ISO 27701 · Privacy management
The 2025 edition turns ISO 27701 from an add-on to ISO 27001 into a privacy standard that stands on its own. That opens a new path to certification. It also moves work onto your plate that ISO 27001 used to carry.
TL;DR
ISO/IEC 27701:2025 is a standalone privacy management system standard. You no longer need ISO 27001 to use it or to get certified.
- New structure. The PIMS now has its own Clauses 4 to 10, in the same shape as ISO 27001 and ISO 42001.
- Controls in one place. Annex A now holds three tables: controller controls, processor controls and security controls for both.
- New audit rules. ISO/IEC 27706:2025 now sets the rules for bodies that certify a PIMS.
- Deadline. Certificates issued against the 2019 edition must move to 2025 by 31 October 2028.
Standalone does not mean lighter. Without ISO 27001 underneath, the risk process, internal audit and security controls are now yours to run inside the PIMS.
Sources: ISO/IEC 27701:2025 · UKAS transition bulletin
The one change that drives the rest #
ISO published the second edition of ISO/IEC 27701 on 14 October 2025. It replaces and withdraws the 2019 edition. The title tells you most of the story.
ISO titled the 2019 edition an “Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management”. You could only build a privacy information management system (PIMS) on top of an ISO 27001 information security management system (ISMS). Certification worked the same way. A 27701 certificate rode on your 27001 certificate.
The 2025 edition drops the word “extension.” Its title now names “privacy information management systems” as a subject in their own right. ISO’s own page answers the obvious question in one line.
“Can ISO/IEC 27701 be used alone? Yes, as it is an independent management system standard (MSS).”
ISOISO/IEC 27701:2025 product page
An extension of ISO 27001
The PIMS sits on top of an ISMS and borrows its clauses.
A standalone PIMS
Its own management system, with or without an ISMS.
How the structure moved between editions. Clause and annex names follow the published standard and certification body summaries.
What changed in the requirements #
The PIMS now uses the harmonized structure that every modern ISO management system shares. If you know ISO 27001:2022 or ISO 42001, you know the shape. Clauses 4 to 6 cover context, leadership and planning. Clauses 7 and 8 cover support and operation. Clauses 9 and 10 cover performance evaluation and improvement.
Privacy risk is now its own process #
Under 2019, you extended your ISMS risk assessment to cover privacy. Under 2025, the PIMS has its own planning clause, and privacy risk sits inside it. BSI notes that planning must now address privacy risk in the light of your legal, regulatory and operating setting. UKAS lists embedded privacy risk management as one of the main changes.
In practice, your risk method must speak to harm to the people whose data you hold, not only to your firm. If you run both standards, you can still share one method. You just have to show that it covers both kinds of risk.
Context, leadership and climate #
Clause 4 now asks you to state how you process personal data and which privacy laws apply to you. Clause 5 puts more weight on top management carrying privacy across the business, not just in IT or legal. UKAS also flags climate change among the new points. The 2024 amendment added the same line to ISO 27001. You decide whether climate change is a relevant issue for your system.
Your own internal audit and management review #
Clauses 9 and 10 now belong to the PIMS. Your internal audit programme and management review must cover privacy on their own terms. Firms that run both standards often run one combined audit and one combined review. That works, as long as the records show that both systems got covered.
What trips people up
Standalone does not mean smaller. Under 2019, your ISMS carried the risk process, the internal audit, the document control and the security controls. If you now certify a PIMS without ISO 27001, all of that has to exist inside the PIMS. For a firm with no ISMS today, the 2025 edition is a real opening. For a firm that plans to drop ISO 27001 to save effort, it is not.
What changed in the controls #
The 2019 edition spread its controls across several places. Clause 6 added privacy guidance to the ISO 27002 controls. Annex A listed 31 controls for PII controllers and Annex B listed 18 for PII processors.
The 2025 edition pulls them into one annex with three tables.
PII controllers
Conditions for processing, obligations to data subjects, privacy by design and default, sharing and transfer.
