ISO/IEC 27701 certifies a privacy information management system, and the 2025 edition can be implemented on its own without ISO/IEC 27001. Automate evidence that systems produce, such as access and configuration records, and keep records of processing, risk decisions and reviews with named privacy owners.
What changed in the 2025 edition?
The 2019 edition extended ISO/IEC 27001. Certification bodies reporting on the October 2025 revision say it is now a standalone standard for a privacy information management system, titled "Information security, cybersecurity and privacy protection, Privacy information management systems." They also report more emphasis on governance, accountability and transparency.
We could not confirm the exact publication date from ISO's own site. Reports differ by a few days in October 2025, so we do not state one. Read the standard from ISO or your national standards body before you plan against clause numbers.
Why does a privacy standard need so much evidence?
Because certification is an audit of operation, not intent. An auditor will ask to see how your organisation decides what personal data it handles and why, who can access it, how requests from individuals are handled, how suppliers are chosen, and how often you review all of this. A policy answers none of those on its own.
What can be collected by a system?
Think about where personal data lives and who touches it.
- Access to systems holding personal data. Account lists, role assignments and MFA status from your identity provider and cloud accounts.
- Technical protections. Encryption and logging settings on storage and databases.
- Change history. Pull request approvals and deployment records for code that handles personal data.
- Supplier inventory. The list of connected services and who approved them, if your tooling tracks it.
- Security testing over time. Dated scan results show regular testing.
Each of these can be exported on a schedule with a timestamp, so you accumulate a record instead of rebuilding one before the audit.
What stays with people?
- The record of processing: purposes, data categories, retention, recipients and transfers. Tools can store it. Only the business can decide it.
- Risk assessments for new processing, with a signed outcome.
- Handling of access, deletion and correction requests, including how you decided when to refuse.
- Supplier due diligence and contract terms.
- Management review, which is a meeting with minutes, not a dashboard.
A working plan
- Get the current text of the standard and list what your scope needs to show.
- For each item, mark it automatic, semi automatic or manual.
- Connect identity, cloud and source control first.
- Create one register for processing activities with an owner per row.
- Schedule evidence collection and decide how long you keep it.
- Hold a management review and record it.
- Run an internal audit before the external one. Pick items at random and trace each to a dated artifact.
- Log gaps with owners and due dates.
What does Safeguard say it covers?
Safeguard's compliance documentation describes a framework library that includes national data protection laws and industry standards, and explains that each framework page lists which requirements a scan decides and which need your evidence. The pages we read do not describe an ISO 27701 mapping, so do not assume one. Safeguard does not certify you against ISO 27701. Only an accredited certification body can do that.
Quick check
Do we need ISO 27001 first?
Reports on the 2025 edition say it can be implemented standalone. Confirm with your certification body how they will scope your audit.
Can evidence be fully automated?
No. System data can be, but processing records, risk decisions and management review need people.
Sources
Last reviewed: 18 October 2026.
