ISO/IEC 27701 Privacy Information Management System (PIMS)

Personal information moves across collection, use, outsourcing and deletion, involving different teams and service providers. A privacy information management system (PIMS) helps an organization clarify processing purposes, roles, risks and responsibilities so that policies become part of everyday work. This guide summarizes the 2025 edition, key clauses and transition preparation.

Discuss privacy management and transition needs

1. Revision overview and transition timing

ISO/IEC 27701:2025 was published on 14 October 2025, replacing the 2019 edition. The new edition is a standalone management-system standard that can be implemented and certified independently or integrated with ISO/IEC 27001. An ISO/IEC 27001 certificate is no longer a prerequisite. ISO/IEC 27002 is a control guideline, not a management-system certificate that an organization must obtain first. ISO catalogue

The new edition follows the ISO harmonized management-system structure (Annex SL). Clauses 4–10 cover organizational context, leadership, planning, support, operation, performance evaluation and improvement. The 2019 edition already included privacy-risk and governance requirements; the main change is a complete, standalone PIMS structure and a reorganization of controls and guidance.

PIMS applies to personally identifiable information (PII) controllers and processors. An organization may act in both roles across different business activities and should determine its role for each actual processing activity. A system can support the management of applicable privacy obligations, but certification does not automatically demonstrate compliance with GDPR, CCPA, LGPD or every jurisdiction's laws.

2019 certificates and transition arrangements

Replacement of a standard and the date an existing certificate loses accreditation status are separate matters. A transition deadline set by one accreditation scheme must not be applied to every certificate. Public arrangements checked for this page include:

Sources: UKAS transition notice and ENAC transition plan. Obtain a written transition plan from the current certification body and allow time for corrective actions and the certification decision. Whether transition can be combined with surveillance or recertification, and any additional audit time, depends on the scheme handling the application.

The role of ISO/IEC 27706:2025

ISO/IEC 27706:2025 specifies requirements for bodies auditing and certifying PIMS. It is used with ISO/IEC 17021-1 and replaces ISO/IEC TS 27006-2:2021. Organizations apply for ISO/IEC 27701 certification; ISO/IEC 27706 governs the competence and operation of certification bodies. ISO 27706 information

2. Overview of the revisions

1. Standalone management-system status: The standard no longer operates only as an extension dependent on an ISMS. A PIMS scope can be defined according to the organization's personal-data activities.
2. Complete management framework: Clauses 4–10 establish PIMS requirements of its own and can be integrated with existing management reviews, audits and document processes.
3. Reorganized controls and guidance: Annex A consolidates controls, Annex B provides implementation guidance, and Annex F helps compare the old and new editions.
4. Personal-data security still matters: Standalone operation does not remove information-security responsibilities. Privacy-risk treatment must connect to appropriate information-security measures.
5. Change planning: Clause 6.3 addresses planned PIMS changes. In practice this can apply to changes in data purposes, platforms, suppliers or organizational responsibilities.
6. Updated scope and evidence: Check how controller/processor roles, the Statement of Applicability (SoA), risks and process evidence fit together. Existing arrangements that remain effective may be retained.

3. Clause-by-clause guide (Clauses 4–10)

The examples of forms, indicators and work methods below are practical preparation ideas. Adapt them to the organization's size, processing activities and applicable requirements.

4. Context of the organization

• 4.1 Organizational context: Analyze internal and external issues affecting the PIMS, such as data purposes, technology, operating models and the regulatory environment; determine whether climate change is a relevant issue.
• 4.2 Interested parties: Identify data subjects, customers, partners, regulators and others connected with PII processing, and determine which needs the system must address. Relevant parties may also have climate-related requirements.
• 4.3 Scope: Describe the included activities, services, sites, data flows and processing roles, and review interfaces with external services.
• 4.4 Management system: Establish, implement, maintain and continually improve the PIMS and its necessary processes.

