# ISO and IEC standards

> ISO and IEC standards (ISO/TC 307 · ISO/IEC JTC 1/SC 27): The standards bodies that specify privacy instead of policing it. Region: Global. Builds with privacy tech: The regime itself mandates, pilots or funds privacy-preserving technology.

Part of the Soda Labs Privacy Hub regulation map, which reads the instruments
themselves rather than summarising the summaries: https://www.sodalabs.xyz/privacy-hub/regulation

## Key facts

- Entry type: Regulator or standard-setter
- Region: Global
- Subject: The standards bodies that specify privacy instead of policing it
- Authority: ISO/TC 307 · ISO/IEC JTC 1/SC 27
- Stance on on-chain confidentiality: Builds with privacy tech. The regime itself mandates, pilots or funds privacy-preserving technology.
- Tags: ISO/IEC 27565, zero-knowledge proofs, de-identification, voluntary standards
- Canonical page: https://www.sodalabs.xyz/privacy-hub/regulation/reg-iso

## What it actually says

Set this against the financial standard-setters and the contrast is sharp. In February 2026 ISO and IEC published guidelines on privacy preservation based on zero-knowledge proofs, meaning there is now an international standard for deploying the primitive that the anti-money-laundering bodies do not mention at all. FATF's July 2026 report on information sharing identifies data protection law as the main obstacle to cooperation and names no privacy-enhancing technology anywhere. ISO's blockchain committee has treated privacy as an engineering problem since 2020, when its technical report on personally identifiable information in distributed ledgers addressed immutability against erasure directly. None of this binds anyone unless a regulator or contract adopts it, which so far none has.

## The instruments that matter

- **ISO/IEC 27565:2026, 10 February 2026**: guidelines on privacy preservation based on zero-knowledge proofs, a published international standard for deploying the primitive itself
- **ISO/TR 23244:2020**: privacy and personally identifiable information protection considerations for blockchain and DLT, covering immutability against erasure and on-chain versus off-chain placement
- **ISO 22739:2024**: second edition of the blockchain vocabulary, superseding the 2020 edition
- **ISO/IEC 20889:2018**: privacy-enhancing data de-identification terminology and classification of techniques

## Sources

- [ISO/TR 23244](https://www.iso.org/standard/75061.html)
- [ISO 22739:2024](https://www.iso.org/standard/82208.html)

## Related entries

- [NIST](https://www.sodalabs.xyz/privacy-hub/regulation/reg-nist): The vocabulary that makes privacy claims testable
- [BIS Innovation Hub](https://www.sodalabs.xyz/privacy-hub/regulation/reg-bis-innovation-hub): Central bank prototypes that build privacy on purpose
- [Convention 108+](https://www.sodalabs.xyz/privacy-hub/regulation/reg-convention-108): The only binding international data protection treaty
- [eIDAS 2 and the EU Digital Identity Wallet](https://www.sodalabs.xyz/privacy-hub/regulation/reg-eidas2): Digital identity · Regulation (EU) 2024/1183
- [US Treasury and the Working Group](https://www.sodalabs.xyz/privacy-hub/regulation/reg-us-treasury-pwg): The first federal endorsement of privacy technology
- [Basel Committee, SCO60](https://www.sodalabs.xyz/privacy-hub/regulation/reg-basel-sco60): Bank capital · the sharpest traceability rule anywhere