CyphrQ
Menu

ISO/IEC 27701 Explained: Privacy Management, GDPR and 2025 Edition

ISO/IEC 27701 explained: the privacy management standard for controllers and processors, how it relates to GDPR, and what the 2025 edition changed.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

11 min read

ISO/IEC 27701 is the international standard for a privacy information management system (PIMS): the policies, roles, risk checks and records an organisation uses to manage personal data. It is written for both controllers (who decide why data is used) and processors (who handle it for someone else). An accredited auditor can certify your system against it. The 2025 edition is now a standalone standard.

Updated 25 October 2026.

What is ISO/IEC 27701 and who publishes it?

ISO and the IEC publish ISO/IEC 27701 together. The official ISO page for ISO/IEC 27701 is the place to confirm the current edition and buy the text. The IEC's own store lists Edition 2.0, published 2025-10-14, and describes the document as specifying requirements for establishing, implementing, maintaining and continually improving a PIMS.

A PIMS is a management system for privacy. A management system is not software. It is the set of rules, responsibilities and routines that make an organisation handle something the same way every time. If you know ISO 9001 for quality, this is the same idea applied to personal data.

The title in the Swedish standards body's catalogue is "Information security, cybersecurity and privacy protection: Privacy information management systems: Requirements and guidance". Its listing shows the 2025 edition as valid and as replacing the 2019 edition.

The edition details here come from the IEC store, national standards bodies and accreditation bodies. Check the ISO page before you cite an edition in a contract.

What changed in the 2025 edition of ISO/IEC 27701?

The big change is independence. The 2019 edition was an extension: you applied it on top of ISO/IEC 27001 and ISO/IEC 27002. The 2025 edition is not. The British Standards Institution describes it as a fully stand-alone management system standard, no longer dependent on ISO/IEC 27001 or 27002, with certification possible without extending ISO/IEC 27001. Singapore's accreditation body says the same thing in different words: the revision converts the PIMS into a standalone management system standard.

Two practical consequences:

  • You no longer need an ISMS first. A privacy-led organisation can build a PIMS without first certifying information security.
  • You can still combine them. Many organisations will want one management system with one internal audit programme. The standalone edition makes that a choice, not a requirement.

Do not read "standalone" as "no security". Protecting personal data still needs security controls. The standard simply carries its own requirements rather than pointing to another certificate. For the security side, see the ISO/IEC 27001 explainer.

What does a privacy information management system cover?

I will describe it in my own words, because the text is copyrighted and paid. A PIMS answers the questions an auditor will put to you:

  1. Where does personal data live, and why do we hold it? You define scope and understand your data flows.
  2. Which role do we play? For each activity you are a controller, a processor, or both.
  3. What could go wrong for the people the data is about? You assess privacy risk, not only risk to the business.
  4. Which controls do we apply, and can we prove they run? You choose controls, operate them and keep records.
  5. How do we check and improve? Internal audit, management review and corrective action, the same loop as other ISO management systems.

The standard is also explicit about two audiences. It is intended for PII controllers and PII processors, and it applies to organisations of any size, including public, private, government and not-for-profit bodies, according to the Estonian standards body's listing. PII means personally identifiable information, which for most readers is the same practical idea as personal data under GDPR.

How do controllers and processors differ under ISO/IEC 27701?

The distinction is the same one GDPR uses, which is why the standard maps well to it. In short, the controller sets the purpose and the means of using personal data. The processor acts for the controller; think of a cloud host or an outsourced payroll provider. The GDPR essentials post explains both roles in more detail.

Controller Processor
Decides purposes of processing Yes No, follows instructions
Typical PIMS focus Why you collect data, notices, people's rights, retention Acting only on instructions, helping the controller, sub-processors, deletion on exit
What a customer wants to see Evidence you handle data lawfully and respond to rights requests Evidence you protect data, flow terms down to sub-processors and report incidents on time
Common trap Thinking a vendor contract moves your responsibility Quietly deciding purposes and so becoming a controller

Many organisations are both. A software company is a controller of its own staff and customer-account data, and a processor of the data its customers load into the product. Your scope statement should say which hat applies to which service.

How does ISO/IEC 27701 map to GDPR?

It supports GDPR compliance; it does not equal it. BSI's description says the standard helps organisations manage privacy risk from processing personal data and supports compliance with laws such as GDPR and the CCPA. That wording is deliberate. GDPR is a law with duties, deadlines and fines. ISO/IEC 27701 is a voluntary management standard.

Here is the practical overlap, using duties the GDPR essentials post covers:

GDPR duty What a PIMS gives you
Records of processing (Article 30) A maintained inventory tied to your scope and roles
Processor contracts (Article 28) A repeatable supplier process and contract checklist
Breach reporting (Article 33) A tested incident procedure with named owners
Data protection impact assessments A routine for assessing privacy risk before change

A certificate does not tell a regulator you comply. It shows a management system exists and was audited. Whether it counts as evidence of "appropriate" measures is a legal question for your adviser. None of the sources cited here describes the certificate as a GDPR certification scheme in its own right, so do not describe it that way.

Can you be certified to ISO/IEC 27701, and how does it relate to other standards?

Yes. ISO/IEC 27701 is a requirements standard, so an accredited certification body can audit and certify you. Its companion is ISO/IEC 27706:2025, the standard for the bodies that audit PIMS. Singapore's accreditation body says both standards were published on 14 October 2025.