Practical review: Trace one recruitment, marketing or outsourced-processing activity from data source through purpose to recipient. Confirm that the declared scope matches the actual process. First determine which local laws apply; do not assume that every law applies everywhere.

5. Leadership

Top management should demonstrate leadership and commitment, establish a privacy policy, provide resources and integrate PIMS requirements into business processes. Roles, responsibilities and authorities should be clear and communicated across the organization.

Legal, information technology, human resources, marketing and operations can jointly manage data flows and decisions. The earlier edition already included leadership responsibilities; the new standalone structure still requires evidence of management involvement and system effectiveness.

6. Planning

• 6.1.2 Privacy risk assessment: Establish consistent methods and criteria that consider the effects of personal-data processing on individuals as well as information-security risks to PII.
• 6.1.3 Privacy risk treatment: Select necessary controls and treatment actions, establish a Statement of Applicability (SoA), and document relevant information-security measures. Annex A is a comparison basis; other sources or organization-designed controls may be added when needed.
• 6.2 Privacy objectives: Set objectives that can be evaluated and, where practicable, measured. Assign owners, resources, deadlines and evaluation methods.
• 6.3 Planning changes: Plan PIMS changes in a controlled way. For example, before adding a new data use, confirm notices, legal basis, access rights and retention rules, then track implementation.

Practical review: Risks, controls, the SoA, owners and evidence should be traceable to one another. The SoA is part of planning and should not be left until after Clause 8 operations have been completed.

7. Support

Provide the resources needed by the management system, ensure relevant personnel have competence and privacy awareness, establish internal and external communication, and control necessary documented information.

Records may include risk assessments, the SoA, processing activities, training, rights requests, incidents and changes. Determine document types and detail according to actual needs; existing documents can be combined. When records themselves contain personal data, restrict access and define retention arrangements.

8. Operation

• 8.1 Operational planning and control: Put planned processes and controls into daily work, manage relevant changes and control externally provided processes, products or services.
• 8.2 Privacy risk assessment: Reassess at planned intervals and when applicable circumstances arise, such as significant changes; retain the results.
• 8.3 Privacy risk treatment: Carry out treatment plans and retain evidence of results.

In practice, trace a data-subject request or outsourced-data deletion. Confirm that identity checks, processing, response and downstream notifications all have assigned responsibilities. Controllers and processors should implement applicable controls according to their respective roles.

9. Performance evaluation

Determine what to monitor and measure, how to analyze and evaluate results, and when to do so. Plan internal audits and management reviews. Possible indicators include rights-request turnaround time, overdue rate, recurring findings and risk-treatment progress. Interpret trends in light of case volume and severity.

Management review should turn system status, relevant changes and performance results into actionable improvement or change decisions. Internal audits should cover applicable requirements of the new edition and remain objective and impartial.

10. Improvement

10.1 Continual improvement concerns the suitability, adequacy and effectiveness of the PIMS. 10.2 Nonconformity and corrective action addresses departures from requirements by evaluating causes, necessary actions and their effectiveness.

Handle privacy incidents under the incident process and applicable obligations, then determine whether an incident also constitutes a management-system nonconformity. The two are not automatically the same. Incidents, requests and audit findings can all inform process improvement.

Annex A: Controls and the SoA

This guide uses the count from SGS's clause-by-clause comparison of the published edition: 31 + 18 + 29, for a total of 78 controls. Some public summaries report different figures. During implementation, verify each control against a lawfully obtained copy of the official standard and the control register.

The controls were reorganized, including transfers and adjustments of earlier content. This does not mean that information-security responsibilities have disappeared. This page does not repeat the unverified claim that “about 52 controls were deleted.” SGS comparison of the 2025 changes and controls

The SoA should identify necessary controls, the reasons for inclusion, implementation status and reasons for excluding Annex A controls, and should be checked for missing necessary measures. An existing SoA can be updated with a crosswalk; all documents do not need to be rewritten from scratch. Controls should not be excluded merely because implementation is inconvenient. The Clause 4–10 management-system requirements cannot be excluded using the logic for selecting controls.

