ISO 27701: the privacy information management standard

ISO 27701 is the international standard for privacy information management: it organises how an organisation protects the personal data it processes, just as ISO 27001 organises information security. Long a mere extension of ISO 27001, it became a standalone standard in October 2025. Here is what it contains, what the new edition changes, and what it does, or does not, bring with regard to the GDPR.

ISO/IEC 27701 sets out the requirements for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS). It is aimed at organisations that process personal data and are accountable for it, whether as controllers or as processors.

Like any management system standard, it is more than a list of controls. It requires you to define a scope, assess risks, set roles and objectives, measure, audit and improve. On top of that, it adds privacy-specific reference controls, separate for controllers and processors: collection conditions, data subject rights, privacy by design, transfers, relations between customers and providers.

It belongs to the ISO 27000 family. Its cousin ISO/IEC 27018, revised in 2025, covers a specific case: public cloud providers processing personal data on behalf of their customers.

The first edition, published in 2019, was titled "Extension to ISO/IEC 27001 and ISO/IEC 27002". It added to an existing ISMS: ISO 27701 certification was impossible without an ISO 27001 management system. The second edition, published in October 2025, breaks that link. ISO describes it as a standalone standard that lets organisations implement and certify a privacy management system independently of ISO 27001, while still allowing integration with an ISMS.

Both standards share the same management system structure. They do not protect the same thing.

This is the most frequent question: does ISO 27701 certification amount to GDPR compliance? The answer from the CNIL, the French data protection authority, is clear: the standard is not specific to the GDPR and does not, as such, constitute a certification within the meaning of Article 42 of the regulation. Those certifications rely on criteria approved by a data protection authority and are issued by bodies accredited for that purpose.

The CNIL does, however, see it as a way to show a proactive approach and to mature one's practices. The 2019 edition even included an annex mapping its requirements to GDPR articles. In practice, the standard helps with several obligations:

• accountability (Article 5(2)): a management system produces, by design, evidence of what you do;
• risk analysis for individuals, which feeds data protection impact assessments (DPIAs);
• relations with processors (Article 28): a certified provider offers guarantees that are easier to check, which lightens your third-party assessment.

At European level, CEN and CENELEC published EN 17926 in 2023, which specifies how to apply ISO 27701 in the European context with a view to certifying processing operations; it is currently being revised.

Certification is issued by an accredited certification body after a two-stage audit: a review of documentation and readiness, then an audit of how the management system operates. As with ISO 27001, the certificate runs on a three-year cycle with surveillance audits.

For organisations certified under the 2019 edition, accreditation bodies govern the transition. In the United Kingdom, UKAS set its timetable in March 2026: assessment of certification bodies from May 2026, all accredited bodies transitioned by 31 October 2027, and certified organisations by 31 October 2028. This timetable follows a consensus within the IAF, the International Accreditation Forum. Elsewhere, your certification body will tell you the applicable dates; the transition often takes place at a recertification audit.

1. Define the scope: which processing, which entities, and for each, are you a controller, a processor, or both?
2. Start from the record: the record of processing activities required by the GDPR gives the starting inventory.
3. Assess risks to the organisation and to individuals, building on the DPIAs already carried out.
4. Select the applicable reference controls and justify exclusions, as in the ISO 27001 statement of applicability.
5. Run the system: roles, training, handling data subject requests, managing breaches, overseeing processors.
6. Audit and improve: internal audit, management review, corrective actions, then the certification audit.

Our article on becoming compliant explains the logic these programmes share. To keep your record, run your DPIAs and assess your providers in one tool, see our GDPR module.