Crossbearing · standards comparison

ISO/IEC 27001 to ISO/IEC 27701

What you can reuse, what to extend and what is new when you add ISO/IEC 27701 to ISO/IEC 27001.

Compare another pair

I already have I want to add

What carries over from ISO/IEC 27001 to ISO/IEC 27701

Your ISMS is most of the way to a PIMS. The clauses are shared, ISO/IEC 27701 asks you to document the information security programme you run — your ISMS is exactly that — and its 29 security controls are ISO/IEC 27001 controls applied to PII. The new work is privacy itself: your controller and processor roles, a privacy policy, privacy risk that weighs the consequences for people, and the 49 controller and processor controls.

Of the 103 clauses and controls ISO/IEC 27701 asks for: 38 to reuse, 22 to extend and 43 new.

38 Reuse Use what you have: the same process or document, with its scope widened.
22 Extend Keep what you have and add the new standard’s content.
43 New Nothing you have covers it: new work.

Clause and control numbers checked against ISO/IEC 27001 and ISO/IEC 27701 themselves; descriptions are MajorCyber™’s own words. Mapping by MajorCyber™, last checked 23 October 2026. Going the other way? ISO/IEC 27701 to ISO/IEC 27001

Do I need to rewrite my policies?

No. Keep your security policy set: ISO/IEC 27701 expects security policies related to PII processing (A.3.3), and yours can carry them. Add a privacy policy with privacy commitments — or a clearly marked privacy section of an integrated policy — and the privacy procedures your controller and processor duties need, such as handling requests, retention and disposal, and engaging subcontractors.

The management system, clause by clause

Both follow the harmonised structure that ISO management-system standards share, so clauses 4 to 10 line up by number. Each row says what ISO/IEC 27701 asks for and what to do with what your ISMS already has.

Controls: ISO/IEC 27701 Annex A, against ISO/IEC 27001 Annex A

Table A.3 of ISO/IEC 27701 applies 29 ISO/IEC 27001 controls to PII processing, so those carry straight over. Tables A.1 (controllers) and A.2 (processors) are privacy controls; only some have a security counterpart.

