ISO/IEC 27701 is the international standard for a privacy information management system, or PIMS. The 2025 edition stands on its own, so you no longer need an ISO 27001 certificate first. It suits any organization that decides how personal data is used (a controller) or handles it for others (a processor), especially when customers ask for proof.
What changed in the 2025 edition?
The 2019 edition was an extension to ISO/IEC 27001 and 27002. Kiwa, a certification body, describes the 2025 revision as no longer an extension but a full standalone standard, now titled "Information security, cybersecurity and privacy protection: Privacy information management systems."
Coalfire, another certification body, adds that the standard follows the high level structure shared by ISO 27001, ISO 9001 and other management system standards, which makes combined audits easier. It also notes that organizations certified to the 2019 version should move to the 2025 version before 31 October 2028, which means updating the statement of applicability and completing an internal audit with the 2025 text in scope.
Two practical consequences follow. A company that never pursued ISO 27001 can still certify a PIMS. A company that holds ISO 27001 can integrate the two systems rather than running parallel programs.
Who needs it?
No law makes ISO 27701 mandatory. The need comes from buyers, regulators and your own risk posture.
Processors with enterprise customers. If your customers send you personal data, their procurement teams increasingly ask how you manage privacy. A certificate answers many questionnaire rows at once.
Controllers in regulated markets. The standard speaks to the responsibilities of both controllers and processors and supports compliance with privacy laws such as the GDPR. Kiwa notes this support role. Certification does not by itself prove legal compliance, so keep your legal assessment separate.
Teams already running ISO 27001. The incremental effort is smaller, because governance, internal audit and management review already exist.
Probably not yet: a small team with no personal data beyond staff records and no customer asking. A written privacy policy and a data inventory may be enough for now.
What does an audit look at?
Expect questions about what personal data you hold, why you hold it, where it flows, who can access it, how long you keep it, and how you respond to requests from individuals. Auditors look for records that show the system runs, not only that policies exist.
What to do
- Build a data inventory: systems, categories of personal data, purposes and recipients.
- Decide whether you act as controller, processor, or both for each flow.
- Check with your largest customers whether they expect ISO 27701 or accept another assurance report.
- Decide whether to integrate with an existing ISO 27001 system or start standalone.
- Run a gap assessment against the 2025 text, which you buy from ISO or a national body.
- Assign an owner for privacy who is separate from the security lead where possible.
- Pick a certification body that is accredited for the 2025 edition and ask about their transition rules.
- Schedule an internal audit before the external one.
Quick check
Do I need ISO 27001 before ISO 27701?
Not under the 2025 edition. Certification bodies report that it is now a standalone standard and that holding ISO 27001 is no longer required before certifying a PIMS.
Does ISO 27701 certification make me GDPR compliant?
No. It supports compliance work and gives structure, but legal compliance is a separate judgment against the law and your facts.
Sources
- Kiwa: ISO/IEC 27701:2025 published, fetched 18 October 2026.
- Coalfire: ISO/IEC 27701:2025, the standalone PIMS, fetched 18 October 2026.
Both sources are certification bodies, not ISO itself. Read the standard text before you rely on a clause detail.
Last reviewed: 18 October 2026.
