ISO/IEC 27701 – the Privacy Information Management System

The standard defines requirements and implementation guidance for a PIMS: policies, roles, risk assessment and controls for the processing of personal data – each from the perspective of the organisation as a PII controller and/or PII processor. Like other management system standards, its clauses 4–10 follow the harmonised structure of the ISO management system standards: context, leadership, planning, support, operation, performance evaluation and improvement. The PIMS is therefore not a catalogue of measures but a continuously operated governance framework with defined responsibilities and documented evidence.

The second edition, published on 14 October 2025, replaces the 2019 version and turns ISO/IEC 27701 into a standalone standard: ISO 27001 certification is no longer a prerequisite for a PIMS certificate. In parallel, ISO/IEC 27706:2025 was published, setting out requirements for certification bodies performing PIMS audits; it replaces the previous ISO/IEC TS 27006-2. A three-year transition period applies: certification bodies must complete their own transition by the end of October 2027, and existing certificates issued against ISO/IEC 27701:2019 will lose their validity no later than the end of October 2028. Certified organisations should therefore factor the transition into their regular surveillance and re-certification cycles.

Standalone does not mean detached: the new edition is aligned with ISO/IEC 27001:2022 and ISO/IEC 27002:2022 and adopts their updated control language and terminology. For organisations with an existing ISMS, integration remains the obvious route – a shared context, a shared risk methodology and a Statement of Applicability extended to cover privacy, rather than a parallel structure. The harmonised clause structure also makes it easier to combine the PIMS with other management systems, for example ISO 9001 or ISO/IEC 42001. What is new is the freedom of choice: organisations without an ISMS certificate can start with the PIMS and add information security certification later.

The controls in the new edition are consolidated in a single Annex A and organised by role: 31 controls for PII controllers (including legal bases, consent, data subject rights, privacy by design and transparency), 18 controls for PII processors (including processing only in line with the customer agreement, supporting the controller, return and deletion, disclosures, and sub-processors), plus a third block of shared security controls for both roles. The previous split into Annex A (controller) and Annex B (processor) in the 2019 edition has been dropped; Annex B now contains implementation guidance. Determining your role remains a key scoping step: depending on the processing, many organisations are both and must consider both control sets.

ISO/IEC 27701 does not replace legal requirements, but it operationalises key GDPR obligations: a documented, audited PIMS supports accountability under Art. 5(2) GDPR and gives processors robust evidence of the “sufficient guarantees” required by Art. 28 GDPR – for example in DPA negotiations and customer audits. One important clarification: an ISO 27701 certificate is not a certification under Art. 42 GDPR; such mechanisms must be approved by the supervisory authorities or the European Data Protection Board. The PIMS certificate demonstrates a functioning management system – the legal assessment of individual processing activities remains unaffected.

The value is greatest for organisations that process personal data on behalf of customers and must regularly demonstrate this: processors, cloud and SaaS providers, and managed service providers, for whom PIMS evidence shortens due diligence reviews and contract negotiations. For companies with an existing ISO 27001 ISMS, the extension is the most efficient way to integrate privacy into established governance structures. Internationally active organisations benefit from the fact that the standard is designed to work across jurisdictions and can be applied to multiple privacy regimes. Since the :2025 revision, they are joined by organisations that deliberately want to start with the privacy management system without certifying an ISMS first.