ISO/IEC 27701 Annex A controls, with the ISO/IEC 27001 Annex A controls that support each
ISO/IEC 27701 control	Supported by your ISO/IEC 27001	What to do
Controller: lawful processing
A.1.2.2 Purposes identified and documented	5.34 Privacy and personal data protected Related	New Knowing your privacy obligations is a start; document the specific purpose of each processing activity.
A.1.2.3 Lawful basis identified and shown	5.34 Privacy and personal data protected Partly covers it	Extend This control identifies your privacy obligations; the PIMS shows the lawful basis for each purpose.
A.1.2.4 A process for when and how consent is sought	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.2.5 Consent obtained and recorded	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.2.6 Privacy impact assessment for new or changed processing	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.2.7 Written contracts with PII processors	5.20 Security terms in supplier contracts Partly covers it	Extend Supplier contracts with security terms carry over; contracts with PII processors also need the privacy controls of Table A.2.
A.1.2.8 Roles agreed with joint controllers	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.2.9 Records that support processing obligations	5.33 Records protected Related	New Records protection keeps processing records safe; it doesn’t create them.
Controller: people’s rights
A.1.3.2 Obligations to people identified and met	5.31 Legal, regulatory and contractual requirements identified Related	New Your register of legal requirements is where obligations to people belong; the PIMS adds how you meet each.
A.1.3.3 Deciding what people are told, and when	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.3.4 Clear information given to people	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.3.5 A way to change or withdraw consent	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.3.6 A way to object to processing	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.3.7 Access, correction and erasure	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.3.8 Third parties told of changes, withdrawals and objections	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.3.9 A copy of their PII for people who ask	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.3.10 Procedures for handling requests	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.3.11 Obligations from automated decisions about people	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
Controller: privacy by design
A.1.4.2 Collection limited to what is needed	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.4.3 Processing limited to what is needed	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.4.4 PII kept accurate and up to date	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.4.5 Minimisation objectives and how they are met	8.11 Data masking Related	New Masking is one way to meet minimisation objectives; define the objectives and the mechanisms.
A.1.4.6 De-identified or deleted when no longer needed	8.10 Information deleted when no longer needed Partly covers it	Extend Deleting information when it is no longer needed, extended to de-identifying PII once its purpose is served.
A.1.4.7 Temporary files disposed of on time	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.4.8 Kept no longer than its purposes need	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.4.9 Disposal policies and procedures	8.10 Information deleted when no longer needed Partly covers it	Extend Secure deletion carries over; document disposal policies and procedures for PII.
A.1.4.10 Transmitted PII reaches only its destination	5.14 Rules for transferring information Partly covers it	Extend Transfer rules carry over; make sure transmitted PII reaches only its intended destination.
Controller: sharing and transfers
A.1.5.2 Basis for transfers between jurisdictions	5.14 Rules for transferring information Related	New Transfer rules are a start; transfers between jurisdictions need a documented legal basis.
A.1.5.3 Where PII may be transferred, documented	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.5.4 Transfers to and from third parties recorded	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.1.5.5 Disclosures to third parties recorded	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
Processor: lawful processing
A.2.2.2 Customer contracts cover help with their obligations	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.2.2.3 PII used only for the customer’s documented purposes	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.2.2.4 No marketing use without the person’s consent	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.2.2.5 Customers told of instructions that seem unlawful	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.2.2.6 Customers given what they need to show compliance	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.2.2.7 Records that support the processor’s obligations	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
Processor: people’s rights
A.2.3.2 Customers helped to meet obligations to people	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
Processor: privacy by design
A.2.4.2 Temporary files disposed of on time	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.2.4.3 PII returned, transferred or disposed of securely	7.14 Equipment wiped before disposal or reuse Related	New Wiping equipment helps; as a processor you must return, transfer or dispose of customers’ PII securely, and publish how.
A.2.4.4 Transmitted PII reaches only its destination	5.14 Rules for transferring information Partly covers it	Extend Transfer rules carry over; make sure transmitted PII reaches only its intended destination.
Processor: sharing and subcontractors
A.2.5.2 Customers told the basis for transfers, and of changes	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.2.5.3 Where PII may be transferred, documented	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.2.5.4 Disclosures to third parties recorded	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.2.5.5 Customers told of legally binding disclosure requests	5.5 Contacts with the relevant authorities Related	New Contacts with authorities help; tell customers about legally binding requests to disclose their PII.
A.2.5.6 Only legally binding disclosures made, customer consulted	No counterpart	New Nothing in ISO/IEC 27001 Annex A corresponds: new work.
A.2.5.7 Subcontractors disclosed before use	5.21 Security across the ICT supply chain Related	New Knowing your supply chain helps you tell customers which subcontractors process their PII.
A.2.5.8 Subcontractors engaged only as the contract allows	5.20 Security terms in supplier contracts Partly covers it	Extend Supplier contracts carry over; engage subcontractors for PII only as your customer contract allows.
A.2.5.9 Customers told of subcontractor changes, with time to object	5.22 Supplier services monitored and reviewed Related	New Managing supplier changes helps; customers must hear of subcontractor changes in time to object.
Security for PII
A.3.3 Security policies covering PII processing	5.1 Security policy set, approved and kept under review Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.4 Security roles for PII processing	5.2 Security roles and responsibilities assigned Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.5 Classification that takes PII into account	5.12 Information classified by sensitivity Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.6 Labelling that takes PII into account	5.13 Information labelled to match its classification Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.7 Rules for transferring PII	5.14 Rules for transferring information Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.8 Identities managed through their life cycle	5.16 Identities managed through their life cycle Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.9 Access rights to PII granted, reviewed and removed	5.18 Access rights granted, reviewed and removed Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.10 Security terms in supplier agreements	5.20 Security terms in supplier contracts Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.11 Incident management planned for PII processing	5.24 Incident management planned and prepared Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.12 Incidents responded to by procedure	5.26 Incidents responded to by procedure Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.13 Legal and contractual security requirements for PII	5.31 Legal, regulatory and contractual requirements identified Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.14 Records about PII protected	5.33 Records protected Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.15 Independent review of PII security	5.35 Independent review of security Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.16 Compliance with security policies checked	5.36 Compliance with security policies checked Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.17 Awareness and training on PII security	6.3 Security awareness, education and training Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.18 Confidentiality agreements	6.6 Confidentiality agreements Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.19 Clear desks and locked screens	7.7 Clear desks and locked screens Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.20 Storage media holding PII managed	7.10 Storage media handled securely Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.21 Equipment wiped before disposal or reuse	7.14 Equipment wiped before disposal or reuse Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.22 User devices protected	8.1 User devices protected Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.23 Secure authentication	8.5 Secure authentication Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.24 Backups, tested	8.13 Backups Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.25 Logging, protected and analysed	8.15 Logging Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.26 Cryptography and key management	8.24 Cryptography and key management Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.27 Secure development life cycle	8.25 Secure development life cycle Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.28 Security requirements for applications	8.26 Security requirements for applications Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.29 Secure architecture and engineering principles	8.27 Secure architecture and engineering principles Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.30 Outsourced development overseen	8.30 Outsourced development overseen Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.
A.3.31 Test data protected	8.33 Test data protected Covers it	Reuse The same control as your ISMS runs, applied to PII processing. Reuse it — check your ISMS scope covers the systems that process PII.

