The privacy side of the program is covered by ISO/IEC 27701, an extension of ISO 27001 that governs how personal data is collected, processed