ISO 27701:2025 Transition Checklist

Confirm dates with your certification body and decide how the PIMS will run.

• 1.1Get a licensed copy of ISO/IEC 27701:2025 for the people doing the transition work.
  Evidence to keep

  Purchase record or licence for the standard.

  ISO/IEC 27701:2025
• 1.2Confirm that your certification body is accredited for ISO/IEC 27701:2025 audits, and ask for its transition deadline and audit options.
  Evidence to keep

  Written confirmation or the certification body's transition notice.

  ISO/IEC 27706:2025
• 1.3Book the transition audit with a surveillance visit, a recertification visit or a separate visit, well before 31 October 2028.
  Evidence to keep

  Confirmed audit date in writing.

  Transition deadline
• 1.4Name a transition owner, set a project plan with dates, and brief top management on the scope and effort.
  Evidence to keep

  Project plan and the briefing record or minutes.

  Clause 5
• 1.5Decide whether the PIMS stays integrated with your ISO 27001 ISMS or runs on its own.
  Evidence to keep

  Documented decision with the reasons.

  Clause 4.3
• 1.6If the PIMS will run without an ISMS, plan for the risk process, internal audit, document control and security controls the ISMS used to supply.
  Evidence to keep

  Gap list for the work the ISMS covered before.

  Clauses 6 to 10, Table A.3Critical for a standalone PIMS

Map what you have today to the 2025 edition.

• 2.1Map every 2019 requirement and control you apply to its 2025 home, using the correspondence in Annex F.
  Evidence to keep

  Mapping table from 2019 references to 2025 references.

  Annex F
• 2.2Confirm where you act as a PII controller, a PII processor, or both. That decides whether Table A.1, Table A.2 or both apply.
  Evidence to keep

  Processing inventory showing your role for each processing activity.

  Tables A.1 and A.2
• 2.3Review and document the PIMS scope. Under the 2025 edition it no longer has to match your ISMS scope.
  Evidence to keep

  Updated PIMS scope statement.

  Clause 4.3
• 2.4Record each gap with an owner, a target date and the evidence you will need.
  Evidence to keep

  Gap register with owners and dates.

  Clause 6

The PIMS now has its own Clauses 4 to 10.

• 3.1Update the context of the PIMS: internal and external issues, interested parties, how you process PII, and the privacy laws that apply.
  Evidence to keep

  Context and interested parties register.

  Clauses 4.1 and 4.2
• 3.2Decide whether climate change is a relevant issue for the PIMS and record the decision.
  Evidence to keep

  Context register entry showing the climate change decision.

  Clause 4.1
• 3.3Update the privacy policy and confirm top management's roles and responsibilities for privacy.
  Evidence to keep

  Approved privacy policy and assigned PIMS roles.

  Clause 5
• 3.4Run a privacy risk assessment that covers risk to the people whose PII you process, not only risk to the business. Update the treatment plan.
  Evidence to keep

  Privacy risk assessment and risk treatment plan.

  Clause 6.1
• 3.5Set measurable privacy objectives with owners and plans to reach them.
  Evidence to keep

  Privacy objectives with owners and targets.

  Clause 6.2
• 3.6Confirm competence, awareness, communication and document control cover the PIMS on its own terms.
  Evidence to keep

  Training records, communication plan and document control procedure.

  Clause 7
• 3.7Put the risk treatment plan into operation and keep records that show it is working.
  Evidence to keep

  Operational records for the treatments in the plan.

  Clause 8
• 3.8Update monitoring, internal audit and management review so they cover the 2025 requirements.
  Evidence to keep

  Updated audit programme and management review agenda.

  Clause 9
• 3.9Confirm the nonconformity and corrective action process covers the PIMS.
  Evidence to keep

  Corrective action procedure and log.

  Clause 10

Move to the three Annex A tables.

• 4.1Rebuild the Statement of Applicability on Tables A.1, A.2 and A.3, with a reason for each control you include or exclude and its status.
  Evidence to keep

  Statement of Applicability built on the 2025 tables.

  Annex A
• 4.2Implement and check the security controls in Table A.3. If you hold ISO 27001, map them to your ISO 27001 Annex A controls so one piece of evidence serves both.
  Evidence to keep

  Table A.3 control evidence, or a mapping to ISO 27001 Annex A.

  Table A.3Critical for a standalone PIMS
• 4.3Use the Annex B guidance to check how each applicable control is implemented.
  Evidence to keep

  Control implementation notes referencing Annex B.

  Annex B
• 4.4Update policies and procedures that cite 2019 clause or annex numbers. In 2019, Annex B held the processor controls. In 2025 it holds guidance.
  Evidence to keep

  Document register showing updated references.

  Annex B
• 4.5Check the GDPR mapping in Annex D. Build your own mapping for PIPEDA, Quebec Law 25, HIPAA or US state privacy laws where they apply.
  Evidence to keep

  Legal mapping for each privacy law in scope.

  Annex D
• 4.6If you are a public cloud PII processor, use Annex E to trace your controls to ISO/IEC 27018.
  Evidence to keep

  Mapping from your controls to ISO/IEC 27018.

  Annex E
• 4.7Update contracts, data processing agreements and trust pages that name the 2019 edition, ready for the new certificate.
  Evidence to keep

  List of customer-facing documents to update after certification.

  Customer commitments

Prove the updated PIMS works before the auditor arrives.

• 5.1Train the people who run the PIMS on what changed and what it means for their work.
  Evidence to keep

  Training attendance records.

  Clause 7.2
• 5.2Run an internal audit against the 2025 edition across the full PIMS scope.
  Evidence to keep

  Internal audit report against ISO/IEC 27701:2025.

  Clause 9.2
• 5.3Hold a management review that covers the transition, the audit results and the privacy objectives.
  Evidence to keep

  Management review minutes.

  Clause 9.3
• 5.4Close or plan corrective action for every nonconformity from the internal audit.
  Evidence to keep

  Corrective action records.

  Clause 10
• 5.5Prepare the evidence pack: scope, Statement of Applicability, risk assessment, Annex F mapping, internal audit report and management review minutes.
  Evidence to keep

  Evidence pack ready to share with the auditor.

  Audit preparation
• 5.6Complete the transition audit, close any findings within the certification body's deadline, and receive the 2025 certificate.
  Evidence to keep

  ISO/IEC 27701:2025 certificate.

  Transition audit