ISO 27701:2025 Privacy Management Guide

ISO 27701 (ISO/IEC 27701) is the international standard for managing privacy. It defines a privacy information management system, or PIMS: the roles, risk assessment, controls and review cycle an organisation uses to process personal data lawfully and securely, whether it decides how data is used (a controller) or processes it for someone else (a processor).

The standard changed significantly in October 2025. The 2019 edition was an extension of ISO/IEC 27001 and could only be certified together with it. The 2025 edition is a standalone management system standard with its own requirements, so an organisation can now be certified to ISO/IEC 27701 alone. This guide explains the structure, the controller and processor controls, how it relates to the GDPR and India's DPDP Act, certification and transition, and the practical work behind it for software and SaaS companies.

What is ISO/IEC 27701?

ISO/IEC 27701 specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving a privacy information management system. It applies to organisations of all types and sizes that are responsible for or process personally identifiable information (PII), which is the ISO term for personal data.

It uses the role terms from the ISO/IEC 29100 privacy framework: a PII controller determines the purposes and means of processing, and a PII processor processes PII on behalf of a controller. Organisations can be both, and the standard lets them apply the controls that match each role.

The 2025 edition follows the harmonised structure for ISO management system standards, so its clauses 4 to 10 mirror those of ISO/IEC 27001, ISO/IEC 42001 and ISO 9001. Its annexes contain reference controls for controllers and processors, with implementation guidance.

History and why ISO 27701 was introduced

ISO/IEC 27701 was first published in August 2019, shortly after the GDPR began to apply. At that time it was written as an extension to ISO/IEC 27001 and ISO/IEC 27002: an organisation added privacy requirements and controls to its information security management system, and certification required an ISO/IEC 27001 certificate.

That design meant privacy could not be certified separately, and organisations whose privacy programme sat outside the security team found it awkward. The 2025 revision, published on 14 October 2025, made ISO/IEC 27701 a standalone management system standard while keeping it compatible with ISO/IEC 27001, so organisations can integrate the two or run them separately.

The purpose remains the same: privacy laws state what must be achieved but not how to manage it day to day. A management system gives a repeatable way to assign responsibility, assess privacy risk, apply controls and prove it to customers and regulators.

Who needs ISO 27701?

No law requires it. It is most useful for:

SaaS and cloud providers acting as processors for business customers' personal data.
IT services and outsourcing companies handling client personal data, often across borders.
Consumer-facing companies (e-commerce, fintech, health-tech, ed-tech) acting as controllers.
Organisations subject to several privacy laws that want one management system to cover them.

It is a global standard. Its value grows where privacy laws apply: the GDPR requires controllers to choose processors that provide "sufficient guarantees" (Article 28), and certification is one recognised way to demonstrate that. India's DPDP Act makes data fiduciaries responsible for processors' compliance, so Indian clients increasingly ask vendors for privacy evidence.

Key requirements: the management system clauses

Clause 4: Context

Understand the organisation's context and interested parties, including applicable privacy laws, regulations, contracts and the expectations of data subjects; determine whether you act as a PII controller, a PII processor or both; and define the scope of the PIMS.

Clause 5: Leadership

Top management commitment, a privacy policy, and assigned roles and responsibilities, including a person responsible for privacy.

Clause 6: Planning

A privacy risk assessment process that considers risks to individuals (PII principals) as well as to the organisation; risk treatment that selects controls, compares them with the reference controls in the annexes and records the decisions in a Statement of Applicability; and measurable privacy objectives.

Clauses 7 to 10

Support (resources, competence, awareness, communication, documented information), operation (planning and control, performing risk assessments and treatment), performance evaluation (monitoring, internal audit, management review) and improvement (nonconformity, corrective action, continual improvement).

The reference controls for controllers and processors

The annexes provide control sets that reflect common privacy principles. The exact numbering is in the standard; in summary they cover:

Area	For PII controllers	For PII processors
Conditions for collection and processing	Identify and document purposes and lawful basis; obtain and record consent where needed; privacy impact assessments; contracts with processors; records of processing	Contracts with customers; process only on documented instructions; records of processing on behalf of customers
Obligations to PII principals	Notices; handling access, correction, deletion, objection and portability requests; automated decision-making	Assist the customer with data subject requests
Privacy by design and by default	Limit collection and processing; accuracy; retention and disposal; de-identification; temporary files	Return, transfer or disposal of PII at the end of the contract; temporary files
Sharing, transfer and disclosure	Identify transfer bases; records of disclosures to third parties; jurisdictions	Notify customers of sub-processors and changes; transfers between jurisdictions; legally binding disclosure requests

Information security controls relevant to protecting PII also apply. Organisations that already run ISO/IEC 27001 can reuse their Annex A controls; those certifying ISO/IEC 27701 alone must still address security of PII through the PIMS.

