ISO 27701 explained: privacy management, the GDPR and what changed in 2025

ISO/IEC 27701 is the international standard for a privacy information management system (PIMS): a management system that lets an organization control how it processes personal data and demonstrate that it does. Until October 2025 the standard was an extension to ISO 27001. Since the 2025 edition it is a standalone management system standard that can be certified without an ISO 27001 certificate. Much of what is written about ISO 27701 online still describes the old situation. This article covers what the standard requires, what changed in 2025, how it relates to the GDPR and what an auditor looks at.

What ISO 27701 covers

ISO 27001 deals with information security in the broad sense: the confidentiality, integrity and availability of all of an organization's information. ISO 27701 focuses on one type of information, personal data, and adds a second risk perspective. Under ISO 27001 you look at the risk to the organization. With privacy you also look at the risk to the data subject, the person the data is about. A breach that does the organization little harm can be serious for the people affected, and a PIMS should make that difference visible in the risk assessment.

In substance the standard asks for things an organization with GDPR obligations should largely have already: an inventory of processing activities with purpose and legal basis, a method for privacy impact assessments, procedures for data subject requests, agreements with processors, retention periods and a process for reporting breaches. The difference lies in the management system. The standard expects each of these to be assigned to an owner, reviewed periodically, covered by internal audit and improved when it does not work.

The 2025 edition stands on its own

ISO/IEC 27701:2019 was built as an extension. Its requirements were written as additions to the clauses of ISO 27001 and the controls of ISO 27002, and certification was only possible on top of an ISO 27001 certificate. ISO/IEC 27701:2025 was published on 14 October 2025. It follows the common structure of management system standards, with its own clauses 4 to 10 covering context, leadership, planning, support, operation, performance evaluation and improvement, and its own Annex A with controls. An organization can now have a PIMS certified without an ISMS certificate.

Combining it with ISO 27001 remains the usual route. An organization that already runs an ISMS will normally build the PIMS into it. The structure is the same, so policy, risk assessment, internal audit and management review can share one cycle.

Organizations holding a certificate against the 2019 edition have a transition period of three years from publication. Certification bodies give October 2028 as the end date. Your own certification body can confirm the exact arrangements, including how long audits against the old edition remain possible.

Controller or processor

Like the GDPR, the standard distinguishes between the PII controller, who determines the purposes and means of processing, and the PII processor, who processes on the controller's behalf. Each role has its own controls. A controller must, among other things, record the legal basis for each processing activity, inform data subjects and be able to honour their rights. A processor must, among other things, process only on instruction, disclose sub-processors and return or delete data at the end of the engagement.

Many organizations have both roles. They are controller for their own employee and customer data and processor for the data customers place in their service. A SaaS provider is the typical example. Determining the role per processing activity is then the first thing an auditor asks about, because the choice of controls depends on it. You record which controls apply and why in a statement of applicability, in the same way as the Statement of Applicability for ISO 27001.

How the standard relates to the GDPR

ISO 27701 is a standard and the GDPR is law. A certificate does not prove that an organization complies with the GDPR. Nor is it a certification within the meaning of Article 42 GDPR: that requires a certification mechanism approved by a supervisory authority or by the European Data Protection Board, and ISO 27701 is not one.

What a certificate does support is the accountability principle in Article 5(2) GDPR. That principle requires an organization to be able to demonstrate compliance, and an externally audited management system is an orderly way to do so. The overlap with specific articles is substantial: the record of processing activities (Article 30), the data protection impact assessment or DPIA (Article 35), the processor agreement (Article 28), breach notification (Article 33) and the security requirement of Article 32.

Some parts of the GDPR fall outside what a management system can cover, such as the legal question of whether a legal basis holds up, or whether a data protection officer is mandatory. There the standard governs the process by which you reach a decision. Whether that decision is legally sound is not something a certification body assesses.

What an auditor looks at

An auditor assessing a PIMS starts with the record of processing activities and checks whether it matches what the organization actually does. A record that has not been updated for two years while new systems were introduced stands out quickly. Samples follow: a completed access request with the dates of receipt and response, a DPIA for a new processing activity, an incident that was or deliberately was not reported with the reasoning behind it, and the processor agreements with the most important suppliers.

The recurring weak point is the supply chain. Organizations have signed agreements with their processors but cannot show that they check whether the processor complies. How to assess suppliers and what evidence to ask for is covered in the article on third-party risk management. A second weak point is retention periods that exist in policy but were never configured in the systems, so the data simply stays.

Certification: standalone or together with ISO 27001

Certification follows the pattern of other management system standards: a stage 1 audit of design and documentation, a stage 2 audit of operation, annual surveillance audits and recertification after three years. Organizations that already hold ISO 27001 usually have the PIMS assessed by the same certification body, combined with a surveillance or recertification audit. That avoids duplicate work on the shared elements. The rest of an ISO 27001 project is described in the ISO 27001 certification roadmap.

Standalone ISO 27701 certification can suit an organization whose customers mainly ask about privacy, or that already demonstrates its information security in another way, for example with an ISAE 3402 or SOC 2 report. The security controls for personal data then have to be set up and shown to work within the PIMS itself, because there is no ISMS to refer to.

When ISO 27701 is worth it

The standard is not a legal requirement anywhere. The trigger is usually a customer or tender asking for evidence that personal data is properly managed. That mostly applies to processors handling large volumes of their customers' personal data, such as suppliers of HR and payroll software or of systems used in healthcare. For such a processor a certificate can replace part of the questionnaires and audits that customers would otherwise carry out themselves.

For an organization that is mainly a controller and faces no external demand, a well-run privacy programme without a certificate may be enough. The question is whether the discipline of an audit cycle is worth the effort. If you are unsure, start with a gap analysis against the standard before involving a certification body. That shows how far your existing GDPR documentation already goes and what is missing on the management system side.