | The operating process, not only the tool, is outside the draft. An organisation still has to run it, and clause 9 is where the draft returns to implementation. |
| The introduction adds individual requests | The framework set out deletion applied in the same way across the organisation. | The framework adds the handling of a request from one person to delete, or to pause a deletion. | A policy that has no route for one person to ask for deletion or for a hold has a visible gap in the DIS. |
| The notes to deletion move the technical detail out | The definition notes described bit patterns, reconstruction effort and a risk based choice of method, and pointed to de-identification guidance. | The notes keep the synonyms and point the reader to clause 5.1, the end of clause 9.1 and the bibliography for mechanisms and their security. | Read clauses 5 and 9 together with the definition. The technical explanation has moved, so a policy that quotes only clause 3 will lose it. |
| Two storage terms are added | The abbreviation list covered discs, tapes and common file formats. | The DIS adds solid state disk and write once read many storage. | The medium inventory must include solid state and write once media. The deletion route for each is different. |
The clause record
One page for each of the ten clauses
- 1ScopeFull public text
- 2Normative referencesFull public text
- 3Terms and definitionsFull public text
- 4Symbols and abbreviated termsTitle coverage
- 5Framework for deletionPublic text to 5.5
- 6Clusters of PIITitle coverage
- 7Specification of deletion periodsTitle coverage
- 8Deletion classesTitle coverage
- 9Requirements for implementationTitle coverage
- 10ResponsibilitiesTitle coverage
Every page carries the citation, what the public sample holds, what to prepare, the evidence an auditor asks for, the tests to run and the gaps the public text leaves. The full contents of 55 headings is on the structure page.
The rules this is built from
Read from the real rules, not invented. Every clause answer points to the official record behind it, so you can check any line yourself. Where the public sample stops, the page says so and does not fill the gap.
The clause record is published on the compliance platform at compliance.theartofservice.com/frameworks/iso-iec-dis-27555. The related standards named in the record are ISO/IEC 27555:2021, ISO/IEC 29100, ISO/IEC 27701, ISO/IEC 27001, ISO/IEC 27002 and ISO/IEC 27557.
Two ways to use it
The record is free. The kit and the watch are not.
Deletion obligation kit
USD 799 one off
PDF, CSV and XLSX. 55 rows, seven artifacts, a dated plan.
- The 55 row obligation register, clause and subclause
- The evidence list with a named artifact per row
- The cluster, period and deletion class worksheets
- The 2021 to DIS change map
- A dated plan and a one page board brief
- A source and method note
Change watch
USD 49 a month
Or USD 490 a year, two months free.
- An email when the ISO stage or a date changes
- An email when the public contents or sample changes
- The field, the old value and the new one
- A link to the page that changed
- Cancel from the Stripe receipt, no retention flow
- No marketing, no newsletter
Prices are in US dollars. The kit is one payment. The watch is a separate subscription and is optional. See the labelled specimen before you buy.
The honest limit
What this record does not hold
The text of clauses 4 to 10 is not in the free public sample. The record holds the full contents, the foreword, the introduction, clauses 1 and 2, the ten defined terms, the start of clause 3 and clauses 5.1 to 5.5 from the public samples. It states every clause in our own words at the level the public material supports and marks the rest as title coverage. It never presents the contents as the requirement text.
It does not set a legal retention period, choose a deletion tool, de-identify a data set or certify an organisation. Those are outside the draft's scope and outside this product. Read the method or check the sources.
Questions
Questions buyers ask before they use the record
Is ISO/IEC DIS 27555 the current standard?
No. It is a Draft International Standard in the enquiry phase. ISO/IEC 27555:2021 remains the published edition, and the draft will replace it only when a new edition is published.
Is ISO 27555 certifiable?
No certification scheme is named on the ISO record. It is guidance for policies and procedures, not a management system standard with an accredited certificate. This site does not certify anyone.
When will the new edition be published?
The ISO record shows no publication date. This record plans to 16 September 2027, an estimate from the close of the DIS ballot on 22 August 2026. The next visible checkpoints are 40.92 or 40.93, 40.99, 50.00 and 60.60.
What changed from the 2021 edition?
The contents keeps ten clauses and 45 subclauses. The held changes sit in the wording: the scope widens to deletion processes, the introduction adds individual requests, the notes to deletion move the technical detail, two storage terms are added, and clause 9 gains space. The change page lists eleven held changes.
Does this site reproduce the standard?
No. Every requirement and evidence line is our own statement. Only clause titles and defined terms stay as the draft has them, and the licensed text is not reproduced.
What does the free check do?
Six questions produce a scope reading: the clauses in play, three priority actions, five evidence items and the dated checkpoints. It starts blank and returns scope incomplete until the questions are answered.