ISO/IEC 27701: What It Is and What Has Changed in 2025

Most countries now regulate how organizations handle personal data. The United Nations Conference on Trade and Development (UNCTAD) counts 137 of 194 economies with data protection legislation in force. IBM's Cost of a Data Breach Report 2026 puts the global average breach at a record $4.99 million, driven by higher detection and escalation and lost business costs. Boards now ask the privacy function the same question they have asked security for a decade: can this be evidenced to a third party?

ISO/IEC 27701 is the standard built to answer that question. The 2025 edition also changed the standard. It no longer depends on ISO/IEC 27001.

Contents

• What is ISO/IEC 27701?
• Why is ISO/IEC 27701 important?
• Benefits of ISO 27701
• Who should use ISO/IEC 27701?
• What is a PIMS?
• Can ISO/IEC 27701 be used alone?
• ISO 27001 vs ISO 27701
• How does ISO/IEC 27701 relate to the GDPR?
• Requirements of ISO 27701
• ISO 27701 and Prescient Security
• Conclusion

What is ISO/IEC 27701?

ISO/IEC 27701 specifies requirements for establishing, implementing, maintaining, and continually improving a privacy information management system (PIMS), and provides guidance on how to implement them. It is written for personally identifiable information (PII) controllers and PII processors, and it applies to organizations of any type and size, including public bodies and not-for-profits.

The first edition, ISO/IEC 27701:2019, was published as an extension to ISO/IEC 27001 and ISO/IEC 27002. The British Standards Institution (BSI) describes it as the world's first global Privacy Information Management System (PIMS) standard.

The second edition, ISO/IEC 27701:2025, which was published on October 14th, 2025, reworked the document so that it becomes a standalone management system standard. The clauses from 4 to 10 now adhere to the unified structure that is used by all ISO management system standards. The section dealing with the controller and the processor, which had been divided between two annexes, is now brought together in a single annex, Annex A: A.1 covers the controller, A.2 covers the processor, and A.3 covers the controls which are shared by both. A new annex, Annex B, is included to give guidance on implementation. The revision also updates the standard to address evolving privacy risks and modern processing environments. Examples of this could include biometric and health data, Internet of Things devices, and the privacy risks resulting from artificial intelligence.

A companion standard, ISO/IEC 27706:2025, sets the requirements certification bodies must meet to audit a PIMS, replacing ISO/IEC TS 27006-2:2021.

Why is ISO/IEC 27701 important?

Privacy law tells organizations what outcomes to achieve, but rarely tells them how. The General Data Protection Regulation (GDPR) requires appropriate technical and organizational measures; however, neither the GDPR nor the UK Data Protection Act 2018 specifies what those measures are.

The cost of a gap is measurable. GDPR penalties reach €20 million or 4 percent of the company's total global revenue for the preceding financial year, whichever is higher. IBM's 2026 report found that post-breach response costs, including fines and legal fees, rose 15 percent year over year.

Benefits of ISO 27701

Regulatory defense gets the most attention, but the real payoff shows up in commercial and operational terms:

• Evidence for contracts. Agreements that involve the transfer of personal data are now requiring clear privacy safeguards. A PIMS certificate provides a form of documentation for the processing of PII that is accepted by counterparties and their auditors.

• Support for multiple regulations. A PIMS provides a common framework for assessing privacy controls across multiple regulatory requirements.

• Clear controller and processor roles. Annex A separates the two sets of obligations, which clarifies who owns which control in a processing chain.

• Consistent processing practices. Organizations spanning business units or jurisdictions apply one rule set for how they obtain, use, share, and delete PII.

• Reuse of an existing information security management system (ISMS). The 2025 edition uses ISO/IEC 27001:2022 and ISO/IEC 27002:2022 terminology, so an existing ISMS can absorb privacy governance instead of duplicating it.

Who should use ISO/IEC 27701?

Any organization that determines the purposes and means of PII processing (a controller), or processes PII on another organization's behalf (a processor), is within scope. The following three groups have the strongest case for certification:

• Processors and cloud service providers whose customers ask for proof of privacy controls during procurement.

• Organizations operating across jurisdictions, where a single international standard can help streamline a patchwork of local attestations.

• Organizations already certified to ISO 27001 that hold significant volumes of personal data. The management system exists; the privacy layer extends it.

