ISO/IEC 27701:2025 Privacy information management system
Prove with an international certificate that you handle personal data responsibly — as a controller, a processor or both.
- new edition
- 2025
- standalone system
- PIMS
- evidence of compliance
- GDPR
- certificate validity
- 3 yrs
ISO/IEC 27701:2025 is now a standalone standard
The second edition was published in October 2025. The biggest change: 27701 is no longer an extension of ISO/IEC 27001 and can be certified on its own.
Certificates to the 2019 edition must move to the new one within a transition period that certification bodies set until 2028. The edition places stronger emphasis on leadership, privacy governance and personal data in AI and digital ecosystems.
What is ISO/IEC 27701
ISO/IEC 27701 sets the requirements for a privacy information management system (PIMS). It turns data protection principles into working processes — roles, responsibilities, controls and evidence.
The standard distinguishes the obligations of controllers and processors of personal data and is aligned with regulations such as the GDPR.
Since 2025 it can be implemented on its own or together with ISO/IEC 27001 — the combination is the strongest proof of security and privacy.
Controller, processor — or both?
ISO/IEC 27701:2025 splits its controls by role. Pick yours and see how many of the 78 controls apply to you.
- Controller controls 31
- Processor controls 18
- Online shop
- Clinic and lab
- Bank and insurer
- School and university
- Hosting and cloud
- SaaS platform
- Payroll outsourcing
- Call centre
- Accounting firm
- Marketing agency
- IT support
The journey of one record — from sign-up to erasure
Maria places an order in an online shop. This is how a PIMS protects her data at every step — and how you prove it.
Collection
Maria signs up and orders.
- Lawful basis
- Privacy notice
- Separate marketing consent
Minimisation
The form asks only for what is needed — no national ID.
- Data minimisation
- Record of processing
- Role-based access
Sharing
The courier gets only name, address and phone.
- Processor agreement
- Only the fields needed
- Supplier assessment
Storage
Data sits in an EU cloud — encrypted.
- Encryption
- Retention period
- Backups
Request
Maria asks for her data to be erased.
- Data subject rights procedure
- Identity check
- Reply within 1 month
Erasure
Erased everywhere — at the courier too.
- Proof of erasure
- Recipients notified
- Logged in the register
GDPR says what. ISO 27701 shows how.
The regulation sets the obligations. The standard turns them into processes, responsibilities and evidence that stand up to a supervisory authority.
Art. 5 Principles Privacy policy, minimisation and retention periods Art. 6–9 Lawful basis A defined basis for every purpose, consent management Art. 12–22 Data subject rights Procedure, deadlines and templates for access, rectification, erasure Art. 24–25 Accountability and data protection by design Risk assessment, leadership and protection by default Art. 28 Processors Contracts, assessment and control of sub-processors Art. 30 Record of processing A register maintained as part of the system Art. 32 Security Shared security controls, compatible with ISO 27001 Art. 33–34 Personal data breaches Incident procedure — notification within 72 hours Art. 35 DPIA Impact assessment for high-risk processing Art. 44–49 Transfers outside the EU Transfer control and appropriate safeguards A working system, not a folder of documents
Everything an auditor or the authority may ask for — and that your team actually uses.
Free consultation- Defined roles — controller and/or processor
- Record of processing activities
- Privacy policy and notices
- Privacy risk assessment and DPIA
- Data subject rights procedure with templates
- Processor and sub-processor agreements
- Breach procedure — 72 hours
- Team training and internal audit
Security and privacy — in one system
ISO 27701 can now be certified on its own, but it is strongest in combination.
The structure of the standard
The 2025 edition follows the common management system structure — clauses 4–10 plus controls divided by role.
Clause 4 — Context of the organisation
Your role — controller, processor or both — interested parties, applicable laws, scope.
Clause 5 — Leadership
Management commitment, privacy policy, roles and responsibilities.
Clause 6 — Planning
Assessment and treatment of risks to personal data and to data subjects, objectives.
Clause 7 — Support
Resources, competence, awareness, communication, documented information.
Clause 8 — Operation
Applying privacy controls and data subject rights.
Clause 9 — Performance evaluation
Monitoring and measurement, internal audit, management review.
Clause 10 — Improvement
Personal data incidents, corrective action, continual improvement.
What the controls cover
Controls are divided by role — controller or processor — and turn GDPR requirements into daily practice.
- 01
Lawful basis and purposes
Why and on what basis each category of data is processed.
- 02
Data subject rights
Access, rectification, erasure, portability — with procedures and deadlines.
- 03
Minimisation and retention
Only the data needed, only for as long as needed.
- 04
Processors and transfers
Contracts, sub-processors and transfers outside the EU.
- 05
Impact assessment
Data protection impact assessment (DPIA) for high-risk processing.
- 06
Personal data breaches
Detection, documentation and notification within the legal deadline.
What you gain
GDPR evidence
Structured evidence for clients and supervisory authorities.
Client trust
Especially when processing data on behalf of clients.
An edge in tenders
An internationally recognised privacy certificate.
Order in your data
You know what data you hold, where it is and who can access it.
Breach readiness
A rehearsed response and notification procedure.
Synergy with ISO 27001
Shared risk, audit and improvement processes.
The route to certification
Six stages with a clear deliverable at each.
- 01 1–2 wks
Data mapping
Record of processing activities and data flows.
- 02 1–2 wks
Roles and lawful bases
Controller or processor, bases, purposes.
- 03 2–3 wks
Risk and DPIA
Assessment of risks to data subjects.
- 04 2–4 wks
Policies and procedures
Subject rights, retention, breaches, processors.
- 05 1–2 wks
Internal audit
Verification and management review.
- 06 Stage 1 + 2
Certification audit
Stage 1 and Stage 2 by an accredited body.
Timeline and cost — what drives them
The cost depends mainly on the volume and sensitivity of the data. These are the factors — plus an estimator.
Employees and sites
Set the workload and audit days.
Volume and sensitivity
Special categories of data need more controls.
Role
Controller, processor or both.
Existing ISO 27001
Significantly shortens implementation.
Transfers outside the EU
Cloud services and suppliers in third countries.
Certification fee
Paid separately to the certification body.
01 Do I need ISO 27001 to get ISO 27701?
Since the 2025 edition — no. ISO/IEC 27701 is now a standalone standard. The two complement each other, though, and are often implemented together.
02 Does a 27701 certificate mean GDPR compliance?
Not automatically — GDPR compliance is assessed by supervisory authorities. The certificate is strong evidence that you run a working data protection system.
03 What happens to 2019 certificates?
They must move to the 2025 edition within the transition period set by certification bodies (until 2028).
04 Is it suitable for small companies?
Yes, especially if you process data on behalf of clients — for example IT, accounting, marketing or HR services.
05 How long does it take?
Usually 2 to 5 months; less if you already have ISO 27001.
No such question in the list — ask us directly and we will reply.
Your first consultation is free
Tell us about your company and your goal. You will get a clear plan and a quote within one business day.