What is ISO 27701?

Where ISO 27701 comes from

ISO/IEC 27701 is published by ISO and the International Electrotechnical Commission (IEC). The first edition appeared in 2019 as an extension to ISO/IEC 27001 and ISO/IEC 27002, adding privacy requirements to an existing information security management system.

The second edition, ISO/IEC 27701:2025, was published in October 2025. ISO lists the 2019 edition as withdrawn and superseded. The key change is that the standard is now an independent management system standard, which means an organization can use it on its own.

What is a privacy information management system?

A privacy information management system (PIMS) is the set of policies, roles, processes, controls and records an organization uses to manage personally identifiable information (PII). It covers how personal data is collected, used, stored, shared, retained and deleted, and how privacy risks are identified and treated.

A PIMS has to reflect how the organization really handles data. A payroll processor, a SaaS provider and a hospital all handle personal data differently, so ISO 27701 provides the management system and controls, while the organization decides how they apply to its own processing.

Why businesses use ISO 27701

Customers, regulators and enterprise buyers increasingly ask organizations to show how they protect personal data, not only to state that they do. Reasons organizations adopt ISO 27701 include:

• Evidence of accountability: documented roles, risk assessments, controls and reviews that can be audited
• A structured way to operationalize privacy laws such as GDPR, CCPA, LGPD and POPIA
• Faster responses to customer due diligence, tenders and security and privacy questionnaires
• Clearer handling of data subject requests, consent, retention and breach response
• Better control of vendors and sub-processors that touch personal data
• One management approach that can sit alongside ISO 27001

What changed in ISO/IEC 27701:2025

ISO/IEC 27701:2025 replaces the 2019 edition. The main changes are:

• Standalone standard: ISO 27701 is now an independent management system standard and can be implemented and audited without first certifying to ISO 27001
• Continued compatibility: organizations with an ISO 27001 information security management system can still integrate the two to avoid duplicated governance, audit and evidence work
• Updated structure and guidance: the revised text follows the current ISO management system structure and reflects modern privacy governance expectations
• Transition for existing certificates: organizations certified to the 2019 edition should confirm transition timelines with their certification body

Controllers, processors and the roles in the standard

ISO 27701 recognizes that responsibilities depend on the role the organization plays. A PII controller decides why and how personal data is processed. A PII processor processes personal data on behalf of a controller. Many organizations are both, depending on the service.

The standard provides controls for each role. Controller controls cover things like the basis for processing, consent, obligations to data subjects, privacy by design and by default, and sharing or transferring data. Processor controls focus on processing only under documented instructions, supporting the controller's obligations, and managing sub-processors and cross-border transfers. Information security controls apply to both.

Identifying your role is therefore one of the first practical steps, because it decides which controls apply to you.

Key components of a PIMS

A working PIMS built to ISO 27701 normally includes these building blocks.

• Scope, context and leadership: what is covered, who is accountable and how privacy is governed
• Privacy risk assessment, including privacy impact assessments where needed
• Privacy and security controls matched to your role as controller, processor or both
• Data subject rights handling: access, correction, deletion, portability and withdrawal of consent
• Vendor and sub-processor oversight, including data processing agreements
• Incident and breach response with clear escalation and reporting steps
• Training and awareness so staff understand their privacy responsibilities
• Monitoring, internal audit, management review and continual improvement

How ISO 27701 supports GDPR and other privacy laws

GDPR sets legal obligations for organizations that process personal data of people in the EU. ISO 27701 does not create or replace those obligations. It gives the organization a management system to show how they are assigned, operated, monitored and improved.

In practice, ISO 27701 can support work such as documenting lawful bases and retention practices, running privacy risk assessments, handling data subject requests, maintaining breach procedures and evidence for reporting timelines, and reviewing vendors and sub-processors. The same approach helps with other laws such as CCPA, LGPD and POPIA.

Certification to ISO 27701 does not make an organization automatically compliant with GDPR or any other law. Regulators, not certification bodies, decide legal compliance.

ISO 27701 and ISO 27001: how they relate

ISO 27001 manages information security: confidentiality, integrity and availability. ISO 27701 manages privacy: the lawful, fair and accountable handling of personal data. They overlap in areas such as risk management, access control, supplier management, incident response, internal audit and management review.

Since 2025 either can be implemented on its own. Organizations that already hold ISO 27001 can build on their existing governance and evidence and add the privacy-specific parts. Organizations that start with ISO 27701 can add ISO 27001 later. Many choose to run both together because the shared processes save effort and give management one view of security and privacy risk.

How to implement ISO 27701

The route depends on where you start, but a practical sequence is:

• Agree the scope of the PIMS and secure management commitment
• Work out whether you act as a PII controller, a processor or both
• Map where personal data is collected, stored, shared and deleted
• Assess privacy risks and decide how to treat them
• Select and implement controls for your role, and write the policies and procedures that support them
• Set up data subject request, consent, retention and breach processes
• Train staff and review your vendors and sub-processors
• Run the system, keep records, then perform an internal audit and management review
• Correct any findings and arrange the certification audit if you want it

What does ISO 27701 certification mean?

An accredited certification body assesses whether your PIMS meets the standard within a defined scope. The assessment normally has two stages: a review of documentation and readiness, then a main audit that checks the system works in practice. A certificate is then issued, followed by surveillance audits and recertification under the certification scheme.

Certification covers the management system, not every processing activity or a legal opinion on compliance. ISO does not issue certificates. Time and cost depend on size, scope, number of processing activities, the maturity of existing controls and whether you already run ISO 27001.

How ComplyEncrypt helps with ISO 27701

ISO 27701 is on the ComplyEncrypt roadmap. ComplyEncrypt is built to bring privacy documentation, processing records, role and risk registers, vendor evidence, internal-audit preparation and corrective-action tracking into an AI-assisted workflow, and to connect them with ISO 27001 and GDPR work so evidence is not duplicated.

AI assistance applies to documentation work. People still decide the organization's role, assess privacy risk, handle data subject requests and breaches, and carry out corrective actions, and certification remains the decision of an accredited body. See the ISO 27701 framework page for current availability.