How it sits next to its siblings:

  • ISO/IEC 27001: sets the requirements for managing information security (an ISMS). Use it for security risk. See the ISO/IEC 27001 explainer.
  • SOC 2: an attestation report rather than an ISO certificate. The SOC 2 versus ISO 27001 comparison shows how the two assurance styles differ.
  • ISO/IEC 42001: applies the management-system model to artificial intelligence. If AI systems use personal data, a PIMS and an AI management system overlap. The ISO/IEC 42001 explainer covers it.

You can browse the wider set on the ISO standards subtopic page.

How does an ISO/IEC 27701 audit or adoption work in practice?

The pattern follows other ISO management systems. Your certification body will give you its own plan, so treat this as the general shape.

  1. Scope it. Name the services, locations and your role (controller, processor or both) for each.
  2. Map your data. Build the inventory of personal data, purposes, recipients and retention.
  3. Assess privacy risk and choose controls. Record what you apply and why.
  4. Run it and keep evidence. Operate the controls, hold an internal audit and a management review.
  5. Engage an accredited certification body. Auditors check the system against the standard in stages.
  6. Stay certified. Expect periodic surveillance audits and a recertification cycle, as with other ISO schemes. Confirm the cycle with your body.

In practice, the 2025 transition has real dates. SAC says existing certification bodies it accredits must complete their transition by 31 October 2027, and must move all their clients to ISO/IEC 27701:2025 by 31 October 2028. That is Singapore's rule. Other accreditation bodies set their own dates, so ask your certification body which one applies to you. If you hold a 2019 certificate, that conversation is the first thing to schedule.

The same sources show why you should check dates for yourself. The IEC store lists publication on 14 October 2025. SAC gives the same date. BSI's catalogue page, which is for BSI's own adopted edition, gives 31 October 2025. They are describing different records, not contradicting each other.

Going deeper: for security and IT teams

Decide your role per processing activity before you write anything. A PIMS fails fastest when the controller-processor split is vague. Build a table with one row per service or data flow, columns for role, data categories, purposes, recipients, retention, transfer destinations and the contract that governs it. That table becomes the backbone of your records of processing and of the scope statement the certificate will carry.

Run a separate privacy risk assessment. Security risk asks what harms confidentiality, integrity or availability of information. Privacy risk also asks what processing does to the individual: excessive collection, loss of control, unexpected reuse, inability to exercise rights. Keep them as two registers or two clearly labelled sections, and link them to a shared treatment plan. If you already run an ISMS, reuse its method and its scoring scale so the board sees comparable numbers.

Build a Statement of Applicability or equivalent. As in other ISO management systems, expect to record which controls apply, why, and their implementation status. This post does not reproduce the control list because it is paid content, so build it from the standard's own text. An exclusion with no reasoning is the easiest finding an auditor can raise.

Evidence an auditor asks for:

  • Scope statement naming controller and processor roles per service.
  • Data inventory and records of processing, with named owners and review dates.
  • Privacy risk assessments and treatment decisions with approval.
  • Supplier register with processor contracts, sub-processor lists and breach-notification terms.
  • Rights-request log showing receipt date, identity check, response and closure.
  • Retention and deletion schedule, with proof a deletion actually ran.
  • Incident procedure, a test record and a post-incident review.
  • Proof you check yourself: an internal audit, the minutes of management review, and a log of corrective actions.

Common nonconformities, described generally. Scope that names a product but not the data flows behind it. A processor contract that does not flow terms down to sub-processors. Retention periods written in policy but not enforced in systems. A rights-request process that works by email but has no log. A privacy risk assessment that is a copy of the security one.

Map to controls you already have. Access control, logging, encryption, backup and change management from your ISMS support the security expectations of a PIMS. If you run both, plan one integrated audit programme, not two. If you do not hold ISO/IEC 27001, the standalone edition means you do not have to start there, but you will still have to evidence security measures for personal data.

Choosing the certification body. Check on the accreditation body's own register that the body is accredited for PIMS certification, and ask how it implements ISO/IEC 27706:2025. Ask about its transition plan for 2019 certificates, how combined audits with ISO/IEC 27001 are scheduled and what the certificate cycle is.

Verify before relying on a supplier's certificate. Ask for the certificate, the scope statement, the certification body and which edition of the standard it was issued against. A 2019 certificate and a 2025 certificate are not the same assurance. Confirm that the scope includes the service you actually buy and that it states whether the supplier acts as a processor for it.

Ask your own team: Which services are we a controller for, and which as a processor? Can we produce a rights-request log in ten minutes? Which processors have no sub-processor list?

What should you do next about ISO/IEC 27701?

  • List your main services and write down whether you are the controller, the processor or both for each.
  • Find out whether customers or regulators in your market are asking for proof, and in what form.
  • If you hold a 2019 certificate, ask your certification body for its transition plan and dates.
  • Before you trust a supplier's certification claim, check which edition and scope it covers, and who issued it.
  • Read the ISO page for the current edition before quoting it.

Learn more

Key takeaways

  • ISO/IEC 27701 is a voluntary standard for a privacy information management system, written for both controllers and processors.
  • The 2025 edition (Edition 2.0, published 14 October 2025 per the IEC store) is standalone: you no longer need ISO/IEC 27001 first.
  • It supports GDPR compliance but does not equal it, and a certificate is not proof of legal compliance.
  • ISO/IEC 27706:2025 sets requirements for the bodies that certify against it.
  • Accreditation bodies set transition dates for 2019 certificates; Singapore's are 31 October 2027 for certification bodies and 31 October 2028 for clients.
  • Define your controller and processor role per service before you scope anything.

Sources