A route from ISO/IEC 27001 to ISO/IEC 27701

01
Roles and scope
- Map your processing and decide, for each activity, whether you act as PII controller (alone or jointly) or processor
- List the privacy laws and contracts that apply
- Set the PIMS scope and how it relates to the ISMS scope
02
Gap assessment
- Go through this page clause by clause
- Table A.3 security controls: confirm your ISMS covers PII processing
- Tables A.1 and A.2: check the controller and processor controls that apply to you
03
Governance
- A privacy policy approved by top management
- Responsibility for the PIMS and its reporting assigned
- Privacy objectives set and measured
04
Risk
- Extend the risk method to privacy risks and their consequences for people
- Privacy impact assessments for new or changed processing (A.1.2.6)
- Document your ISMS as the information security programme, and write the Statement of Applicability against ISO/IEC 27701 Annex A
05
Controls
- As controller: purposes, lawful basis, consent, rights, privacy by design, transfers
- As processor: customer instructions, help with their obligations, subcontractors, return and disposal, disclosure requests
06
Run and check
- Operate the PIMS and keep its records
- An internal audit covering both roles
- A management review with the PIMS inputs
07
Certification
- Ask your certification body about auditing the PIMS with the ISMS, and whether it is accredited for the 2025 edition

Certification and audits

Since the 2025 edition, ISO/IEC 27701 is certified on its own: you don’t need ISO/IEC 27001 first, and the two certificates are separate.
Integrated audits are common when both systems share processes. Ask your certification body whether it is accredited for ISO/IEC 27701:2025, since accreditation was still being extended after publication.
Certification to ISO/IEC 27701 shows a working privacy management system. It is not certification of compliance with any particular privacy law.

Common pitfalls

Calling yourself “the processor” for everything, when you are a controller for your own staff, customers’ billing contacts and marketing.
Rating privacy risks only by their consequences for the organisation.
Reusing the ISMS Statement of Applicability instead of writing one against ISO/IEC 27701 Annex A.
Working from the 2019 edition, which extended ISO/IEC 27001 and 27002, instead of the standalone 2025 one.
Treating a PIMS certificate as proof of GDPR or DPDP Act compliance.

