ISO/IEC 27701 is the international standard that specifies requirements and guidance for a privacy information management system (PIMS), the set of policies, roles, processes and controls an organization uses to govern the processing of personally identifiable information (PII). Among security standards in cybersecurity, it is the main certifiable framework for privacy, and it is often called simply ISO 27701.
The first edition, published in 2019, was written as a privacy extension of ISO/IEC 27001 and ISO/IEC 27002: an organization could only be certified against it together with an information security management system. The 2025 edition restructured the document as a standalone management system standard, so a PIMS can now be built and certified on its own, although most organizations still run it alongside an existing ISO 27001 program.
How a privacy information management system works
A PIMS applies the familiar Plan-Do-Check-Act cycle of ISO management systems to personal data. The organization defines its context and scope, identifies the interested parties and the privacy laws that apply, assigns accountable roles, assesses risks to individuals, selects controls, measures their effectiveness and improves the system through internal audits and management review.
The decisive shift compared with pure information security is the object of risk assessment. ISO 27001 asks what could harm the organization’s information assets; ISO/IEC 27701 adds privacy risk to the data subject, meaning harm to the people whose data is processed, such as discrimination, financial loss or loss of control over their information. A breach that costs the company little can still be a severe privacy event for thousands of individuals.
The standard distinguishes two roles taken from the privacy framework in ISO/IEC 29100. A PII controller decides why and how personal data is processed; a PII processor processes it on behalf of a controller. One organization often holds both roles for different processing activities, for example as controller of its own employee data and as processor for its customers’ data.
The following table summarizes the main building blocks that an auditor expects to find in an operating PIMS.
| Component | What it contains | Typical evidence |
|---|---|---|
| Scope and context | Processing activities, jurisdictions, roles held | Scope statement, legal register |
| Privacy risk assessment | Risks to data subjects and to the organization | Risk register, impact assessments |
| Statement of applicability | Selected controls with justification for exclusions | Signed SoA document |
| Records of processing | Purposes, categories of data, recipients, retention | Processing inventory |
| Performance evaluation | Monitoring, internal audit, management review | Audit reports, review minutes |
Structure and control sets of ISO/IEC 27701
The control content is organized by role, which is the most practical feature of the standard. In the 2019 edition, Annex A lists additional controls for PII controllers and Annex B lists those for PII processors, while clauses 5 and 6 explain how the requirements and controls of ISO 27001 and ISO 27002 must be interpreted for privacy. The 2025 edition keeps the controller and processor control sets but integrates the necessary security requirements so that the document no longer depends on ISO 27001.
| Role | Main control themes | Examples |
|---|---|---|
| PII controller | Lawful basis, purpose limitation, data subject rights | Consent records, access request handling, privacy notices |
| PII controller | Privacy by design and by default | Data minimization, retention limits, de-identification |
| PII processor | Processing only on documented instructions | Customer contracts, instruction logs |
| PII processor | Subprocessor and transfer management | Subprocessor lists, transfer safeguards, return or deletion of data |
| Both roles | Breach handling and accountability | Breach notification procedures, processing records |
Annexes that map the controls to privacy regulations are another distinctive element. The 2019 edition includes a mapping to the EU General Data Protection Regulation (GDPR) and to frameworks such as ISO/IEC 29100, which lets a privacy team show which controls support which legal obligations. The mapping is a navigation aid, not a legal verdict: certification does not prove regulatory compliance.
How ISO/IEC 27701 compares with related security standards
ISO/IEC 27701 sits in a crowded neighborhood of security standards, and confusion usually comes from overlapping vocabulary. The key difference is that it is the only widely used certifiable management system dedicated to privacy, while its neighbors focus on security controls, cloud processing or audit reporting.
| Framework | Primary focus | Certifiable | Relation to ISO/IEC 27701 |
|---|---|---|---|
| ISO 27001 | Information security management system | Yes | Common foundation, often certified together |
| ISO/IEC 27002 | Catalog of security controls | No | Security control guidance that privacy controls build on |
| ISO/IEC 27018 | PII protection in public cloud processing | Usually as an extension | Narrower, cloud processor focus |
| SOC 2 | Attestation on trust services criteria | Attestation report | Privacy criterion overlaps, different audit model |
| NIST Privacy Framework | Voluntary privacy risk outcomes | No | Compatible risk vocabulary, no certificate |
In practice, organizations with an existing ISO 27001 certificate treat ISO/IEC 27701 as the lowest-effort path to a privacy certificate, because the management system machinery, the document control, internal audit and management review, already exists and only needs privacy-specific extensions.
Certification process and practical implementation
Certification follows the usual ISO model: an accredited certification body performs a two-stage initial audit, issues a certificate valid for three years and conducts annual surveillance audits, with a recertification audit before expiry. When combined with ISO 27001, both standards are usually audited in a single integrated audit, which reduces cost and disruption.
Implementation time depends on maturity. A company with a functioning ISO 27001 program and a GDPR compliance effort often needs several months, while an organization starting without either typically needs a year or more. The work is less about technology and more about documented accountability: who decides, who approves, and where the evidence lives.
| Situation | Recommended approach | Reason |
|---|---|---|
| Certified to ISO 27001 already | Extend the existing ISMS to a PIMS | Reuses audits, policies and governance |
| No security certificate, privacy is the driver | Use the standalone 2025 edition | Avoids building an unrelated ISMS first |
| Cloud or SaaS provider acting as processor | Focus on processor controls and contracts | Customers mainly assess processor duties |
| Group with mixed controller and processor roles | Define roles per processing activity | Prevents gaps between the two control sets |
Limitations and common mistakes
The most frequent misunderstanding is treating the certificate as proof of GDPR compliance. ISO/IEC 27701 demonstrates that a management system exists and operates within a defined scope; supervisory authorities and courts still judge each processing activity against the law. A second weakness is scope narrowing, where only a small, well-controlled part of the business is certified while riskier processing stays outside.
- Copying security risk methods unchanged, so that harm to data subjects never appears in the risk register.
- Unclear controller and processor roles, which leaves contract duties and data subject requests without an owner.
- Stale processing records that no longer match real systems, the first thing a skilled auditor tests.
- Ignoring transition deadlines between editions, which can leave a certificate referencing a withdrawn version.
A non-technical view
Imagine a company that holds information about you: your name, address, purchases and perhaps your health. ISO/IEC 27701 is a rulebook for handling that information responsibly. It asks the company to know what personal data it holds, why it holds it, who may see it, how long it keeps it and what it does when something goes wrong.
An independent auditor then checks that the company actually follows its own rules, year after year. The certificate shows that a working privacy system is in place, much like a food safety certificate shows that a kitchen follows hygiene procedures, without promising that no mistake will ever happen.
A concrete example
A mid-sized software company sells a cloud payroll service to employers in several European countries. It already holds an ISO 27001 certificate, but large customers keep sending long privacy questionnaires before signing contracts. The company decides to extend its ISMS to a PIMS and defines itself as a PII processor for payroll data and as a PII controller for its own staff and marketing contacts.
Over about eight months, the privacy team builds a processing inventory, adds data subject harm to its risk method, rewrites customer contracts to document processing instructions and publishes a subprocessor list. A combined audit covers both standards. The resulting certificate replaces many questionnaire answers, shortens procurement reviews and gives the team a structured annual cycle for keeping privacy controls current.