ISO/IEC 27701

What is ISO/IEC 27701?

ISO/IEC 27701 specifies requirements and gives guidance for a privacy information management system (PIMS). A PIMS is the policies, roles, processes and controls an organisation uses to protect personally identifiable information (PII) and the privacy of the people it relates to.

The first edition, published in 2019, was an extension of ISO/IEC 27001 and ISO/IEC 27002, so it could only be certified on top of an information security management system. The 2025 edition changes that. It is a standalone management-system standard with its own harmonised clauses and control set.

Purpose and objectives

• Give organisations a structured, auditable way to manage privacy obligations.
• Clarify responsibilities for PII controllers (who decide why and how PII is processed) and PII processors (who process on their behalf).
• Provide a common language for privacy assurance between customers, suppliers and regulators across jurisdictions.

Who does it apply to?

Any organisation that processes PII, whether as a controller, a processor or both: SaaS providers, outsourcers, healthcare and financial organisations, public bodies, and global groups seeking one privacy framework across many laws.

Scope and applicability considerations

Scope should state which processing activities, systems, sites and roles (controller, processor or both) are covered. Interested parties include data subjects, regulators, customers and processors. The applicable privacy laws are a key input to context and to selecting controls.

How is the standard structured?

Because it now follows the same harmonised structure as ISO/IEC 27001 and ISO/IEC 42001, an organisation can run an integrated management system that covers security, privacy and AI, with shared governance, internal audit and management review.

Core requirements in practice

• Privacy risk assessment and treatment, considering risks to individuals as well as to the organisation.
• Lawful and transparent processing. Identifying purposes and legal bases, giving notices, and managing consent where relevant.
• Data subject rights: access, correction, erasure, objection and portability, as applicable.
• Privacy by design and by default, and limiting collection, use and retention.
• PII sharing, transfer and disclosure controls, including cross-border transfers.
• Processor obligations: processing only on instructions, helping controllers with rights requests and breaches, and managing sub-processors.
• Breach management, including notification to controllers, authorities and individuals as required.

What changed from the 2019 edition?

For organisations already certified to the 2019 edition, the practical work is to re-map existing privacy processes and controls to the new structure, confirm the Statement of Applicability, and agree the transition audit with the certification body.

Controller and processor responsibilities in practice

Key terminology

• PII (personally identifiable information): information that can identify a natural person, directly or indirectly. Broadly equivalent to “personal data” in GDPR and DPDP terms.
• PII principal: the person the PII relates to (the “data subject” or “Data Principal”).
• PIMS: privacy information management system.
• Privacy impact assessment: a structured assessment of how processing affects individuals’ privacy, used to choose controls.

Implementation lifecycle

1. Define roles and scope for each processing activity.
2. Map PII and processing. Records of processing, data flows, systems and third parties.
3. Identify legal and contractual requirements in each jurisdiction.
4. Assess privacy risks and impacts, and select controls.
5. Implement and operate policies, procedures and technical measures.
6. Monitor, audit and review.
7. Certify (optional) with a certification body, then maintain through surveillance audits.

Evidence and documentation

Typical evidence includes the PIMS scope and policy, records of processing, privacy risk and impact assessments, the Statement of Applicability, notices and consent records, data subject request logs, processor and sub-processor agreements, transfer assessments, the breach register, training records, internal audits and management reviews.

Common misconceptions and pitfalls

• “Certified means compliant.” Certification does not replace legal analysis.
• Ignoring the processor role. Many SaaS providers are both controller (for their own customers’ account data) and processor (for customer content).
• Assuming the 2019 structure still applies. The clauses and control set were reorganised in 2025.

Relationship with other frameworks