ISO/IEC 27001 and ISO/IEC 27701 at a glance

ISO/IEC 27001 and ISO/IEC 27701 side by side
Fact	ISO/IEC 27001	ISO/IEC 27701
What it is	Certifiable standard	Certifiable standard
How it applies	Voluntary, often required by customers	Voluntary, often required by customers
How you show it	Certification by an accredited certification body	Certification by an accredited certification body
Where	International	International
Covers	Information security, Risk management, Audit & assurance	Privacy, Information security, Audit & assurance
Issued or enforced by	ISO and IEC (joint technical committee ISO/IEC JTC 1/SC 27)	ISO and IEC (ISO/IEC JTC 1/SC 27)
Current edition or status	ISO/IEC 27001:2022, amended by ISO/IEC 27001:2022/Amd 1:2024 (climate change considerations). The 2013 edition's certification transition has ended.	ISO/IEC 27701:2025 (published October 2025) replaces the 2019 edition and is now a standalone management-system standard.

Next steps on MajorCyber™

Sources

ISO/IEC 27001:2022 — Information security management systems — Requirements — International Organization for Standardization (ISO)
ISO/IEC 27701:2025 — Privacy information management systems — Requirements and guidance — International Organization for Standardization (ISO)

An educational comparison, researched and drafted with AI assistance. A mapping shows where work you have already done supports a requirement; it never means the requirement is met. Your certification body decides what conforms. No standard’s text is reproduced: buy the standards from ISO or your national standards body.

