What is ISO/IEC 27701?
ISO/IEC 27701 specifies requirements and guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS). The first edition of 2019 was an extension of ISO/IEC 27001 and ISO/IEC 27002. An organisation took its working Information Security Management System and added personal data protection, from risk assessment that considers harm to individuals, through lawful bases for processing, to fulfilling data subject rights.
In October 2025 the ISO/IEC 27701:2025 edition was published. It is a standalone standard based on the harmonised management system structure (Annex SL) that can be certified without ISO/IEC 27001. Certificates issued against the 2019 edition have a transition period, most often given as ending in October 2028. The Guardiso module follows the 2025 edition: clauses 4 to 10 and the three control tables of Annex A.
Who is it for?
The standard is voluntary and can be implemented by any organisation processing personal data — regardless of size, industry or jurisdiction. The most common adopters are companies for which trust in personal data processing is a business prerequisite: SaaS and cloud service providers, technology companies handling their customers’ customer data, the financial and healthcare sectors, shared service centres, and organisations processing large volumes of employee and consumer data.
A distinguishing feature of ISO/IEC 27701 is the role-based split of controls. In the 2025 edition, Table A.1 of Annex A contains controls for PII controllers, Table A.2 for PII processors and Table A.3 controls shared by both roles. An organisation applies the tables matching its actual role in each processing activity. The 2025 edition can be certified on its own, and a company with a working ISO/IEC 27001 reuses much of the same documentation.
Structure of the requirements
The 2025 edition shares its structure with other management system standards. Clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement. They also include a privacy risk assessment that considers harm to PII principals, and the Statement of Applicability.
Annex A has three tables. Table A.1 covers PII controllers: purpose and lawful basis of processing, consent, privacy impact assessment, processing records, privacy notices, data subject rights, minimisation, retention and transfers. Table A.2 covers PII processors: processing only on the customer’s instructions, return or deletion of data, a disclosure register and oversight of subcontractors. Table A.3 contains 29 controls relevant to both roles, for example access rights, cryptography, logging and incident response.
ISO 27701 and the GDPR
ISO/IEC 27701 does not replace the GDPR and is not a formal certification mechanism under Article 42 GDPR — the certificate is not legal proof of compliance with the regulation. It is, however, one of the strongest available accountability tools (Article 5(2) and Article 24 GDPR): an independent, annually verified privacy management system makes it much easier to demonstrate that controller or processor obligations are met systematically rather than ad hoc.
The standard was designed with the GDPR in mind — its requirements correspond to the regulation’s key obligations: lawful bases (Article 6), consent (Article 7), information duties (Articles 13-14), data subject rights (Articles 15-22), the record of processing activities (Article 30), security of processing (Article 32), breach notification (Articles 33-34), DPIAs (Article 35), processing agreements (Article 28) and transfers (Chapter V). The 2019 edition had a table of links to GDPR articles in Annex D, and Guardiso reflects these relationships in its control cross-mapping.
What does certification look like?
The ISO/IEC 27701 certificate is issued by an accredited certification body. Under the 2025 edition certification can be standalone, while under the 2019 edition it was always tied to ISO/IEC 27001 certification. The audit has two stages: Stage 1 reviews the PIMS documentation (scope, controller/processor roles, record of processing activities, DPIAs, policies), and Stage 2 verifies implementation through sampling — the auditor will trace, for example, the handling of real data subject requests, consent records and breach handling.
The certification cycle is three years, with annual surveillance audits and recertification before the end of the cycle. With a combined ISO 27001 audit both cycles can be synchronised. Organisations planning certification should account for the transition to the 2025 edition: new certifications against the 2019 edition will be phased out, and existing certificates must transition by October 2028.
What are the benefits?
Implementing a PIMS consolidates personal data protection into one managed system instead of scattered "GDPR paperwork", and delivers tangible business benefits.
- Independently verified proof of GDPR accountability — a strong argument with corporate customers, supervisory authorities and in due diligence questionnaires.
- Shorter data processing agreement negotiations: a certified PIMS answers most customer questions about data protection at a processor.
- One coherent set of documentation instead of duplication: risk assessment, incidents, suppliers and training shared between information security and privacy.
- Lower risk of breaches and fines through a systematic approach to minimisation, retention and individual rights — instead of reacting only after a complaint or inspection.
- A competitive edge in tenders and sales to regulated sectors where data protection is a supplier selection criterion.
How does Guardiso help?
Guardiso guides you through the ISO/IEC 27701 implementation and reuses the work already done for ISO 27001 and GDPR, without duplicating documentation.
- The full set of 103 requirements of the 2025 edition (clauses 4 to 10 and Tables A.1, A.2 and A.3 of Annex A) seeded automatically when you enable the standard, with descriptions, statuses and owners, and a document for every requirement.
- Cross-mapping to ISO 27001 and GDPR: work done in the ISMS and GDPR modules automatically counts towards overlapping PIMS requirements, and gaps are clearly visible.
- Privacy registers in one place: the record of processing activities, DPIAs, consents, data subject requests and breaches — linked to controls and evidence.
- Data protection policies and procedures generated from templates and tailored to the controller or processor role.
- Compliance evidence collection (training records, access reviews, breach procedure tests) with recurring tasks and automation.
- An auditor portal with controlled access to the PIMS documentation — no files emailed around.