How to implement ISO 27701 step by step

Determine roles and scope: for each product or service, whether you are a controller, processor or both, and which laws and contracts apply.
Map personal data: categories, purposes, systems, recipients, sub-processors and countries. This becomes your records of processing.
Write the privacy policy and assign a privacy lead with authority.
Assess privacy risks, including risks to individuals, and run privacy impact assessments for high-risk processing.
Select controls from the controller and processor sets, write the Statement of Applicability and a treatment plan.
Build the operational processes: data subject request handling, consent management, retention and deletion schedules, breach notification, sub-processor management and transfer mechanisms.
Put contracts in order: data processing agreements with customers and with your own vendors.
Implement the technical controls: access control, encryption, logging, pseudonymisation, deletion that reaches all systems, and secure test data.
Train staff on privacy responsibilities.
Measure, audit and review, then fix nonconformities.
Certify with an accredited certification body, alone or combined with ISO/IEC 27001.

What changed between the 2019 and 2025 editions

Standalone management system. The 2019 edition added privacy requirements to ISO/IEC 27001 clauses. The 2025 edition has its own clauses 4 to 10, so the PIMS no longer depends on an ISMS.
Independent certification. Certification no longer requires an ISO/IEC 27001 certificate, which suits organisations where the privacy programme is run separately from security.
Alignment with the 2022 security standards. Security-related guidance reflects the restructured ISO/IEC 27002:2022 controls rather than the 2013 control set.
More weight on privacy risk. Risk assessment explicitly covers consequences for individuals, and commentators note more attention to impact assessments, cross-border transfers and oversight of processors and sub-processors.
Climate change consideration. Like other ISO management system standards revised after 2024, clause 4 asks whether climate change is a relevant issue.

If you hold a 2019 certificate, start by mapping your existing Statement of Applicability to the 2025 structure, then update the risk assessment and run an internal audit against the new edition before your transition audit.

What auditors look for in a software product

For SaaS and IT service companies, much of the evidence for an ISO/IEC 27701 audit sits in the product and its operations rather than in policy documents. Expect auditors to sample:

Data subject requests: a sample of access, correction and deletion requests, how identity was verified, how long each took, and proof that deletion reached every system, including processors.
Retention: configured retention periods for each data category and evidence that deletion jobs ran.
Processing on instructions: for processors, how the product prevents staff from using customer data for other purposes, including access controls and logs of support access.
Sub-processors: the published list, change notifications sent to customers and the contracts behind them.
Test data: whether production personal data is copied into development or test environments, and if so how it is masked.
Breach handling: incident records showing how personal data breaches were assessed and who was notified, and when.

Designing these features into the product early is far cheaper than retrofitting them before an audit.

Documentation and records required

PIMS scope, including roles as controller or processor.
Privacy policy and objectives.
Privacy risk assessment and treatment methods and results.
Statement of Applicability for the reference controls.
Records of processing activities, for both roles where relevant.
Privacy impact assessments.
Notices, consent records and data subject request logs.
Contracts with customers and processors, and the sub-processor list.
Retention schedule and disposal records.
Breach response procedure and records.
Competence and training records, internal audit and management review results, corrective actions.

Certification and transition

Certification follows the usual ISO pattern: Stage 1 and Stage 2 audits by an accredited certification body, a three-year certificate with surveillance audits in years one and two, and recertification. Under the 2025 edition you can certify ISO/IEC 27701 on its own, or run a combined audit with ISO/IEC 27001.

Organisations certified to the 2019 edition must transition to the 2025 edition. Certification bodies have reported a transition deadline of 31 October 2028; confirm the exact arrangements with your certification body, since they follow the rules set through the accreditation system. Verify any certificate on IAF CertSearch.

Timeline and cost considerations

Organisations with an existing ISO/IEC 27001 system can reuse document control, internal audit, management review and many security controls, so the new work is mostly privacy-specific: data mapping, privacy risk, rights handling, contracts and transfers. The number of products, data categories, jurisdictions and sub-processors drives the effort. Costs include certification audit days, internal staff time across legal, product and engineering, privacy tooling (data discovery, consent and request management), and engineering work on deletion, retention and access logging.

Benefits and the risk of not having it

ISO/IEC 27701 gives a structured, auditable privacy programme that can cover several laws at once, answers customer due diligence with an independent certificate, and makes privacy responsibilities clear inside the organisation. For processors, it is practical evidence of the "sufficient guarantees" GDPR controllers must look for.

There is no legal penalty for not being certified. Without a managed programme, privacy obligations tend to be handled ad hoc, which shows up as missed rights requests, unknown sub-processors, data kept too long and contracts that do not match practice. Those are exactly the failures privacy regulators penalise.

