ISO 27701: The Privacy Management Standard Explained

ISO/IEC 27701 is the international standard for managing privacy. It sets out how an organisation should govern, protect and account for personally identifiable information (PII), whether it decides how that data is used (a controller) or processes it for someone else (a processor). The 2025 edition turned ISO 27701 into a standalone management system standard. It is voluntary and certifiable.

What is ISO 27701?

ISO 27701 defines a privacy information management system (PIMS). Like ISO 27001 for security, it follows the common ISO management system structure:

• Clauses 4 to 10 set requirements for context, leadership, planning, support, operation, performance evaluation and improvement, applied to privacy.
• Annex A lists privacy controls, organised for PII controllers, PII processors, and controls that apply to both.
• Guidance explains how to implement the controls.

What changed in 2025? The 2019 edition was an extension of ISO 27001: you could only be certified to it together with ISO 27001. ISO/IEC 27701:2025 is a standalone standard with its own management system clauses, so an organisation can now hold an ISO 27701 certificate on its own. Integrating it with an existing ISO 27001 ISMS remains common and efficient.

History and why it was introduced

ISO 27701 was introduced because privacy laws multiplied after the GDPR and organisations needed a single, auditable framework that worked across countries. The 2025 revision made it usable by organisations that don’t run an ISO 27001 ISMS, and aligned it with the current ISO management system structure.

Main objectives:

1. Provide a management system for privacy that works across jurisdictions.
2. Clarify the different responsibilities of controllers and processors.
3. Give organisations an independent way to demonstrate privacy accountability.
4. Help map privacy controls to laws such as the GDPR.

Who needs ISO 27701?

Geography: used worldwide, with notable demand in Europe, India, the Middle East and APAC, where buyers look for evidence of GDPR and local privacy law readiness.

Is ISO 27701 mandatory?

No law requires ISO 27701. It becomes required in practice when a customer contract or tender demands it. It doesn’t make you compliant with any privacy law by itself, but it is strong evidence of accountability under laws like the GDPR (Article 5(2) and Article 24) and India’s DPDP Act.

Key requirements

Management system (clauses 4 to 10)

Controls

The controls cover three groups:

You decide which controls apply based on your role and your risk assessment, and you justify exclusions in the Statement of Applicability.

How to implement ISO 27701

1. Decide your scope and roles. Which products, services and processes, and whether you act as controller, processor or both for each.
2. Identify applicable laws and contracts, such as the GDPR, the DPDP Act, US state laws and customer data processing agreements.
3. Map personal data: categories, purposes, systems, transfers and retention. This becomes your record of processing.
4. Run a privacy risk assessment, considering risks to individuals, not only to the company.
5. Choose controls and write the Statement of Applicability.
6. Build processes: privacy notices, data subject requests, privacy impact assessments, privacy by design reviews, breach handling, sub-processor management and deletion.
7. Integrate with ISO 27001 if you have it: share the document control, internal audit, management review and corrective action processes.
8. Train staff in privacy responsibilities.
9. Run an internal audit and management review.
10. Book a certification audit with an accredited certification body.

Documentation and policies

• PIMS scope and statement of roles (controller, processor)
• Privacy policy and topic-specific procedures
• Records of processing and data flow maps
• Privacy risk assessment and treatment plan
• Statement of Applicability
• Privacy impact assessment procedure and completed assessments
• Privacy notices and consent records
• Data subject request procedure and log
• Data processing agreements and sub-processor list
• Retention and deletion schedule
• Breach response procedure and register
• Training records, internal audit reports and management review minutes

Audits and certification

Certification works like ISO 27001:

1. Stage 1 audit: the certification body reviews your documentation and readiness.
2. Stage 2 audit: it tests whether the PIMS operates as described.
3. Certificate: valid for three years, with surveillance audits in years one and two and recertification in year three.

Certification bodies must be accredited for ISO 27701 by a national accreditation body. If you hold a certificate to the 2019 edition, ask your certification body about its transition plan to the 2025 edition.

Cost

Benefits

• Independent evidence of privacy accountability for customers and regulators.
• Clear split of controller and processor duties, which simplifies contracts.
• One framework that maps to many privacy laws.
• Efficient to add to an existing ISO 27001 ISMS.
• Better privacy risk decisions in product development.

Risks of not having it

• Longer privacy questionnaires and procurement cycles.
• Losing tenders that score or require privacy certification.
• Inconsistent privacy practices across teams and countries.

Common mistakes

• Treating it as a security project. ISO 27701 is about how personal data is used, not just how it is protected.
• Getting roles wrong. Many SaaS companies are processors for customer data and controllers for their own marketing and employee data, and need both sets of controls.
• Skipping the data map. Without it, risk assessment and the Statement of Applicability are guesswork.
• Assuming certification equals GDPR compliance. It supports compliance but doesn’t replace legal analysis.
• Ignoring deletion in backups, logs and sub-processors.

Challenges for IT companies

• Personal data spread across many microservices, analytics tools and logs.
• Fast-changing sub-processor lists, including AI providers.
• Customers with different contractual privacy terms.
• Supporting multiple laws with different rules for consent, children’s data and transfers.

Best practices

• Combine ISO 27701 with ISO 27001 in one integrated management system.
• Build privacy impact assessments into product design reviews.
• Automate deletion and keep evidence that it works.
• Publish a sub-processor list and change notification process.
• Use ISO 27018 guidance if you are a public cloud processor.

Tools that help

How ISO 27701 relates to other frameworks

Real-world examples

• Cloud providers. Major cloud providers list ISO 27701 among their certifications in their public compliance centres.
• Indian IT services. Large Indian IT and BPO firms that process European personal data commonly pursue privacy certification alongside ISO 27001 to meet client expectations.
• Illustrative scenario, not a real company: an edtech SaaS company with an ISO 27001 certificate adds ISO 27701 as a processor and controller. It reuses its internal audit and management review, builds a data map and DPIA process, and passes a combined surveillance and ISO 27701 audit.

Frequently asked questions

Can we get ISO 27701 without ISO 27001? Yes, under the 2025 edition, which is a standalone standard. Under the 2019 edition, ISO 27001 was required.

Does ISO 27701 make us GDPR compliant? No single certificate does. It provides strong evidence of accountability and covers many GDPR requirements.

Is ISO 27701 mandatory? No. It is voluntary, but customers may require it.

What is a PIMS? A privacy information management system: policies, processes, roles and controls for managing personal data.

How long is the certificate valid? Three years, with yearly surveillance audits.

Do we need to be a controller or a processor? Neither is required. You apply the controls that match your role, and many organisations are both.

How is ISO 27701 different from ISO 27018? ISO 27018 is guidance for public cloud providers processing PII. ISO 27701 is a full, certifiable management system for any organisation.

Next steps

• Decide whether you act as controller, processor or both for each service.
• Build or update your record of processing.
• Run a gap assessment against the ISO 27701 clauses and controls.
• Ask your ISO 27001 certification body about a combined audit.