ISO/IEC 27701 is the international standard for a privacy information management system. Its October 2025 revision made it standalone, so it can be implemented and certified without ISO/IEC 27001. A CTO decides whether customers need it, how it combines with an existing security system, and which data systems come into scope.
What changed in 2025?
The original 2019 edition was an extension to ISO/IEC 27001 and 27002, so you needed a security management system first. According to the public summary of the standard, the October 2025 revision replaced it with a stand-alone standard that has its own management system clauses 4 to 10, aligned with the 27001:2022 and 27002:2022 structures. It also expands guidance on cloud services, AI related processing, IoT, biometrics and health data.
Because the source we could fetch for this is a secondary summary, read the ISO catalogue entry before you commit to a plan.
What is a PIMS?
A privacy information management system is the same idea as a security management system, aimed at personal data. You define scope, assess privacy risk, apply controls, run them, audit and improve. Controls cover things like purposes and lawful basis records, data subject requests, retention, transfers, processor management and privacy by design.
It is a management system standard, not a law. Certification does not mean you comply with GDPR or any other privacy law, though it can support the evidence.
Where does a CTO feel it?
Engineering owns the data map and most privacy controls in practice.
- Inventory: which systems hold personal data, why, and for how long.
- Retention and deletion: automated, tested, and covering backups and logs.
- Data subject requests: export and erasure paths that reach every store.
- Processors: the list of vendors that touch personal data, and the contracts and reviews behind them.
- Design: privacy review as part of the release process, such as data minimisation and default settings.
Each of these produces evidence an auditor can sample.
What do you decide?
First, whether the standard is needed: look for customers or tenders that name it. Second, whether to combine it with a 27001 programme. If you already run 27001, the management system machinery of audits, reviews and corrective actions is mostly shared, and the privacy controls add to it. If you have neither, the standalone route means you can choose, but you will still need security controls to protect the data, so expect overlap anyway.
Third, scope. Include the products and data flows where you act as controller or processor, and say which role applies to each. A standard that mixes the two roles loosely produces confused evidence.
What is not yours?
Role determination, lawful bases and privacy notices belong to legal and the privacy lead. You provide facts about systems and flows.
What should you avoid claiming?
Do not tell customers you are GDPR compliant because you hold, or are pursuing, this certificate. Say what is true: scope, status and certification body.
How to check or apply this
- Collect customer requirements that name the standard.
- Check the current ISO catalogue entry for the edition and clauses.
- Decide whether to run it alongside an existing 27001 system.
- Build a data inventory with role, purpose and retention per system.
- Test erasure and export end to end, including backups and vendors.
- Add a privacy review step to your release process.
Quick check
Do I need ISO 27001 first?
Not under the 2025 revision, which is stand-alone per the public summary. Confirm with the ISO catalogue and your certification body.
Does it prove GDPR compliance?
No. It certifies a management system. Legal compliance is a separate question.
Sources
Last reviewed: 18 October 2026.
