After you certify to ISO/IEC 27701, keep the privacy management system alive with a calendar: monthly checks on processing records, requests and incidents, a quarterly review of suppliers and changes, and a yearly internal audit and management review. Also track the transition to the 2025 edition, whose rules are still being finalised.
What changed with the 2025 edition?
According to DNV, ISO and IEC published the revised ISO/IEC 27701 on 14 October 2025, replacing the 2019 edition. DNV describes it as no longer an extension of ISO/IEC 27001, while still built on it with added privacy controls, and designed to work with ISO 9001, ISO 27001 and ISO 42001. It has more comprehensive privacy controls for personally identifiable information (PII) controllers and processors, and aligns better with regulations such as GDPR.
As of the DNV page we fetched on 18 October 2026, no final transition timeline was set: the IAF was still developing transition rules, ISO transitions typically run up to three years, and the period may be as short as two. Accreditation bodies set the timeline for existing certificate holders. Ask your certification body for its plan, and read the 2025 text before your next surveillance audit.
What does a living privacy system look like?
A management system fails after certification because the routines stop, not because the design was wrong. Build the routines into a calendar with names.
Monthly
- Processing records: did any team add a purpose, data type, system or recipient? Update the record the same day.
- Rights requests: log every request, check each met its deadline, and look at the causes of any delay.
- Incidents and near misses: review each privacy event, and check that notifications to authorities and customers met their deadlines.
- Training and access: are new staff trained, and have leavers lost access to personal data systems?
Quarterly
- Suppliers and processors: confirm contracts and data processing terms exist, list sub processors and review changes.
- Retention: sample one data store and check that deletion rules ran.
- Changes: review launches and new analytics or AI features for privacy impact, and confirm impact assessments were done where your policy requires them.
- Metrics: trends in requests, incidents and complaints.
Yearly
- Internal audit, done by someone who is independent of the processes audited.
- Management review: results, incidents, audit findings, changes in law, resources and decisions.
- Risk and applicability review: have your privacy risks changed, and does your statement of applicability still match?
- Policy review and re approval.
How do surveillance audits fit?
Certification bodies check certified systems during the certificate cycle, so assume your auditor will ask for records from the period since the last visit. A system with a monthly log, dated reviews and a closed corrective action list passes these visits with little drama. Ask your certification body for the visit schedule.
What about corrective actions?
Any nonconformity, from an audit, an incident or a customer complaint, goes on one register with cause, fix, owner and date. Close each with evidence. Open items older than your own deadline are the first thing an auditor will look at.
Mistakes to avoid
- Pausing the routines after the certificate arrives.
- Updating the processing record only before audits.
- Treating the 2025 edition as someone else's problem until the deadline.
- Letting the internal audit be done by the person who runs the system.
What to do
- Build the monthly, quarterly and yearly calendar with an owner for each item.
- Create one corrective action register and review it monthly.
- Add a change trigger so new processing updates the record within days.
- Schedule the internal audit and management review for the full year ahead.
- Obtain the 2025 edition and ask your certification body for the transition plan.
- Keep dated records for every cycle, and file them by month.
Quick check
Do we need ISO 27001 to certify against the 2025 edition of 27701?
Reports on the new edition say it can be pursued on its own, though the standard builds on ISO 27001 content. Ask your certification body to confirm for your case.
When does the transition to the 2025 edition end?
No final date was published on the DNV page we read. Ask your certification body, since accreditation bodies set the timeline.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, which suits a system whose upkeep is a monthly cycle. Evidence is collected from connected systems and code instead of screenshots, and monitoring runs continuously between audits so a missed routine is visible early. Technical evidence from scans and SBOMs shows which libraries and services handle data, a useful input to supplier and processing reviews. Safeguard helps you prepare and keep evidence ready. It does not certify you or replace the certification body. See the framework mapping demo.
Sources
- DNV, Revision of ISO/IEC 27701, fetched 18 October 2026. We did not have access to the standard text.
Last reviewed: 18 October 2026.
