ISO/IEC 27701 — Privacy Information Management System (PIMS)

ISO/IEC 27701:2025, "Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance", is an International Standard of ISO and IEC for a privacy information management system (PIMS). ISO/IEC JTC 1/SC 27 prepared it, and ISO and IEC released the second edition in October 2025.

Clause 1 gives the scope of the standard. The standard gives requirements to establish, implement, maintain, and continually improve a PIMS. It also gives guidance to help the organization implement these requirements. ISO/IEC 27701 is a voluntary standard (Foreword). Its requirements apply to an organization that implements it. Modulos gives the standard as two Frameworks, OFF-12 and MFF-13 (ISO/IEC 27701 in Modulos).

Key facts

Publisher

ISO and IEC, joint standard of ISO/IEC JTC 1/SC 27

Edition

Second edition, October 2025

Prior edition

ISO/IEC 27701:2019, withdrawn on 14 October 2025

Type

Voluntary, stand-alone management system standard

Scope

A PIMS for PII controllers and PII processors

Structure

Clauses 4 to 10 (harmonized structure). Annexes A and B normative, Annexes C to F informative.

Certification

Optional, by a certification body. The standard does not refer to certification.

Modulos Frameworks

OFF-12 (Organization level) and MFF-13 (AI System level)

The standard and its edition

ISO/IEC 27701:2025 is the second edition of the standard. Its Foreword tells you that the second edition cancels and replaces ISO/IEC 27701:2019, the first edition, and that the first edition was "technically revised". The Foreword gives one primary change: the standard became a stand-alone management system standard. The ISO catalog page also tells you that ISO/IEC 27701 is an independent management system standard. An organization can use it without a different management system standard.

The first edition, ISO/IEC 27701:2019, has the title "Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines". ISO and IEC released it in August 2019. It was for PII controllers and PII processors that process PII in an information security management system (ISMS). The ISO catalog page shows the 2019 edition as withdrawn on 14 October 2025. On the same date, ISO and IEC released the second edition.

Annex F (informative) of the 2025 edition shows the correspondence between the controls of Table A.3 and the information security controls of the 2019 edition. It gives no correspondence for Tables A.1 and A.2 (The six annexes).

"ISO 27701" is a short name for ISO/IEC 27701:2025, and the two Modulos Frameworks have this name.

ISO/IEC 27701 has one normative reference, ISO/IEC 29100, without a date (Clause 2). Thus the "latest edition" of ISO/IEC 29100 applies. The ISO catalog page shows ISO/IEC 29100:2024, the second edition of February 2024, as the edition that replaces the withdrawn 2011 edition.

Clause 3 uses the terms and definitions of ISO/IEC 29100, and it adds the definitions 3.1 to 3.25. The definitions of PII controller and PII processor come from ISO/IEC 29100. The definitions of joint PII controller (3.21) and customer (3.22) are in Clause 3. For these roles, see PII controller and PII processor roles.

Organizations that the standard applies to

ISO/IEC 27701 is for PII controllers and PII processors that have responsibility and accountability for the processing of PII (Clause 1). The standard applies to all organizations, large or small, of all types.

The Introduction of ISO/IEC 27701 (0.1) tells you that these organizations can use the standard:

• PII controllers, and also joint PII controllers
• PII processors, and also those that use subcontracted PII processors and those that process PII as subcontractors of a different PII processor.

The Introduction (0.1) also tells you that an organization that conforms to the requirements can supply evidence of how it processes PII. The use of the standard can give independent verification of this evidence.

In Clause 4.1, ISO/IEC 27701 requires the organization to determine if it is a PII controller or a PII processor. For the roles, see PII controller and PII processor roles.

Annex A of ISO/IEC 27701 has Table A.1 for PII controllers and Table A.2 for PII processors. Table A.3 has information security controls for the two roles (Annex A).

Structure of the standard

ISO/IEC 27701:2025 has a Foreword, an Introduction, 11 clauses, six annexes, and a bibliography. Clauses 4 to 10 contain the requirements for the PIMS.

