ISO/IEC 27701:2025 is the international standard for privacy information management systems. This glossary explains the words you will hear in meetings about it, in plain language, so that engineers, legal and security can talk about the same thing. It describes the standard. It does not certify anyone.
What is ISO 27701?
The 2025 edition is a standalone standard, with the title "Information security, cybersecurity and privacy protection, Privacy information management systems." The 2019 edition extended ISO/IEC 27001 and 27002. Kiwa, a certification body, notes the new edition uses the same terminology and structure as the ISO 27000 family, adds emphasis on governance, accountability and transparency, and widens guidance on modern technologies. The same page states that an ISO 27001 certificate is no longer a prerequisite, though its linked pages still use older wording, so check with your certification body.
Glossary
PIMS. Privacy information management system. The set of policies, roles, processes and records through which you manage privacy risk on purpose and keep improving it.
PII. Personally identifiable information. Information that can identify a person, directly or in combination with other data.
PII controller. The party that decides why and how personal data is processed. Similar to a "controller" under the GDPR.
PII processor. The party that processes personal data on behalf of a controller. The standard addresses the split between the two roles, and your role may differ by product.
Scope. The boundary of what the PIMS covers: which products, sites, processes and data. A narrow scope is cheaper to run, and a customer may ask whether it covers what they use.
Management system. The shared structure ISO standards use: policy, objectives, internal audit, management review and corrective action. If you run ISO 27001 already, much of this will look familiar.
Risk assessment. A structured look at what could go wrong for the people whose data you hold, not only for the company.
Statement of Applicability. A document that lists the controls you chose, which apply, and why others do not. Auditors read it closely.
Records of processing. A record of what personal data you process, why, where it goes and how long you keep it. Privacy laws such as the GDPR have similar requirements.
Data subject. The person the data is about.
Internal audit. A check you run on your own system before the external audit. Findings and fixes are evidence.
Nonconformity. A requirement that is not met. Minor and major categories exist in most certification schemes, so ask your auditor what applies.
Corrective action. What you do to fix a nonconformity and stop it from recurring.
Certification body. The organization accredited to audit your system against the standard. It is separate from the standards body.
Where does engineering come in?
Engineers feed the risk assessment and the controls. Typical evidence includes data flow diagrams, retention settings, access reviews, encryption status, and a list of third party components that handle personal data. An SBOM and dependency scan history show what software touches the data. Safeguard's compliance automation can help gather and map this evidence, and the certification decision stays with the certification body.
What to do
- Decide which products and data are in scope.
- Confirm your role, controller or processor, for each.
- List the personal data you process and where it lives.
- Run a privacy risk assessment and record it.
- Draft a Statement of Applicability and review it with legal.
- Collect technical evidence on a schedule.
- Hold an internal audit before booking the external one.
Quick check
Do I need ISO 27001 first?
The 2025 edition is standalone, and Kiwa states that a 27001 certificate is no longer a prerequisite. Ask your certification body to confirm for your case.
Is ISO 27701 required by law?
Certification is voluntary. Privacy laws set their own duties, so ask counsel what applies to you. ISO 27701 is a way to show your practice.
Sources
Last reviewed: 18 October 2026.