Annexes B–F: guidance and crosswalks

Annexes C–F provide informative mappings. A regulatory crosswalk can help identify relevant controls, but does not replace legal applicability analysis or prove full compliance.

4. Steps for organizational transition

Step 1: Assess gaps and map roles

Confirm the current certificate, accreditation scheme, PIMS scope and controller/processor roles. Compare Clauses 4–10, Annex A and existing arrangements; record gaps, evidence that can be retained and improvement owners. Annex F can support the old-to-new crosswalk.

Step 2: Form a cross-functional project team

With management support, involve relevant personnel from legal, IT, human resources, operations, marketing and procurement. Set timing for document updates, training, process trials, internal audit, management review and external audit.

Step 3: Provide role-based training

• Senior management: responsibilities, scope, resources and decisions on significant risks under a standalone PIMS.
• Internal auditors: new clauses, control mapping, SoA and evidence review.
• Business teams: data purposes, rights requests, incident reporting, outsourcing and cross-border data processes.

Step 4: Update documents and the SoA

Update the policy, risk assessment, treatment plan, SoA, change management and incident processes, and revise contracts and forms as needed. Retain processes that remain suitable, and identify the reason, approval and version for each revision; simply changing the year is not a transition.

Step 5: Operate the system, build evidence and review internally

Run the updated system and build records for requests, risk treatment, supplier management and changes. Complete internal audits, necessary corrective actions and management review. Plan the operating period according to scope, complexity and evidence sufficiency; there is no fixed number of days that applies to every organization.

Step 6: Arrange the transition audit and certification decision

Confirm the applicable scheme with an independent certification body qualified for it. Assess whether transition can be combined with surveillance or recertification, or requires a separate audit. After nonconformities are addressed, the body makes the certification decision. New applicants apply for initial certification to the new edition. A transition does not automatically grant a fresh three-year certificate term.

5. Common transition misunderstandings

Is 27701 still only a privacy appendix to 27001?

The 2025 edition is a standalone standard. Confirm the PIMS scope, requirements and evidence in its own right. An existing ISMS can support integration but does not automatically replace privacy-management work.

Is a 27001 certificate required before applying?

The new edition does not require an ISO/IEC 27001 certificate as a prerequisite. Necessary personal-data security measures still need to be established, and the organization's certification body should confirm its available scheme.

Must every Annex A control be selected, or can controls be removed freely?

Determine necessary controls based on roles, risks and applicable requirements, compare the full Annex A, document exclusions and add controls when needed. Do not select controls arbitrarily.

Must the SoA and every procedure be rewritten?

Update the crosswalk, applicability rationale and evidence; effective existing content may remain. The transition is about closing gaps and demonstrating implementation, not increasing document count.

Is privacy management only a legal or IT responsibility?

Data processing takes place across departments. Assign responsibilities and resources so that recruitment, marketing, services and outsourcing processes all apply the system.

Does an ISO/IEC 27001 or 27701 certificate prove compliance with every privacy law?

A certificate has a defined scope and assessment basis. The organization must still identify applicable laws, contracts and actual processing obligations, and continue reviewing cross-border transfers, notices and data-subject rights.

Service scope and consultation

Depending on agreed needs, support can cover processing-activity inventories, data-flow and role maps, gap assessments, SoA updates, internal-audit preparation and training. Actual scope, schedule and fees must be confirmed separately; the certification decision belongs to the independent body handling the application.

• ISO/IEC 27001 Information Security Management System
• ISO management-system corporate training
• ISO management-system services

For an initial discussion, prepare an overview of one processing activity's data flow, current policy, certification scheme and de-identified records. Contact Captain International

Sources and review scope

This page was prepared on 29 September 2026 using the ISO catalogue, SGS's public comparison of the published edition and accreditation-body notices. It is a transition guide with practical recommendations; the full paid standard was not obtained for clause-by-clause conformity review. Confirm exact requirements and applicable transition arrangements against official documents and the latest notice from the certification body handling the application.