A Privacy Information Management System only works if its foundations are defined with precision. Organisations must be clear about what constitutes PII processing in their environment, which roles apply, and where system boundaries sit across internal units and external parties.

This module focuses on the architectural front end of a PIMS: defining processing context in a maintainable way, determining controller and processor roles including joint arrangements, establishing internal accountability models, and formalising scope statements and boundary artefacts that reflect real operations and sourcing structures. The emphasis is on governance clarity that enables consistent decision-making, auditability, and long-term maintainability.