CYBER SECURITY COMPLIANCE · ISO 27701
ISO/IEC 27701: 2025
Standalone PIMS Readiness and Audit Preparation
ISO/IEC 27701 was republished on 14 October 2025 as a standalone privacy information management system standard. It no longer requires ISO/IEC 27001 underneath it, which changes who can certify and what a certificate proves. Organizations holding the 2019 edition have until 31 October 2028 to transition, and the real constraint is their own recertification cycle rather than that date. Elevate Consult builds the PIMS, defines controller and processor obligations, and produces the evidence enterprise due diligence teams actually test.
CONTROL STRUCTURE
Ninety three controls across four themes
The 2022 edition restructured Annex A from 114 controls in fourteen domains into 93 controls across four themes, with eleven controls new to the edition.
The standard is now standalone
The 2019 edition was an extension to ISO/IEC 27001 and 27002, and certification required an ISMS underneath it. The 2025 edition is a management system standard in its own right. An organization can now design and certify a PIMS without pursuing ISO 27001 at all, which opens certification to teams that handle PII without operating a full information security program.
Clauses 4 to 10 are self-contained
The revision adopts the harmonized structure used across ISO management system standards. The clauses no longer cross-reference ISO 27001, though alignment remains straightforward for organizations holding both. Clauses 4.1 and 4.2 now include the climate change context requirement applied across ISO management standards.
Annex A was consolidated
Controls for PII controllers and PII processors were unified into a single consolidated structure rather than split across separate annexes, with role-based obligations stated more explicitly and therefore more auditably.
Certification bodies moved to a new standard
Controls for PII controllers and PII processors were unified into a single consolidated structure rather than split across separate annexes, with role-based obligations stated more explicitly and therefore more auditably.
WHAT IT ISÂ
A management system for privacy, not a privacy policy
ISO/IEC 27701 sets requirements for establishing, implementing, maintaining and continually improving a privacy information management system. It applies to organizations acting as PII controllers, PII processors, or both, and it exists to let an organization prove privacy accountability rather than assert it.
Â
The practical difference from a privacy statement is evidence. A PIMS produces a risk register with owners, operational procedures across the PII lifecycle, supplier governance with monitoring records, and an internal audit trail. Those are the artifacts an enterprise buyer’s due diligence team asks for.
WHY IT MATTERSÂ
Enterprise buyers stopped accepting assertions
Security and privacy reviews increasingly ask for proof rather than policy. A recognized PIMS with consistent evidence moves an organization through those reviews faster, and the 2025 standalone structure means a privacy-first signal is now available without first building an ISMS. It also supports alignment with global privacy expectations including GDPR-style accountability, without functioning as a legal substitute for any of them.
Scope and context
Clause 4
Define PIMS scope, interested parties, PII processing context, and the systems and flows in scope.
Leadership and accountability
Clause 5
Assign roles, responsibilities and governance oversight with real decision authority.
Privacy risk assessment
Clause 6
Identify privacy risks, decide treatment, track residual risk, and evidence the decisions.
Operational controls
8 controls
Procedures for collection, access, sharing, retention, deletion and incident handling across the PII lifecycle.
Supplier governance
Clause 8
Due diligence, contract clauses, monitoring cadence and evidence capture for processors and subprocessors.
Performance evaluation
Clauses 9 and 10
Metrics, internal audit, management review, corrective action and evidence-based continual improvement.
OUR PROCESS
Scope, roles, risk, controls and evidence
Elevate Consult builds the PIMS around the controller and processor distinction, because that determines which obligations apply and where most programs get their role boundaries wrong.
Readiness and gap assessment
Define scope and controller or processor roles, assess the current privacy program against the 2025 requirements, and deliver a prioritized remediation plan.
PIMS documentation and evidence library
Build audit-ready documentation and evidence structure: policies, procedures, risk register, control mappings and an evidence index.
Privacy risk program
Operationalize privacy risk assessment and treatment workflows that stay active rather than becoming one-time checklists.
Vendor and subprocessor governance
Implement third-party governance: questionnaires, contract clauses, monitoring cadence and evidence capture.
Audit preparation and findings support
Prepare teams for interviews, evidence sampling, internal audit and corrective action cycles.
Cross-mapping to reduce duplication
Map ISO 27701 to ISO 27001, GDPR accountability expectations and broader governance programs to eliminate repeated work.
ENGAGEMENT PHASESÂ
How the work runs
WHO THIS IS FORÂ
Roles Elevate works with on this standard
GET STARTED
Ready to build a standalone PIMS?
Whether the driver is a 2019 certificate that needs transitioning, an enterprise buyer asking which edition you hold, or a first privacy certification, Elevate Consult defines the scope, closes the gaps and builds the evidence library that accelerates due diligence.
FAQ
Common Questions
🡪 Can ISO 27701 be implemented without ISO 27001?
Yes. The 2025 edition is a standalone management system standard and no longer requires ISO/IEC 27001 as a prerequisite. An organization can scope and certify a PIMS independently, or maintain an integrated PIMS and ISMS where both are relevant. The 2019 edition did require an ISMS underneath it.
🡪 When do we have to transition from the 2019 edition?
The transition deadline is 31 October 2028, three years from the 14 October 2025 publication. The practical deadline is earlier: an existing certificate stays valid until it expires or the deadline arrives, whichever comes first, so the binding date is the next recertification audit. Certification bodies only had to be ready under the new regime by October 2026, so audit capacity will tighten as the window closes.
🡪 Is ISO 27701 the same as GDPR compliance?
No. GDPR is a regulation with legal force. ISO 27701 is a management system framework that helps operationalize privacy accountability and produce consistent evidence supporting regulatory expectations. Certification does not establish GDPR compliance and GDPR compliance does not produce a certificate.
🡪 What is a PIMS?
A privacy information management system: a structured set of policies, risk assessment processes, operational procedures, measurement and continual improvement covering how an organization processes personal information. It is the privacy equivalent of what an ISMS does for information security.
🡪 Who should pursue ISO 27701 certification?
Any organization processing PII at scale, particularly SaaS and cloud providers acting as processors, B2B platforms with multi-tenant environments and subprocessor chains, companies expanding internationally into new privacy regimes, and firms selling into regulated industries where privacy evidence is a procurement condition.
🡪 What is the practical benefit?
It reduces friction in privacy and security reviews by standardizing owners, controls and evidence across systems and vendors. Privacy stops being a set of assertions repeated per questionnaire and becomes a system that produces the same proof every time it is asked for.