Privacy
ISO/IEC 27701:2025 — Privacy information management systems
The certifiable standard for privacy information management (PIMS): structured proof of your GDPR compliance.
At a glance
- Type
- International standard, certifiable
- Publisher
- ISO / IEC
- Edition
- 2025
- Regulatory link
- GDPR mapping in an annex
108 requirements tracked · 120 shared controls
What is ISO 27701?
ISO/IEC 27701 sets out the requirements of a privacy information management system (PIMS) for organisations processing personal data as controllers, processors, or both.
The 2025 edition follows the harmonised structure of management system standards (clauses 4 to 10) and groups 78 controls in its Annex A: 31 for controllers, 18 for processors and 29 shared security controls. It can be certified on its own or together with an ISO/IEC 27001 ISMS, and its annexes map it to the GDPR.
Key requirements
- 1
PIMS roles and scope
Determine for each processing whether the organisation acts as controller or processor, and set the scope.
- 2
Privacy risk assessment
Assess the risks to data subjects, in addition to the risks to the organisation.
- 3
Controller controls
Conditions for collection, lawful bases, information, data subject rights, privacy by design, sharing and transfers.
- 4
Processor controls
Follow customer instructions, assist with rights and breaches, sub-processing, return or deletion of data.
- 5
Evaluation and improvement
Indicators, internal audit, management review and corrective actions, as for any management system.
Summary written by OK-GRC. The texts of ISO standards are protected by copyright and are not reproduced.
How OK-GRC helps
- ISO 27701 requirements linked to 120 common controls, shared with the GDPR and ISO 27001
- Records of processing, DPIA, data subject requests and breaches: the day-to-day evidence of the PIMS
- Statement of Applicability and justification of exclusions
- Data protection policy, rights procedure and data processing agreement template
- Internal audits, management review and corrective actions shared with your other standards
Related frameworks
With ISO 27001 controls in place, your ISO 27701 starting score is about 49 to 65%.
The controls you put in place for ISO 27701 also count for:
Frequently asked questions about ISO 27701
Do we need ISO 27001 certification before ISO 27701?
Not anymore: since the 2025 edition, ISO/IEC 27701 can be certified on its own. In practice, combining it with an ISO 27001 ISMS is often the most efficient path, because many security controls are shared.
Does ISO 27701 guarantee GDPR compliance?
No, a certification is not legal compliance. It does demonstrate an organised approach verified by a third party, which is useful under the accountability principle.
Informational content up to date as of October 2026; it does not constitute legal advice. Always check the official texts in force.
Ready to simplify your compliance?
Create your workspace in minutes. The assistant suggests the frameworks and priorities that fit your company.
14-day trial with every Pro feature · Nothing charged before the trial ends · No commitment