ISO/IEC 27701 is the international standard for a Privacy Information Management System (PIMS). It defines requirements for establishing, running, and improving a privacy program covering both PII controllers and PII processors. The 2025 edition is now a standalone standard, where the original 2019 edition required an existing ISO 27001 ISMS as a prerequisite.
What does ISO 27701 add on top of ISO 27001?
It adds a PIMS layer covering controller and processor duties, lawful basis tracking, data subject rights, transfer impact, and breach reporting.
The 2019 edition extended ISO 27001 and 27002 with PIMS-specific requirements and two annexes of controls (Annex A for controllers, Annex B for processors). The 2025 edition restructures the standard so it can be implemented either standalone or in combination with 27001 (ISO).
Who certifies ISO 27701 and how does it map to GDPR?
Certification follows the same accredited-body pattern as 27001, with audit-body requirements set in the new ISO/IEC 27706:2025 standard.
ISO 27701 was designed by ISO and IEC explicitly as the certifiable artifact organizations could point to as evidence of GDPR alignment (ISO 27706). The mapping is not a legal substitute for GDPR compliance, but EU regulators and buyers treat a clean 27701 certificate as material evidence under Articles 24 and 28 of GDPR.
Why does ISO 27701 keep showing up in privacy questionnaires?
Because it is the only widely-recognized certifiable privacy framework, and EU buyers want a privacy audit that mirrors what 27001 gives on security.
Most teams we see ship 27701 after they already hold 27001, then bundle it with a SOC 2 Privacy criterion attestation for the US market. Carrying both reduces the data-protection-questionnaire prep work in any cross-border deal, especially with TPRM teams handling EU and US buyers in parallel.
Related terms
These adjacent terms cover the base ISMS, the cloud-only PII companion in the 27000 series, and the privacy regulation that drives most 27701 asks.
- ISO 27001 - the ISMS the 2019 edition of 27701 extended and the 2025 edition still pairs with
- ISO 27017 - the cloud-services control set 27701 sits alongside on combined certificates
- ISO 27018 - the cloud-only PII-processor code 27701 supersedes for org-wide privacy
- GDPR - the EU regulation the 27701 control set is most often used to evidence alignment with