Key Facts
- Regulator
- ISO/IEC JTC 1/SC 27 (published by ISO and IEC)
- Latest version
- ISO/IEC 27701:2025 (Edition 2), which replaced ISO/IEC 27701:2019
- Effective
- 14 October 2025
- Official text
- www.iso.org ↗
What is ISO/IEC 27701?
ISO/IEC 27701 is the international standard for a Privacy Information Management System (PIMS): the requirements and guidance for managing personally identifiable information responsibly. ISO and IEC publish it through committee JTC 1/SC 27. It applies to any organisation that handles personal data, and is designed for PII controllers and processors.
Its full title is Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance. The current version is ISO/IEC 27701:2025 (Edition 2), published on 14 October 2025. ISO lists it as published (stage 60.60), and no revision is under way.
The 2025 edition replaced ISO/IEC 27701:2019, which is now withdrawn. The 2019 edition was written as an extension to ISO/IEC 27001 and ISO/IEC 27002, for organisations handling personal data inside an information security management system (ISMS). The 2025 edition stands on its own. Anyone still working from an ISO 27701:2019 document is using a superseded edition.
Why it matters
The customer's data protection questionnaire asks who is accountable for personal data in your service. The honest answer is often a folder of policies with no single owner.
ISO/IEC 27701 turns that folder into a management system that is run, checked and improved. ISO says the standard helps organisations show compliance with privacy laws such as GDPR. That is why ISO 27701 certification comes up when a customer wants evidence of how you handle personal data.
The limit matters as much as the benefit. The ICO describes ISO 27701 as a management system that focuses on policies and procedures, and says those policies must also work in practice. A certificate is evidence that you manage personal data on purpose. It is not a finding that any given processing is lawful.
A management system proves you have a process. It does not prove every processing operation is lawful.
Who it applies to
ISO/IEC 27701 is voluntary. It is an international management system standard that organisations choose to adopt, and no law requires it. It becomes contractual only when a customer writes it into a supplier agreement, and then the obligation comes from the contract, not the standard.
In practice that means any organisation that collects, stores or uses personal data, whether public, private or not-for-profit, acting as a controller, a processor or both. A software provider is often a processor for its customers' data and a controller for its own staff and marketing data, so one PIMS can cover both roles.
Unlike the 2019 edition, ISO/IEC 27701:2025 does not need an ISO 27001 ISMS underneath it: ISO says it can be used alone. ISO also says it aligns with existing ISO/IEC 27001 systems, so a certified firm can extend the system it already runs. Inside ISO 27001, privacy has one Annex A control, A.5.34 Privacy and protection of PII; ISO/IEC 27701 is the full management system behind it.
The UK position
No UK law requires ISO/IEC 27701. A UK firm meets it when a customer or partner asks for it, or when it wants a structured way to evidence accountability under UK GDPR. Three regimes sit around it:
| Regime | Who it affects | How ISO/IEC 27701 relates |
|---|---|---|
| UK GDPR and Data Protection Act 2018 | UK organisations processing personal data | A PIMS can support accountability evidence. The ICO calls ISO 27701 a management system focused on policies and procedures, not a test of whether processing complies with the law |
| UK GDPR Article 42 certification schemes | Organisations seeking ICO-approved certification | Separate from ISO 27701. These schemes assess specific processing operations, not the management system |
| EU GDPR | UK firms that handle EU personal data | ISO says the standard helps demonstrate compliance with privacy regulations such as GDPR |
The ICO says an existing certificate could count as evidence when an organisation is assessed for a new certification, and that UK GDPR schemes are not meant to replace ISO standards. Read the ICO's certification FAQs before calling an ISO 27701 certificate GDPR certification.
Key requirements
ISO's public pages describe the shape of the standard, not its clauses. What they confirm:
- A management system for privacy. Set up, run, maintain and keep improving a PIMS. The standard gives requirements, plus guidance on putting them into practice.
- A role for each set of personal data. The requirements are written for PII controllers and processors, so the first step is deciding which role you hold for each processing activity.
- Accountability with evidence. ISO presents the PIMS as a way to show accountability, manage risks around personal data and keep evidence of how privacy is managed.
- Standalone or integrated. The 2025 edition runs on its own or alongside an existing ISO/IEC 27001 system.
Controls and the 2025 edition
People searching for an ISO 27701 controls list usually want the detailed controls. ISO's public pages do not list them, and this entry does not either. Work from the purchased 2025 text.
A controls list copied from the withdrawn edition is a checklist for a standard that no longer exists.
Frequently asked questions
ISO/IEC 27701 is the ISO and IEC standard for privacy information management. It sets requirements for a Privacy Information Management System (PIMS) across all of an organisation's personal data. Narrower companions exist: ISO/IEC 27018, for example, is a code of practice for public cloud providers that process personal data for customers. ISO/IEC 27701 is the broader management system standard.
ISO 27701 primarily focuses on personal data rather than information in general. ISO/IEC 27701 asks who is the controller or processor, who is accountable, and how risks to personal data are managed and evidenced. ISO/IEC 27001 protects the confidentiality, integrity and availability of all information; ISO/IEC 27701 covers the privacy questions that security controls alone do not answer.
ISO/IEC 27001 certifies an information security management system; ISO/IEC 27701 covers privacy information management. Under the 2019 edition, ISO 27701 could only sit on top of an ISO 27001 ISMS. Since the 2025 edition it can stand alone, so an ISO 27001 certificate on its own says little about privacy, and an ISO 27701 certificate no longer implies ISO 27001.
No. The ICO lists ISO 27701 alongside ISO 27001 and BS 10012 as management systems that focus on policies and procedures. Only schemes built under Article 42 of the UK GDPR and approved by the ICO give that assurance about specific processing, and the ICO publishes the approved schemes. An ISO 27701 certificate may still count as evidence in such an assessment.
ISO/IEC 27701:2025, Edition 2, is current. ISO published it on 14 October 2025, and the 2019 edition is withdrawn. When a supplier offers an ISO 27701 certificate, check which edition it names: a 2019 certificate was assessed as an extension to an ISO 27001 ISMS, not as a standalone privacy management system.