Clause	Your ISO/IEC 27001	ISO/IEC 27701 asks for	What to do
4.1 Context	Internal and external issues that affect what the ISMS is meant to achieve — including, since the 2024 amendment, whether climate change is relevant.	Issues that affect the PIMS, including whether climate change is relevant, and whether the organisation acts as a PII controller (alone or jointly), a PII processor or both.	Extend Add the privacy laws and contracts that apply, and decide where you act as a PII controller (alone or jointly) and where as a processor.
4.2 Interested parties	Who has a stake in information security, what they require, and which of those requirements the ISMS will address.	Who has a stake in the organisation’s handling of PII — the people it relates to, customers, regulators, processors — and what they require.	Extend Keep what your ISMS has here, and add what ISO/IEC 27701 asks for.
4.3 Scope	The boundaries of the ISMS: which parts of the organisation, locations, assets and interfaces it covers.	The boundaries of the PIMS: which processing, systems and roles it covers.	Extend Write the PIMS scope: which processing, systems and roles it covers. It can share a document with the ISMS scope, but each certificate has its own.
4.4 The management system	An ISMS that is set up, run, maintained and continually improved, with its processes and how they interact.	A PIMS that is set up, run, maintained and continually improved, with its processes and how they interact.	Reuse Use your ISMS’s process for both systems, with its scope widened to the PIMS.
5.1 Leadership	Top management directs and supports the ISMS: aligned with strategy, built into the business, resourced and communicated.	Top management directs and supports the PIMS: aligned with strategy, built into the business, resourced and communicated.	Extend Keep what your ISMS has here, and add what ISO/IEC 27701 asks for.
5.2 Policy	An information security policy from top management that frames objectives and commits to meeting requirements and improving.	A privacy policy from top management that frames privacy objectives and commits to meeting requirements and improving.	New A privacy policy with privacy commitments, beside the security policy or as a clearly marked part of an integrated one.
5.3 Roles	Responsibilities and authorities for information security assigned and communicated.	Responsibilities and authorities for privacy assigned and communicated.	Extend Assign who makes sure the PIMS conforms and who reports on its performance, and add privacy duties to the roles you already assign.
6.1.1 Risks and opportunities	Plan how the ISMS addresses the risks and opportunities that come from its context and interested parties.	Plan how the PIMS addresses its risks and opportunities.	Extend Keep what your ISMS has here, and add what ISO/IEC 27701 asks for.
6.1.2 Risk assessment	A repeatable information security risk assessment: criteria for acceptance and assessment, risk owners, likelihood and consequence, prioritisation.	A repeatable privacy risk assessment of the privacy and information security risks in scope, weighing the consequences for the people whose PII it is as well as for the organisation, with risk owners.	Extend Keep one risk method: ISO/IEC 27701 allows privacy and security risk assessments to be combined. Extend it to privacy risks, and weigh the consequences for the people whose PII it is as well as for the organisation.
6.1.3 Risk treatment	Choose treatments and the controls they need, compare them with Annex A, write a Statement of Applicability (6.1.3 d) and a treatment plan approved by the risk owners.	Choose treatments and controls, identify and document the information security programme you run (6.1.3 c), check against Annex A, and write a Statement of Applicability (6.1.3 e) and a treatment plan approved by the privacy risk owners.	Extend Keep one treatment process. Your ISMS is the information security programme ISO/IEC 27701 asks you to document (6.1.3 c). Write a separate Statement of Applicability against ISO/IEC 27701 Annex A (6.1.3 e).
6.2 Objectives	Measurable information security objectives, with plans for who achieves them, how and by when.	Privacy objectives, with plans for who achieves them, how and by when.	Extend Keep what your ISMS has here, and add what ISO/IEC 27701 asks for.
6.3 Planning changes	Changes to the management system are carried out in a planned way.	Changes to the management system are carried out in a planned way.	Reuse Use your ISMS’s process for both systems, with its scope widened to the PIMS.
7.1 Resources	The resources the management system needs are provided.	The resources the management system needs are provided.	Reuse Use your ISMS’s process for both systems, with its scope widened to the PIMS.
7.2 Competence	People whose work affects information security are competent, with evidence kept.	People whose work affects privacy are competent, with evidence kept.	Extend Add privacy competences — privacy law, impact assessment, handling requests — to the competence framework.
7.3 Awareness	People know the security policy, their part in the ISMS, and what failing to follow it means.	People know the privacy policy and their part in the PIMS.	Extend Keep what your ISMS has here, and add what ISO/IEC 27701 asks for.
7.4 Communication	What is communicated, when, to whom and how.	What is communicated, when, to whom and how.	Reuse Use your ISMS’s process for both systems, with its scope widened to the PIMS.
7.5 Documented information	Documents and records the ISMS needs are created, updated and controlled.	Documents and records the PIMS needs are created, updated and controlled.	Reuse Use your ISMS’s process for both systems, with its scope widened to the PIMS.
8.1 Operational control	Processes planned, run and controlled, including outsourced ones, with evidence that they ran as planned.	Processes planned, run and controlled, including outsourced ones, with evidence that they ran as planned.	Extend Keep what your ISMS has here, and add what ISO/IEC 27701 asks for.
8.2 Risk assessment in operation	Risk assessments carried out at planned intervals and when significant changes happen.	Privacy risk assessments carried out at planned intervals and when significant changes happen.	Extend Keep what your ISMS has here, and add what ISO/IEC 27701 asks for.
8.3 Risk treatment in operation	The risk treatment plan implemented.	The privacy risk treatment plan implemented.	Extend Keep what your ISMS has here, and add what ISO/IEC 27701 asks for.
9.1 Monitoring and measurement	What is monitored and measured, how and when, and how the results are evaluated.	What is monitored and measured, how and when, and how the results are evaluated.	Extend Keep what your ISMS has here, and add what ISO/IEC 27701 asks for.
9.2 Internal audit	Internal audits at planned intervals, by objective auditors, against the standard and the organisation’s own requirements.	Internal audits at planned intervals, by objective auditors, against the standard and the organisation’s own requirements.	Reuse Keep one audit procedure; widen the programme to the PIMS, covering both your controller and processor roles.
9.3 Management review	Top management reviews the ISMS at planned intervals, with set inputs and recorded decisions.	Top management reviews the PIMS at planned intervals, with set inputs and recorded decisions.	Reuse Use your ISMS’s process for both systems, with its scope widened to the PIMS.
10.1 Continual improvement	The ISMS keeps getting more suitable, adequate and effective.	The PIMS keeps getting more suitable, adequate and effective.	Reuse Use your ISMS’s process for both systems, with its scope widened to the PIMS.
10.2 Nonconformity and corrective action	Nonconformities are corrected, their causes found and removed, and the actions checked.	Nonconformities are corrected, their causes found and removed, and the actions checked.	Reuse Use your ISMS’s process for both systems, with its scope widened to the PIMS.