Home / Answers / What changed in the ISO 27555 revision?
Answer · from the public record
What changed in the ISO 27555 revision?
The draft keeps ten clauses and 45 subclauses but moves the wording. The scope now covers deletion processes as well as mechanisms, the introduction adds individual requests, the technical notes move from the definition to clause 5.1, two storage terms are added, clause 7.4.3 changes subject, and clause 9 grows by about three pages.
Last updated: 2026-10-22. Evidence level: public record and public sample. The licensed text is not reproduced.
The structure carries across
The public contents of the DIS names the same ten clauses and the same 45 subclauses as the 2021 edition. That is the first fact a team needs, because it means an existing clause map can be reused. The update is a re-read of the text, not a rebuild of the framework. The page count moves from 25 to 27, and the extra pages sit mainly in clause 9.
The scope widens
The 2021 scope excluded the reliability, security and suitability of deletion mechanisms. The DIS excludes the reliability, security and suitability of deletion processes as well as mechanisms. Read alone, that looks like a narrow wording change. Read with clause 9, it says the operating process is outside the guidance but still the organisation's responsibility.
The definition notes move the technical detail
In the 2021 edition the notes to deletion described bit patterns, reconstruction effort and a risk based choice of method. The DIS keeps the synonyms and points the reader to clause 5.1, the end of clause 9.1 and the bibliography. A policy that quotes only clause 3 will lose the technical explanation.
Clause 5 is sharpened
Clause 5.1 adds a description of mechanism families: overwriting, device commands, encryption with key destruction and physical destruction. Clause 5.3 adds notes that clusters are logical containers and that a rule generally stays stable until purpose or law changes. Clause 5.4.2 expresses the outer period in terms of the deletion process and the maximum acceptable time for it.
Clause 7.4.3 changes subject
The 2021 heading was the need to extend the period of active use. The DIS heading is delayed deletion by allocation to another cluster of PII. A policy that still uses the old heading has not caught up with the structure, even though the surrounding clause numbers are unchanged.
Clause 9 gains the space
The clause moves from about five pages to about eight. The organisation wide list, the individual system requirements, manual processes, processors, exception management and the individual request route all sit there. If a team budgets only a document rewrite, clause 9 is where the budget will be wrong.
Check the source. The full record, the stage trail and the clause pages are free. Start with the full change ledger.