PII processors
Conditions for processing on a customer’s behalf, support for their obligations, sharing and transfer.
Security for both
The information security controls a PIMS needs, now written into the privacy standard itself.
Table A.3 is the big one #
Table A.3 is what makes the standalone model work. It brings the security controls a PIMS depends on into ISO 27701 itself, so you do not need ISO 27002 to fill the gap. Schellman, an accredited certification body, makes a useful point here. Every control in A.3 already existed in some form in the 2019 edition or in ISO 27002:2022. Unlike the 2022 revision of ISO 27001, this edition adds no net-new controls.
So for a firm already certified to both standards, the control work is more a renumbering and remapping exercise than a rebuild. For a firm with no ISMS, A.3 is where most of the new effort sits.
Annex B is now the guidance #
In 2019, Annex B held the processor controls. In 2025, Annex B is informative guidance on how to put each Annex A control in place. If your documents cite “Annex B” for a processor control, that reference is now wrong. Your Statement of Applicability needs the same care. Every 2019 clause reference in it should give way to a 2025 table and control number.
Watch the control counts
Published summaries disagree on how many controls sit in each 2025 table. One certification body gives 34, 21 and 31. Other guides give lower numbers. Count from your own licensed copy of the standard before you size the work or build your Statement of Applicability.
The mapping annexes #
The informative annexes still map ISO 27701 to other frameworks. BSI lists four. Annex C maps to ISO/IEC 29100 and Annex D to the EU GDPR. Annex E maps to ISO/IEC 27018 and ISO/IEC 29151. Annex F links back to the 2019 edition. Annex F is the one to open first if you are moving an existing certificate.
Note what is not there. The standard maps to GDPR, not to North American law. Your program may need to cover PIPEDA or Quebec Law 25 in Canada. It may need HIPAA and the state privacy statutes in the United States. If so, you build that mapping yourself. Our ISO 27701 vs GDPR comparison shows how far the GDPR map goes and where it stops.
| Topic | ISO/IEC 27701:2019 | ISO/IEC 27701:2025 |
|---|---|---|
| Relationship to ISO 27001 | Extension. An ISMS is required. | Standalone. An ISMS is optional. |
| Management system clauses | Clause 5 adds to ISO 27001 Clauses 4 to 10 | Own Clauses 4 to 10 in the harmonized structure |
| Privacy risk | Added to the ISMS risk assessment | Built into PIMS planning |
| Controller controls | Annex A, with Clause 7 guidance | Annex A, Table A.1 |
| Processor controls | Annex B, with Clause 8 guidance | Annex A, Table A.2 |
| Security controls | Clause 6 adds to ISO 27002 | Annex A, Table A.3 |
| Implementation guidance | Clauses 6, 7 and 8 | Annex B |
| Rules for certification bodies | ISO/IEC TS 27006-2:2021 | ISO/IEC 27706:2025 |
What changed for certification #
ISO/IEC 27706:2025 sets the rules for bodies that audit and certify a PIMS. It replaces ISO/IEC TS 27006-2:2021. UKAS says the new standard defines competence for PIMS auditors and tightens impartiality rules. It also sets audit time and scope by controller and processor role.
For you, this means two things. Your certification body needs accreditation for the 2025 edition before it can audit you against it. And audit time now depends in part on whether you act as a controller, a processor or both.
Accreditation in Canada and the United States #
A PIMS certificate carries weight when an accreditation body stands behind the firm that issued it. In Canada, the Standards Council of Canada runs the PIMS accreditation program. In the United States, ANAB does. Ask your certification body which accreditation covers its 27701:2025 audits, and when it received it.
The transition dates #
The deadline for certified firms is the same across the sources we checked. Certificates issued against the 2019 edition must move to the 2025 edition by 31 October 2028. After that date, a 2019 certificate is no longer valid.
