ISO/IEC 29100 applies to individuals and organizations involved in defining, creating, designing, developing, testing, maintaining, managing, operating information and communication technology systems or services where privacy controls are required for PII processing.