ISO 27701 — Privacy Information Management System

What Is ISO 27701?

ISO/IEC 27701 is the international standard for Privacy Information Management Systems (PIMS). First published in 2019 and substantially revised in 2025, it provides a structured framework for organisations to manage the privacy of personal data through documented policies, controls, and continual improvement.

The standard is built as an extension to ISO/IEC 27001 — the international standard for information security management. Where ISO 27001 protects information assets generally, ISO 27701 adds privacy-specific requirements that address how personally identifiable information (PII) is collected, used, retained, disclosed, and disposed of.

ISO 27701 is a certifiable standard, meaning organisations can be audited by accredited certification bodies and receive formal certification demonstrating their privacy management practices meet international requirements. The 2025 revision aligns with the latest ISO 27001:2022 controls and addresses updated global privacy regulations.

ISO 27701 and ISO 27001 — The Relationship

ISO 27701 cannot be implemented or certified in isolation. It is explicitly designed as an extension to ISO 27001 — your organisation must either already have an ISO 27001-aligned ISMS in place, or implement both standards together.

This integration is intentional. Privacy and information security overlap significantly: most privacy controls depend on underlying security controls (encryption, access management, monitoring), and many security incidents have privacy implications. Building PIMS on top of an ISMS avoids duplication and creates a unified governance structure.

For organisations already certified to ISO 27001, adding ISO 27701 is the most efficient path. The ISMS provides the foundation; ISO 27701 adds the privacy-specific clauses and controls. Auditors can assess both standards in a single audit cycle, reducing cost and effort.

Key ISO 27701 Requirements

PII Controllers vs Processors

ISO 27701 recognises two distinct roles in privacy management, each with different obligations:

• PII controllers — Organisations that determine the purposes and means of processing personal data. Controllers have primary accountability under privacy law and face the broadest set of obligations.
• PII processors — Organisations that process personal data on behalf of controllers (typically as a service provider). Processors have a narrower set of obligations focused on acting only on documented instructions.

The standard provides separate Annex A controls for controllers and Annex B controls for processors. Organisations that act in both roles (which is common for SaaS businesses) implement both sets of controls.

Privacy by Design

ISO 27701 requires organisations to embed privacy considerations into systems, processes, and services from the outset rather than adding them after deployment. This includes data minimisation, purpose limitation, retention controls, and default settings that protect privacy.

Data Subject Rights Handling

Organisations must establish processes to handle requests from data subjects, including access, rectification, erasure, restriction of processing, data portability, and objection. ISO 27701 requires documented procedures, defined response times, and audit trails.

Privacy Impact Assessments

The standard requires organisations to conduct privacy impact assessments (PIAs) for new processing activities or significant changes. PIAs identify privacy risks and define treatment measures before processing begins, supporting GDPR Article 35 DPIA requirements.

Certification Process

ISO 27701 certification follows the same audit process as ISO 27001 because the two standards are integrated. The typical pathway is:

1. Gap analysis — Compare current privacy practices against ISO 27701 requirements to identify gaps and remediation needs.
2. PIMS implementation — Develop policies, procedures, controls, and records to meet the standard's clauses and Annex A/B requirements.
3. Internal audit — Verify the PIMS is implemented and effective before engaging an external auditor.
4. Stage 1 audit — Documentation review by an accredited certification body.
5. Stage 2 audit — On-site or remote assessment of PIMS effectiveness in operation.
6. Certification — Issued for 3 years with annual surveillance audits.

If you are pursuing ISO 27001 and ISO 27701 simultaneously, both standards can be assessed in a single combined audit, significantly reducing cost and effort compared to separate audit cycles.

Who Needs ISO 27701?

ISO 27701 is most valuable for organisations that handle significant volumes of personal data or face direct privacy obligations:

• SaaS companies with EU customers — GDPR creates direct obligations and ISO 27701 provides documented evidence of compliance.
• Data processors and service providers — Increasingly required by enterprise customers as part of vendor due diligence and contractual requirements.
• Healthcare and financial services — Sectors with sensitive PII and strict regulatory requirements.
• Multinational enterprises — Operating across multiple privacy regimes benefit from a single unified PIMS standard.
• Public sector and government — Where privacy accountability is a legal and reputational priority.
• Australian organisations — Subject to the Privacy Act 1988 and Australian Privacy Principles, ISO 27701 provides a structured framework for compliance.