The deadline for certification bodies is not the same everywhere. UKAS gives its bodies until 31 October 2027. Schellman reports that ANAB, under Heads Up 550, set 31 October 2026 for the bodies it accredits. Some guides also quote 1 October 2028 for clients. The accreditation bodies say 31 October. Plan against the date in your own certification body’s notice, not a blog post.
What good looks like
A transition audit booked with your next surveillance or recertification visit, well before October 2028. A gap analysis built from Annex F. A Statement of Applicability rebuilt on Tables A.1 to A.3. An internal audit and a management review that cover the 2025 edition, with minutes to prove it.
What to do next #
If you hold a 2019 certificate #
- Confirm your dates. Ask your certification body when it gained accreditation for the 2025 edition. Then ask when it can schedule your transition audit.
- Run a gap analysis from Annex F. Map each 2019 clause and control to its 2025 home. Most will move rather than change.
- Decide on scope and role. The 2025 edition lets your PIMS scope differ from your ISMS scope. Confirm whether you act as a controller, a processor or both.
- Rebuild the Statement of Applicability. Replace 2019 references with Table A.1, A.2 and A.3 control numbers, with a reason for each exclusion.
- Update the management system. Add privacy to your context, risk method, objectives, internal audit and management review. Record the climate change decision.
- Book the audit. A transition can run with a surveillance or recertification visit, or on its own.
If you are starting fresh #
Build on the 2025 edition from day one. There is no reason to certify against a withdrawn standard and then transition. If you already hold ISO 27001, run the PIMS as an integrated system and share the machinery. If you do not, treat 27701 as a full management system project, with Table A.3 as its security core. Our guide to designing and implementing a PIMS walks through the build, and what ISO 27701 certification is covers the basics.
Frequently asked questions #
What is the main difference between ISO 27701:2019 and ISO 27701:2025?
The 2019 edition was an extension to ISO 27001 and ISO 27002, so you needed an ISMS first. The 2025 edition is a standalone management system standard. It has its own Clauses 4 to 10 and its own security controls in Annex A, Table A.3.
Do I need ISO 27001 to get ISO 27701:2025 certification?
No. ISO confirms that you can use ISO/IEC 27701:2025 alone. You can still run it alongside ISO 27001 as an integrated system. Many firms will, because the two can share risk, audit and review processes.
When must I transition my ISO 27701:2019 certificate?
By 31 October 2028. UKAS and ANAB both use that date for certified firms. After it, a 2019 certificate is no longer valid. Confirm the timing with your own certification body, since its own deadline to transition may be earlier.
Are there new controls in ISO 27701:2025?
The 2025 edition sorts the controls into three Annex A tables for controllers, processors and shared security. Schellman, an accredited certification body, reports that the security controls in Table A.3 all existed in some form before. So the edition adds no net-new controls.
What is ISO/IEC 27706:2025?
It is the standard for bodies that audit and certify a PIMS against ISO 27701. It replaces ISO/IEC TS 27006-2:2021 and sets auditor competence, impartiality rules and audit time based on controller and processor roles.
Does ISO 27701:2025 map to PIPEDA or US state privacy laws?
No. Its mapping annex covers the EU GDPR. For PIPEDA, Quebec Law 25, HIPAA or the state privacy statutes, you build that mapping yourself from the Annex A controls.
Key takeaways #
- ISO/IEC 27701:2025 is a standalone PIMS standard. You no longer need ISO 27001 to use it or certify to it.
- The PIMS now has its own Clauses 4 to 10, with privacy risk built into planning.
- Annex A holds three tables: controllers, processors and shared security controls.
- Table A.3 brings security controls into the privacy standard, and none of them are net-new.
- Annex B is now guidance, so any document that cites Annex B for processor controls needs an update.
- 2019 certificates must move to 2025 by 31 October 2028. Check your certification body’s own date.
- Standalone does not mean lighter. Without an ISMS, you run the risk, audit and security work inside the PIMS.
Move your PIMS to the 2025 edition #
We run the gap analysis from Annex F and rebuild your Statement of Applicability on the new tables. Then we prepare you for the transition audit, well before the October 2028 deadline.
