ISO/IEC 27701:2025, published on 14 October 2025, is a standalone management system standard for a privacy information management system (PIMS). You can now implement it and be certified to it without first holding ISO/IEC 27001, which was required under the 2019 edition it replaced.
This guide is for DPOs, privacy and compliance managers and CISOs deciding how to build a PIMS or move a 2019 certificate to the new edition.
What is ISO/IEC 27701:2025 and who is it for?
ISO/IEC 27701 sets requirements and gives guidance for establishing, running and improving a PIMS. The 2025 text is the second edition, 64 pages long, developed by the joint ISO and IEC committee for information security, cybersecurity and privacy (ISO/IEC JTC 1/SC 27). Its title no longer calls it an extension. It now names privacy information management systems directly.
ISO describes the standard as written for organisations that act as controllers or processors of personally identifiable information (PII). A controller decides why and how personal data is processed. A processor handles it on a controller's behalf. ISO's ISO/IEC 27701:2025 page says it suits any public, private or not-for-profit organisation that collects, processes, stores or controls PII.
Many organisations are both. A payroll provider is a controller for its own staff records and a processor for its clients' employee data. Cloud providers carry the processor role at scale, and our guide to ISO/IEC 27017 cloud security controls covers the related cloud standard.
What changed from the 2019 edition?
The 2019 edition was built as an extension to ISO/IEC 27001 and ISO/IEC 27002. Its requirements were added on top of an information security management system (ISMS). ISO withdrew it on 14 October 2025, the day the new edition was published.
Accreditation bodies have summarised the main changes in their transition notices. The 2025 edition adopts the harmonized structure that ISO uses for all management system standards. It strengthens requirements on leadership, governance, performance evaluation and privacy risk management. It adds climate change considerations, as other management system standards now do, and it clarifies the controls for controllers and processors.
| Point | ISO/IEC 27701:2019 | ISO/IEC 27701:2025 |
|---|---|---|
| Form | Extension to ISO/IEC 27001 and 27002 | Standalone management system standard |
| Certified ISMS needed first | Yes, for accredited certification | No |
| Clause structure | Privacy requirements added to the ISO/IEC 27001 clauses | Harmonized structure of its own, clauses 4 to 10 |
| Rules for certification bodies | ISO/IEC TS 27006-2:2021 | ISO/IEC 27706:2025, published 14 October 2025 |
| Status | Withdrawn 14 October 2025 | Current, Edition 2 |
The table is AGS's summary of ISO's catalogue entries and the accreditation body notices listed in our sources. It is not text from the standard.
Do you still need ISO/IEC 27001 to use ISO/IEC 27701?
No. ISO's own FAQ for the standard answers that it can be used alone because it is an independent management system standard. The Standards Council of Canada confirms that certification bodies no longer require a client to hold a certified ISMS before applying for PIMS certification.
That said, privacy controls still depend on security controls. Access control, encryption, logging and incident response protect personal data whichever standard asks for them. An organisation that already runs an ISMS can keep one integrated system with a shared risk process, audit programme and management review. Our guide to ISO/IEC 27001:2022 explains the ISMS side.
An organisation without an ISMS, such as a clinic or a marketing agency, can now start with the PIMS alone. It still has to show how the security of personal data is managed, so the scope and risk assessment must cover it.
What does the transition look like if you hold a 2019 certificate?
Dates are set by accreditation bodies, so check the one behind your certificate. The Standards Council of Canada bulletin of 9 July 2026 and the Singapore Accreditation Council notice of 20 April 2026 set the same two deadlines. Accredited certification bodies must complete their own move to ISO/IEC 27706 by 31 October 2027. They must transition all certified clients to ISO/IEC 27701:2025 by 31 October 2028.
The Canadian bulletin adds that certification to the 2025 edition can begin only once the certification body has completed its own transition. Accreditation bodies cooperate internationally through Global ACI (formerly IAF and ILAC), which took over both roles in January 2026. Other accreditation bodies may publish different dates.
A practical order of work, in our view, looks like this:
- Ask your certification body when it expects to be ready and whether the transition audit will run at surveillance, at recertification or as a special visit.
- Write a PIMS scope that stands on its own, naming the processing activities, sites and whether you act as controller, processor or both.
- Rework context, interested parties, privacy policy and objectives so they no longer rely on the ISMS documents.
- Check that the privacy risk method assesses risk to the people whose data you hold, not only risk to the organisation.
- Re-check which controls apply against the 2025 control set and record the reasons for each inclusion and exclusion.
- Add climate change to the context review, even if you conclude it is not a relevant issue for your PIMS.
What records will a PIMS auditor ask to see?
Auditors test a PIMS by sampling evidence, not by reading policies. The list below is our interpretation of what usually proves the system works. It is not wording from the standard.
- Records of processing activities that match what systems actually do, with lawful bases and retention periods.
- Data protection impact assessments for high-risk processing, with the decisions taken.
- A privacy risk register and treatment plan, reviewed on a set cycle.
- A log of requests from data subjects, with dates received and answered.
- Contracts and due diligence for processors and subprocessors, including cross-border transfer terms.
- An incident and breach register showing who decided whether to notify, and when.
- Training records, internal audit reports and management review minutes that cover privacy.
Expect the auditor to pick one processing activity and follow it end to end, from the record of processing to the retention schedule and the disposal evidence.
Does ISO/IEC 27701 make you compliant with GDPR or the Saudi PDPL?
No standard makes you compliant with a law. ISO says the standard helps organisations demonstrate compliance with privacy regulations such as the GDPR. A regulator, however, judges compliance against its own law, not against a certificate.
A PIMS gives you the records and routines that regulators ask about, such as processing records, impact assessments and breach decisions. Requirements such as notification deadlines, registration duties and transfer rules still come from each law. Our guide to Saudi PDPL enforcement shows how one regulator approaches this. For legal questions, take advice on the law that applies to you.
How AGS can help
The AGS PIMS toolkit contains 63 editable Microsoft Word documents. It includes a PIMS manual, a privacy policy, a scheme document and 18 procedures, from records of processing and impact assessments to cross-border transfers and breach management. There are also 15 forms, 11 registers including a statement of applicability, 7 checklists, 5 guidance notes on topics such as controller and processor roles, 3 training documents and a master index.
Frequently asked questions
Is an ISO/IEC 27701:2019 certificate still valid?
ISO has withdrawn the 2019 edition, but accredited certificates continue during the transition. Under the Canadian and Singapore arrangements, clients must move to the 2025 edition by 31 October 2028.
Can a processor be certified to ISO/IEC 27701?
Yes. The standard is written for both controllers and processors. Your scope should state which role you hold for each processing activity.
What is ISO/IEC 27706?
It sets the requirements for bodies that audit and certify a PIMS. It was published alongside the new ISO/IEC 27701 and replaced the 2021 technical specification ISO/IEC TS 27006-2.
Does buying documentation mean the organisation will be certified?
No. Documents are a starting point. Certification depends on how the system runs and on the certification body's audit findings.
AGS provides independent documentation toolkits. This guide and the referenced documents are not affiliated with, endorsed by or approved by ISO, IEC, any accreditation body or any certification body, and they do not guarantee any certification outcome.
Reviewed October 2026. Facts checked against the sources current at publication.
