ISO 27701
Also known as: ISO/IEC 27701, Privacy Information Management System, PIMS
ISO 27701 is an international standard for a Privacy Information Management System (PIMS).
The 2019 edition extended ISO 27001 and ISO 27002; the October 2025 edition made it a standalone standard that can be certified on its own or alongside ISO 27001. It provides specific controls for organizations acting as personal information controllers (who determine the purposes of processing) and personal information processors (who process data on behalf of controllers). ISO 27701 certification is increasingly accepted by regulators as evidence of GDPR-aligned privacy governance.
ISO 27701, explained at three levels
At home
ISO 27701 is like an extension pack for ISO 27001 that adds privacy protections on top of security protections. While ISO 27001 focuses on keeping information safe from unauthorized access, ISO 27701 adds requirements about respecting people's privacy rights, who is allowed to process personal data, for what purposes, for how long, and how people can exercise their rights to access or delete their information. Getting ISO 27701 certified helps organizations show regulators (like data protection authorities) that they take privacy seriously.
At work
Under the 2019 edition, ISO 27701 applied to organizations already certified to ISO 27001 that wanted to add formal privacy management; the 2025 edition can also be certified on its own. The 2019 edition added 49 controls specific to privacy: 31 for personal information controllers and 18 for personal information processors. These controls cover privacy policies, individual rights management, consent and purpose limitation, data transfer safeguards, privacy impact assessments, and breach notification. The combined ISO 27001/27701 certificate is issued by the same accredited certification body.
At home
ISO 27701's controls map directly to GDPR's core obligations. Organizations can use the GDPR mapping table (Annex D in the 2019 edition) to demonstrate which controls satisfy which GDPR articles: for example, ISO 27701 control 7.2.5 (addressing privacy impact assessments) maps to GDPR Article 35 (Data Protection Impact Assessment). While ISO 27701 certification does not automatically mean GDPR compliance (which is a legal determination made by supervisory authorities), it provides a structured, auditable framework for demonstrating compliance efforts.
At work
The standard distinguishes between two roles with different control sets: Personal Information Controllers (PICs) are organizations that determine the purposes and means of processing personal information (companies that collect and use customer data for their own purposes). Personal Information Processors (PIPs) are organizations that process personal information on behalf of a PIC (cloud service providers, payroll processors, data analytics vendors). This controller/processor distinction mirrors GDPR's Article 4 definitions and Article 28's requirement for data processing agreements.
At home
Under the 2019 edition, ISO 27701 certification required organizations to expand their existing ISO 27001 scope statement to include the PIMS, conduct a privacy risk assessment (in addition to the information security risk assessment), update the Statement of Applicability to include the 49 additional PIMS controls, and implement and provide evidence for all applicable controls. The certification audit follows the same two-stage process as ISO 27001 and is conducted by the same certification body, often in a combined audit.
At work
From a practitioner standpoint, ISO 27701 provides the most value to organizations that want to demonstrate privacy governance to multiple audiences simultaneously: regulators (using the GDPR mapping), customers (using the combined ISO 27001/27701 certificate), and internal stakeholders (using the PIMS framework for structured privacy program management). The challenge is that unlike ISO 27001 (which is technology-neutral), effective ISO 27701 implementation requires involvement from legal, HR, and business functions: it cannot be run as a purely IT project.
Real-world examples
At home
Marcus works at a company that processes personal data for insurance clients across Europe. The company held ISO 27001 certification and decided to pursue ISO 27701 to demonstrate GDPR alignment to their clients. Marcus helped map the company's existing privacy policies to the ISO 27701 controls, identified six gaps, and worked with the legal team to close them before the certification audit.
At work
The privacy team at Meridian Cloud Services (a SaaS provider) pursued ISO 27701 certification as part of their enterprise sales strategy. After achieving the combined ISO 27001/27701 certificate, they used the GDPR mapping in Annex D to respond to enterprise customer due diligence questionnaires more efficiently: many questions mapped directly to specific controls they could evidence through the audit.
How it compares
| Feature | ISO 27701 | ISO 27001 | GDPR |
|---|---|---|---|
| What it covers | Privacy Information Management System (PIMS) | Information Security Management System (ISMS) | Legal rights and obligations for personal data processing |
| Who issues it | Accredited certification body (standalone or combined with ISO 27001 since 2025) | Accredited certification body | European Data Protection Authorities (no certification) |
| Mandatory? | No: voluntary | No: voluntary | Yes: for organizations processing EU personal data |
| Geographic scope | Global | Global | EU and organizations processing EU residents' data |
| Primary use | Structured privacy governance; GDPR evidence | Security management; customer assurance | Legal compliance obligation |
ISO 27701 is a voluntary management system standard that provides structured evidence of privacy governance. GDPR is a mandatory legal framework. ISO 27701 certification does not guarantee GDPR compliance but demonstrates a structured, auditable approach to meeting GDPR's core obligations.
For analysts
In BA artefacts, ISO 27701 requirements generate privacy-specific NFRs alongside standard security NFRs. When documenting requirements for any system that processes personal data, ask whether the organization holds or is pursuing ISO 27701 certification: if so, requirements must address the PIMS controls relevant to that system, including consent management, individual rights workflows, retention and deletion, and Data Protection Impact Assessments for high-risk processing. Useful NFR: 'The system must support the exercise of data subject rights (access, rectification, erasure, portability) within the timeframes specified in the privacy policy, with a workflow that routes requests to the designated Privacy Officer for processing.'
History & origin
ISO 27701 was published in August 2019, developed in response to the explosion of global privacy regulation (particularly GDPR (2018)) and the need for an internationally recognized management system standard for privacy. Before ISO 27701, organizations had ISO 27001 for information security but no equivalent standard specifically for privacy management. The standard was built as a direct extension of ISO 27001 (and ISO 27002 for implementation guidance), meaning organizations needed ISO 27001 to certify to it. The October 2025 revision made ISO 27701 a standalone management system standard, and 2019 certificates must transition by October 2028.