What is a PIMS?

A privacy information management system is the set of policies, processes, controls, and records through which an organization governs PII across its lifecycle, from collection through processing, storage, and destruction. It runs on the Plan-Do-Check-Act cycle common to ISO management systems: define scope and context, assess privacy risk, implement controls, measure, audit, correct.

What distinguishes a PIMS from an ISMS is what each one protects. An ISMS protects information assets against loss of confidentiality, integrity, or availability. A PIMS governs the processing of personal data itself, including lawful basis, purpose limitation, consent, individual rights, retention and third-party transfers. A processing activity can be perfectly secure and still unlawful. The PIMS exists to catch that case.

Can ISO/IEC 27701 be used alone?

Under the 2019 edition, no. Certification was available only as an add-on to ISO 27001 and lapsed when the ISO 27001 certificate did. Under the 2025 edition, yes, an organization can implement and certify a PIMS with no ISMS behind it.

The fact that a standard is stand-alone doesn't mean that it has no connection with the rest. It still requires that information security controls should be in place to protect personal identifiable information (PII), and those organizations which hold ISO 27001 will discover that the common clause structure enables a combined audit. There are two deadlines as a result of this change. Organizations certified under the 2019 edition must carry out a transition audit before October 2028, which is three years after the publication date. Also, certification bodies themselves had to move to ISO/IEC 27706 before they can begin auditing according to the new edition.

ISO 27001 vs ISO 27701

The two standards share Clauses 4 through 10, a risk-based method, and the same Stage 1 and Stage 2 audit model. The difference is the question each answers. ISO 27001 asks whether information is protected. ISO 27701 asks whether personal information is processed lawfully, transparently, and for stated purposes. An organization running both can share its context analysis, leadership commitments, internal audit program, and management review, and most do.

How does ISO/IEC 27701 relate to the GDPR?

ISO 27701 is not an approved certification mechanism under GDPR Article 42. It offers a structured demonstration of accountability under Article 5(2). The 2019 edition mapped its controls to GDPR articles in Annex D; the 2025 edition retains a GDPR mapping alongside mappings to ISO/IEC 29100, ISO/IEC 27018 and ISO/IEC 29151.

For a controller, the mapping connects the principles set out in Article 5, the data protection by design requirement in Article 25, and the individual rights in Articles 12 through 22 to the controls in place together with the audit evidence supporting them; for a processor, it records the obligations under Article 28 which a controller must verify before signing a processing agreement; a certified PIMS can provide documented evidence of the measures an organization has implemented.

Requirements of ISO 27701

The requirements sit in two layers. The management system clauses (4 through 10) require the organization to define the PIMS scope and context, secure leadership commitment, and assess and treat privacy risk. They also require resources and competence, control operations, and performance evaluation and improvement. Annex A then specifies the privacy controls. In practice, an organization seeking certification must:

• Design, build and implement a PIMS covering the systems, locations, and processes involved in its PII processing, with a documented scope.

• Follow the standard's guidance when designing and implementing the PIMS, including the implementation guidance now in Annex B.

• Define controls for how PII is obtained, used, shared and deleted, covering purpose limitation, consent, records of processing, individual rights, and third-party transfers.

• Define appropriate roles, responsibilities, and controls for protecting PII based on the organization's privacy risks and processing activities.

Certification then follows the standard ISO pattern: a Stage 1 readiness review of documented information, a Stage 2 audit of implementation and effectiveness, annual surveillance audits, and recertification every three years.

ISO 27701 and Prescient Security

Prescient Security functions as an independent certification body and carries out conformity assessments with regard to ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001, ISO/IEC 20000-1, ISO 22301, and ISO 9001; its certification decisions are made on the basis of objective evidence gathered during structured Stage 1 and Stage 2 audits and then subject to surveillance and recertification cycles.

Conclusion

ISO/IEC 27701 has moved from an add-on to a standard in its own right. For organizations certified to the 2019 edition, the practical work is a gap analysis against the 2025 clause structure and Annex A, followed by a transition audit before October 2028. For organizations without ISO 27001, the barrier that kept privacy certification out of reach is gone. In both cases, confirm the certification body's own transition to ISO/IEC 27706 before scheduling an audit.

Learn how ISO 27701 can strengthen your privacy posture