Common mistakes and challenges for IT companies

Treating certification as legal compliance. It is evidence of management, not a ruling that you comply with any law.
Wrong role decisions. Calling yourself a processor when you use customer data for your own analytics or product training makes you a controller for that processing.
Incomplete data maps. Logs, analytics tools, support systems and backups often hold personal data that maps miss.
Deletion that does not reach processors or backups.
Sub-processor changes without notice to customers, contrary to processor controls and most DPAs.
Copying an ISO/IEC 27001 risk register. Privacy risk includes harm to individuals, not only to the company.

Best practices, tools and technologies

Keep records of processing as structured data linked to systems and vendors, not only as a spreadsheet.
Automate data subject requests: identity verification, discovery across systems, export and deletion with audit trails.
Use pseudonymisation in analytics and test environments.
Implement retention as code: scheduled jobs that delete or anonymise data by category.
Publish and maintain a sub-processor list with change notifications.
Integrate the PIMS with ISO/IEC 27001 for shared processes and audits.

We build rights request handling, consent records and retention jobs in web applications and SaaS products.

How ISO 27701 relates to other frameworks

Framework	Relationship
ISO/IEC 27001	Security management system. Compatible structure; the 2025 edition of ISO/IEC 27701 no longer requires it.
GDPR	Law. ISO/IEC 27701 helps organise GDPR obligations and evidence processor guarantees, but is not a GDPR certification under Article 42.
DPDP Act	Indian law with similar roles; a PIMS can structure fiduciary and processor duties.
ISO/IEC 27018	Code of practice for public cloud PII processors; complements the processor controls.
NIST Privacy Framework	Voluntary US framework of privacy outcomes; can be mapped to ISO/IEC 27701.
SOC 2 privacy criteria	An attestation option on privacy commitments, common with US customers.

Real-world implementation examples

Major cloud providers have long held ISO/IEC 27701 certifications for their services and publish them in their compliance portals, which customers use when assessing them as processors under the GDPR.

An illustrative case for an Indian IT services company serving European clients: it is a processor for client data and a controller for its employee and sales data. It defines two scopes in one PIMS, builds a client data register per engagement, standardises its DPA and sub-processor notices, implements deletion at contract end with certificates of destruction, and adds privacy questions to its project kickoff checklist. Certification gives its sales team a single answer to the privacy section of client RFPs.

Next steps

Decide your roles and scope.
Build the data map and records of processing.
Assess privacy risk and select controls.
Fix contracts, rights handling and retention in the product.
Choose an accredited certification body, and plan the transition if you hold a 2019 certificate.

Frequently asked questions

What is the latest version of ISO 27701?

ISO/IEC 27701:2025, published in October 2025. It replaced the 2019 edition and is now a standalone management system standard.

Do we need ISO 27001 to get ISO 27701?

Not under the 2025 edition. It can be certified on its own. Many organisations still combine the two because their processes overlap.

Is ISO 27701 mandatory?

No. It is voluntary. It is often requested by customers and supports compliance with privacy laws.

No. It shows that a privacy management system is in place and audited. Compliance with the GDPR is decided by regulators and courts on the facts.

What is a PIMS?

A privacy information management system: the policies, roles, risk processes and controls an organisation uses to manage personal data processing and improve over time.

What is the difference between a PII controller and a PII processor?

A controller decides why and how personal data is processed; a processor processes it on the controller's behalf. ISO/IEC 27701 provides controls for each role.

What happens to ISO 27701:2019 certificates?

They must transition to the 2025 edition. Certification bodies report a deadline of 31 October 2028; confirm with your certification body.

How long is an ISO 27701 certificate valid?

Three years, with surveillance audits in the first and second years and recertification before expiry.

Who should own the PIMS?

A named privacy lead with authority, supported by legal, security, product and engineering. In smaller companies this is often the same person who owns the ISMS, but privacy decisions such as lawful basis and retention need input from legal or compliance.

Can we include only one product in scope?

Yes. The scope can be limited to specific products, services or locations, provided it is clearly defined and the certificate states it. Customers will check that the scope covers the service they buy.

Is ISO 27701 relevant for the DPDP Act?

Yes, as a way to organise and evidence privacy management. It does not replace the Act's specific requirements, such as notices, consent and breach intimation timelines.

How does ISO 27701 differ from ISO 27018?

ISO/IEC 27701 is a full management system for any controller or processor. ISO/IEC 27018 is a code of practice specifically for public cloud providers processing PII.

Can a small company implement ISO 27701?

Yes. The standard scales to organisation size. A small SaaS company can keep documentation lean if processes are clear and evidenced.