Skip to content

ISO/IEC 27701

server room

About ISO/IEC 27701

ISO/IEC 27701:2025 is an international standard for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS). It provides requirements and guidance for organizations acting as PII Controllers and PII Processors to effectively manage privacy risks, protect personally identifiable information (PII), and demonstrate compliance with applicable privacy and data protection regulations. 

The 2025 edition has been revised as a stand-alone management system standard, enabling organizations to implement a PIMS independently while remaining compatible with other management systems such as ISO/IEC 27001.

 

Request a proposal

Advantages of ISO/IEC 27701

ISO/IEC 27701:2025 enables organizations to build a culture of privacy and accountability by embedding privacy considerations into business processes and decision-making. The standard helps organizations define clear roles and responsibilities for handling personally identifiable information (PII), improve transparency in data processing activities, and establish consistent controls for managing privacy risks throughout the information lifecycle. 

By adopting a recognized privacy management framework, organizations can enhance stakeholder confidence, improve operational efficiency in privacy-related activities, and strengthen their ability to respond to evolving regulatory and business requirements.

Contents of ISO 27701

ISO 27001 and ISO 27002 contain requirements and guidelines for an information security management system (ISMS). ISO 27701 adds data protection-specific requirements and guidelines and expands them to include a data protection information management system (PIMS).

Specific additions:

  • the existing standard chapters of ISO 27001 (chapters 4-10) including
  • Annex A1 (Controls from ISO 27002 (5-18) with the ISO 27701-specific requirements

ISO 27701 is therefore an extension of the requirements and controls of ISO 27001 and does not function as a stand-alone standard. It therefore necessarily has the same scope as the underlying ISO 27001 management system

Factsheet (pdf)

Audit process for ISO 27701 certification

1

01

Enquiry and Proposal Preparation

2

02

Contract Confirmation and Audit Scheduling

3

03

Audit: Understanding the Organization and Assessing Readiness for Certification

4

04

Identification of Opportunities for Improvement and Certification Decision Process

5

05

Quick four-eye check & certificate creation

6

06

External TÜV certificate

7

07

Continuous further development of the management system & competitiveness

FAQ about an ISO 27701 certification

An ISO 27701 certificate is suitable for any organisation that processes personally identifiable information (PII). Regardless of its size, for both public and private companies, government agencies and non-profit organisations that process personal data (PII) as a controller and/or processor within the meaning of the BDSG as part of an ISMS.

Especially if you need to prove that your organisation consciously handles this type of personal data, this certificate offers a structured solution:

  • Any organisation that processes personal data, regardless of its size and type, can benefit from implementing ISO 27701
  • Organisations that want to (co-)mitigate financial and regulatory risks associated with data breaches
  • Private, public organisations and even government agencies that need to take a risk-based approach to the retention and processing of personal data
  • Organisations with an ISMS that want to further develop and professionalise their role as controller and/or processor

Companies that fall under European legislation, e.g. because they are European or operate in the EU, can use ISO 27701 to take a closer look at compliance with GDPR legislation. This applies, for example, to:

  • Organisations looking for a way to comply with the obligation to demonstrate that they have taken appropriate technical and organisational measures to ensure compliance with the requirements of the GDPR
  • Organisations that wish to (further) process personal data on behalf of customers, which by law may only outsource this to organisations that sufficiently guarantee that the processing meets the requirements of the GDPR and the protection of the rights of the data subjects

To obtain ISO 27701 certification, you must already have a functioning ISMS that fulfils the requirements of ISO 27001. This means that you already have or are in the process of obtaining ISO 27001 certification. The reason for this is that ISO 27701 complements this standard.

For any organisation that works with privacy-sensitive information, especially if that information can be traced back to an individual, this addition is certainly relevant.

If you already have an ISO 27001 certificate (via TÜV NORD or another certification body), you will first be audited separately for ISO 27701. This certificate then corresponds to your current ISO 27001 certificate in terms of duration. When this expires or if you start with ISO 27001 and ISO 27701 at the same time, the audits for ISO 27001 and ISO 27701 will be synchronised.

The ISMS and PIMS are then integrated and the audits for both systems are combined.

Privacy Management for a Trusted Digital Future.

As personal data becomes an increasingly valuable asset, a systematic approach to privacy management is essential for building and maintaining business trust.

ISO 27701 helps organizations manage personal data in a structured and effective manner, enhancing transparency, reducing privacy-related risks, and strengthening stakeholder confidence in the digital economy.

Contact us
Overview
IT Services
Continue to
Education/Training