ISO/IEC 22624:2020 pdf download – Information technology — Cloud computing — Taxonomy based data handling for cloud services.
5 Overview: The need for a structured expression of data policies and practices based on a common data taxonomy Data policies and practices, at corporate or government level, need to be crisply expressed with the desired degree of precision and clarity. The need for varying degree of precision, along with the need to compare and analyse various policies in an efficient manner, calls for a common and structured approach to the expression of these policies and practices, an approach that is based on a common data taxonomy. ISO/IEC 19944 provides a comprehensive set of elements which can be used to a) assign a data category to a given data set (e.g. personally identifiable information (PII), organisational identifiable information, customer content data), b) provide classes of actions applied to such data (e.g. use to provide a service, to optimize it, to provide marketing information), c) include scopes explaining on what level the use of data happens (e.g. service level vs. enterprise/ organisational level vs. use by 3rd parties), and d) define the level of de-identification (or anonymization) applied to a data set (qualifiers such as “identified”, “anonymized”, “aggregated”). These elements are referred to in the document as “data categories” or “data taxonomy”, “actions”, “scopes”, and “qualifiers” without explicitly referencing ISO/IEC 19944. Clause 6 provides a comprehensive overview of the elements. The framework described in this document references the framework in ISO/IEC 19944.
6 Framework for the structured expression of data related policies and practices 6.1 General This document uses the taxonomy and data use expression structure specified in ISO/IEC 19944. Any policy or practice that conforms to this document and uses the taxonomy or data use expression shall meet the requirements of ISO/IEC 19944 as appropriate. To handle key data management topics, Clause 6 describes a harmonized structure to express a desired policy for data management based on various data types, using data taxonomy in ISO/IEC 19944. The data management policies based on a common structure specified by this document can be expressed, compared and negotiated. It is important to point out that this document does not define one or more data policies, rather it offers a common structure and framework for others to use in order to express their policy of choice. Moreover, this document does not stipulate any specific format or syntax to be used to express policies and practices related to a categorization of data. Although tables are frequently employed throughout this document to illustrate the usage of the framework, the use of tabular formats is not normative or mandatory but serves for the presentation of examples only.