What changed in the ISO 27555 draft

Eleven held changes between the public sample of the 2021 edition and the public sample of the DIS. Each entry gives the old position, the new position and what it means for a deletion procedure. The comparison is of the public samples, not the licensed full texts.

The stage trail

Where the draft stands, and what comes next

From the ISO life cycle. An empty date means ISO has not recorded it.
Stage	Step	Date	Basis
10.99	New project approved	2025-09-26	Recorded on the ISO page
30.99	CD approved for registration as DIS	2025-09-26	Recorded on the ISO page
40.00	DIS registered	2026-03-26	Recorded on the ISO page
40.20	DIS ballot initiated: 12 weeks	2026-05-29	Recorded on the ISO page and the public sample
40.60	Close of voting	2026-08-22	Recorded on the ISO page; current stage
40.92	Full report circulated: DIS referred back to TC or SC	Not recorded	Not recorded
40.93	Full report circulated: decision for new DIS ballot	Not recorded	Not recorded
40.99	Full report circulated: DIS approved for registration as FDIS	Not recorded	Not recorded
50.00	Final text received or FDIS registered for formal approval	Not recorded	Not recorded
50.20	Proof sent to secretariat or FDIS ballot initiated: 8 weeks	Not recorded	Not recorded
50.60	Close of voting. Proof returned by secretariat	Not recorded	Not recorded
60.00	International Standard under publication	Not recorded	Not recorded
60.60	International Standard published	Not recorded	Not recorded; 2027-09-16 is a planning estimate

The record stands at stage 40.60, close of voting, on 22 August 2026. The planning date used on this site is 16 September 2027, about fifteen months after the close of the ballot. It is an estimate and not an ISO date. The public checkpoints still to come are 40.92 or 40.93 if the DIS is referred back, 40.99 if it is approved for registration as an FDIS, 50.00 for the final text and 60.60 for publication.

No certification transition. The ISO record names no certification scheme for this document. It is guidance for policies and procedures, not a management system standard. There is no accreditation deadline and no transition audit. The date that matters is the one your organisation sets for its own policy update, and the date your auditor or customer expects the published replacement to be cited.

The change ledger

Eleven held changes

Was, now, and what it means.
Change	Was	Now	What it means
The contents keeps ten clauses and 45 subclauses structure	Edition 1 had ten clauses and 45 subclauses across about 25 pages.	The DIS keeps the same ten top level clauses and the same subclause count across 27 pages.	The revision is not a rebuild of the framework. A team can map its existing clause references across, then re-read the text for the wording changes.
Clause 1 widens the exclusion to deletion processes text	The scope excluded the dependability, security and fitness of the deletion tools.	The DIS excludes the same test for the deletion process as well as for the tool.	The operating process, not only the tool, is outside the draft. An organisation still has to run it, and clause 9 is where the draft returns to implementation.
The introduction adds individual requests text	The framework set out deletion applied in the same way across the organisation.	The framework adds the handling of a request from one person to delete, or to pause a deletion.	A policy that has no route for one person to ask for deletion or for a hold has a visible gap in the DIS.
The notes to deletion move the technical detail out term	The definition notes described bit patterns, reconstruction effort and a risk based choice of method, and pointed to de-identification guidance.	The notes keep the synonyms and point the reader to clause 5.1, the end of clause 9.1 and the bibliography for mechanisms and their security.	Read clauses 5 and 9 together with the definition. The technical explanation has moved, so a policy that quotes only clause 3 will lose it.
Two storage terms are added term	The abbreviation list covered discs, tapes and common file formats.	The DIS adds solid state disk and write once read many storage.	The medium inventory must include solid state and write once media. The deletion route for each is different.
Clause 5.1 describes the mechanism families text	Clause 5.1 set the policy and procedure sequence without naming mechanism families.	The DIS describes overwriting, device commands, encryption with key destruction and physical destruction, and points to the bibliography for detail.	There is now a plain list to check an estate against. It is still not a specification of any one method.
Clause 5.3 adds notes on clusters as containers text	The clause described naming and the case where one record sits in several clusters.	The DIS adds notes that clusters are logical containers, that a rule generally stays stable until purpose or law changes, and that a change of purpose can move a data object.	A cluster is a purpose container, not a system container. A system migration does not by itself change the rule.
Clause 5.4.2 talks about the deletion process text	The regular deletion period was the retention period plus the maximum time for deletion work.	The DIS expresses the outer limit in terms of the deletion process and the maximum acceptable time for it.	The operational routine is now part of the period arithmetic. If the process is slow, the period is longer and that must be written down.
Clause 7.4.3 changes its subject heading	The heading was the need to extend the period of active use.	The heading covers postponement when a record is moved into a different cluster.	The DIS treats a move between clusters as the reason for the delay. A policy that still uses the old heading has not caught up with the structure.
Clause 9 gains the most space structure	Clause 9 ran from about page 16 to page 21 of 25.	Clause 9 runs from about page 17 to page 25 of 27, with the individual request clause at the end.	Implementation and the individual request route are where the revision expects work. Budget the update there first.
The edition in force is still the 2021 text status	ISO/IEC 27555:2021 is published and stands at stage 90.92, to be revised.	The DIS is a draft in the enquiry phase. It is not an International Standard and may change before publication.	Do not cite the DIS as the current standard in a policy or an audit response. Cite the published edition, and plan for the replacement.

What did not change

The ten clauses, the 45 subclauses, the ten defined terms and the single normative reference all remain. A team can map its existing clause references across and then re-read the text for the wording changes above. That is a materially smaller job than a rebuild, and it is the first thing to tell a steering group.

If you want the clause-level work product, the kit turns the change map and the 55 headings into a register and a dated plan. The watch emails when the stage, the date or the public sample moves.