ISO 27701:2025: The Standalone Privacy Information Management Standard (PIMS)

ISO 27701 is the international standard for a privacy information management system (PIMS). The current edition, ISO/IEC 27701:2025, was published in October 2025 and is a standalone management system standard: for the first time you can implement it and be certified to it without ISO 27001. It sets out management system requirements in clauses 4 to 10 and reference controls for organisations that act as PII controllers, PII processors or both. It helps you evidence UK GDPR accountability, but a certificate is not proof of legal compliance.

What is ISO 27701?

ISO 27701 is a framework for managing personally identifiable information (PII) through a management system, in the same way that ISO 27001 manages information security. Its full title is Information security, cybersecurity and privacy protection - Privacy information management systems - Requirements and guidance, and it is published jointly by ISO and IEC (ISO/IEC 27701:2025 on iso.org).

The standard uses its own vocabulary, which maps closely to UK GDPR:

It is a natural fit for organisations that process personal data for other businesses, such as SaaS platforms, cloud providers, payroll outsourcers and contact centres, because a certificate answers much of the privacy section of a customer’s due diligence questionnaire. Controllers with large or sensitive data sets use it to run privacy as a managed programme.

What changed in ISO 27701:2025?

The 2025 edition turned ISO 27701 from an add-on into a management system standard in its own right. The 2019 edition, titled Security techniques - Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management, could only be used on top of an ISO 27001 information security management system (ISMS).

The privacy content itself is familiar. The 31 controller and 18 processor controls carry the same themes as the 2019 annexes. The biggest change is Table A.3: the PII-specific security guidance that the 2019 edition attached to ISO 27002 controls in its clause 6 is consolidated into 29 information security controls, so the PIMS no longer depends on an ISMS.

Is ISO 27701 certifiable on its own?

Yes. Under the 2025 edition an organisation can define a PIMS scope, implement clauses 4 to 10 and the applicable Annex A controls, and be audited by an independent certification body without holding ISO 27001. The audit follows the usual pattern: a Stage 1 readiness review, a Stage 2 audit of the system in operation, then surveillance audits during a three-year certificate cycle.

Ask any certification body you shortlist whether it can certify ISO/IEC 27701:2025 as a standalone standard, since each body must extend its own scope to the new edition. And expect many buyers to want ISO 27001 as well, because Table A.3 covers only the security controls that matter for personal data, not your whole security programme.

What does ISO 27701 require?

The requirements follow the same clause 4 to 10 structure as other ISO management system standards, with privacy at the centre:

As with ISO 27001, the Statement of Applicability lists every Annex A control, says whether it applies and justifies any exclusion. Our guide to the ISO 27001 Statement of Applicability shows the format.

What controls apply to PII controllers and processors?

Annex A sorts the controls by role. A controller applies Tables A.1 and A.3, a processor applies Tables A.2 and A.3, and an organisation that is a controller for some processing and a processor for other processing applies all three.

For processors, Table A.2 turns the duties in data processing agreements into auditable controls.

How does ISO 27701 relate to UK GDPR?

ISO 27701 gives you the management system and controls that UK GDPR expects you to have, without being a legal compliance check. The main links are:

Does ISO 27701 prove GDPR compliance?

No. An ISO 27701 certificate shows that a certification body has audited your management system against the standard. It does not confirm that each processing activity is lawful, and it is not one of the certification schemes approved by the ICO under Article 42 of UK GDPR. It is, however, strong evidence of the accountability principle in action: documented roles, risk assessments, records and controls that are checked every year. For the legal review that sits alongside it, see our GDPR compliance audit guide.

How is ISO 27701 different from ISO 27001?

ISO 27001 protects the confidentiality, integrity and availability of all your information. ISO 27701 manages personal data and the risks its processing creates for the individuals concerned.

The two fit together well. An existing ISMS already provides the risk method, document control, internal audit and management review, and its 93 Annex A controls overlap heavily with Table A.3. Many organisations run them as one integrated system with a shared ISO 27001 risk assessment method extended to cover privacy risk.

ISO 27701 transition: what should 2019 certificate holders do now?

Plan a transition audit. Accreditation bodies, including UKAS and the Standards Council of Canada, require certification bodies to move all certified clients to the 2025 edition by 31 October 2028; confirm the audit arrangements with your own certification body, as some set earlier internal cut-offs. Before the transition audit, most organisations:

1. Review the new clauses 4 to 10 as standalone requirements, rather than as amendments to ISO 27001.
2. Rebuild the Statement of Applicability against Tables A.1, A.2 and A.3, re-confirming the role for each processing activity.
3. Update policies, procedures and records that cite 2019 clause or annex numbers.
4. Run an internal audit and management review with the 2025 edition in scope.
5. Decide the certificate structure: keep the PIMS integrated with your ISO 27001 certificate or move to a standalone ISO 27701 certificate.

How do you prepare for ISO 27701 for the first time?

Start from your processing, not from the standard. Map what personal data you hold, why, where it flows and who you share it with; most of this is your Article 30 record of processing. Decide your role for each activity and define the PIMS scope. Then assess privacy risk, complete the Statement of Applicability and close the gaps, often in processing agreements, retention, rights handling and supplier oversight. Run the system long enough to produce records, including an internal audit and a management review, before the Stage 2 audit.

Do not leave security evidence until last. Table A.3 and Article 32 both expect you to check that controls work, and web application penetration testing of the systems that hold personal data gives you documented proof.

What affects ISO 27701 certification cost?

ISO 27701 certification cost depends on the same kind of drivers as ISO 27001: the people and sites in scope, how many processing activities and data flows the PIMS covers, whether you act as a controller, a processor or both, and how much privacy work already exists in your records of processing, DPIAs and contracts. If you already hold ISO 27001, an integrated audit with the same certification body can take less time than a separate one, and the certification body confirms the audit time for your scope when it quotes.

Why Sovereign Secure

Sovereign Secure Ltd was founded in 2012 and is headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. We are ICO registered. Our role in a privacy programme is the security foundation:

• ISO 27001 certified, with ISO 27001 consultancy for the ISMS that many organisations integrate their PIMS with. ISO 27001 certification audits are carried out by our partner certification body, MQA International, which makes its own certification decisions.
• Penetration testing of web applications, APIs, cloud and networks that process personal data.
• PCI SSC Qualified Security Assessor (QSA) company and IASME-licensed Cyber Essentials certification body.

We do not issue ISO certificates, and this guide is not legal advice. For the other management system standards we support, see ISO certification.

Next step

If you are building the ISMS your privacy programme will sit on, or need independent evidence that the systems holding personal data are secure, contact us or call +44 161 523 5276 to talk it through.