Part	Contents	Page
Foreword and Introduction (0.1, 0.2)	The edition and its primary change, the organizations that can use the standard, and compatibility with other management system standards (0.2)	This page
Clauses 1 to 3	The scope of the standard, the normative reference ISO/IEC 29100, and the terms and definitions (3.1 to 3.25)	This page
Clauses 4 to 10	The requirements for the PIMS, from 4 Context of the organization to 10 Improvement. The PII role determination is in 4.1, the scope of the PIMS is in 4.3, and the statement of applicability is in 6.1.3 e)	Clauses 4 to 10, PII roles, Scope of the PIMS, Clause 6
Clause 11	Short information about Annexes C to F	The six annexes
Annex A (normative), PIMS reference control objectives and controls for PII controllers and PII processors	Table A.1 for PII controllers, Table A.2 for PII processors, and Table A.3 for the two roles. The organization uses Annex A through its privacy risk treatment (6.1.3). It can exclude a control, with a justification in its statement of applicability	Annex A
Annex B (normative), Implementation guidance for PII controllers and PII processors	Guidance for each Annex A control, with the same number. In its privacy risk treatment, the organization considers this guidance (6.1.3 h))	The six annexes
Annexes C to F (informative)	Annex C has a mapping to ISO/IEC 29100, Annex D to the GDPR, and Annex E to ISO/IEC 29151 and ISO/IEC 27018. Annex F gives the correspondence with ISO/IEC 27701:2019	The six annexes

ISO/IEC 27701 and the GDPR

ISO/IEC 27701 is a voluntary standard, and the GDPR, Regulation (EU) 2016/679, is binding EU law. Thus conformity with ISO/IEC 27701 is not the same as compliance with the GDPR. Annex D (informative) of ISO/IEC 27701 gives only an indicative mapping to the GDPR. ISO/IEC 27701 does not tell you that it is a certification mechanism of GDPR Article 42. For Annex D, certification in the GDPR, and the GDPR roles, see Conformity with ISO/IEC 27701 and compliance with the GDPR.

Use with ISO/IEC 27001 and ISO/IEC 42001

ISO/IEC 27701:2025 applies the framework that ISO made to align its management system standards (0.2). ISO/IEC 42001:2023 and ISO/IEC 27001:2022 give this framework the name harmonized structure, and ISO/IEC 27001:2022 also refers to Annex SL (0.2). With this framework, ISO/IEC 27701 lets an organization align or integrate its PIMS with other management system standards (0.2). Introduction 0.2 names the ISMS of ISO/IEC 27001 "in particular". The standard makes it possible to integrate the PIMS, but it does not make this necessary.

ISO/IEC 27001:2022 gives requirements for an information security management system (ISMS), and ISO/IEC 42001:2023 gives requirements for an AI management system. Clauses 4 to 10 have the same numbers and titles in the three standards. But each standard sets the requirements for the management system of that standard, and each adds or changes some requirements.

For example, the internal audit of ISO/IEC 27701 gives information on conformity with the requirements of ISO/IEC 27701 (9.2.1). An audit can be a combined audit (3.18 Note 1), but ISO/IEC 27701 does not make a combined audit necessary.

In Clauses 4 to 10, ISO/IEC 27701 adds privacy requirements. Examples are the PII role determination (4.1), the privacy risks to PII principals (6.1.2), and the information security program (6.1.3 c)). For these requirements, see ISO/IEC 27701 and the harmonized structure. The information security program can be, for example, an ISMS of ISO/IEC 27001, but it can also be a different information security program (3.24 Note 1).

To compare ISO/IEC 42001 and ISO/IEC 27001, see ISO 42001 and ISO 27001. For each standard, see the ISO/IEC 27001 and ISO/IEC 42001 pages. In Modulos, each standard has different Frameworks (Other Frameworks in Modulos).

Certification

ISO/IEC 27701 does not refer to certification, and certification is optional. A certification body can audit a PIMS and then give a certificate. For the certification audit cycle and the internal audits that ISO/IEC 27701 requires, see The certification audit cycle.

ISO/IEC 27701 in Modulos

Modulos gives ISO/IEC 27701 as two Frameworks with the name ISO 27701:

• OFF-12, at the Organization level, holds one Requirement for each subclause from 4.1 to 10.2, but not for 8.2 and 8.3. You add OFF-12 to your organization AI System. If you do not have an organization AI System, contact Modulos support.
• MFF-13, at the AI System level, holds 8.2, 8.3, and one Requirement for each table of Annex A.

In the standard, Clauses 8.2 and 8.3 and Annex A apply to the PIMS of the organization. Modulos puts them at the AI System level, and this is a decision of Modulos, not a structure of the standard. The page ISO/IEC 27701 in Modulos gives the decisions, the steps, and the Requirement table.

Where to go next

PII roles, PIMS scope, and certification

The PII controller and PII processor roles, the scope of the PIMS, and the certification audit cycle.

Clauses 4 to 10

The requirements of the PIMS in Clauses 4 to 10.

Annexes

The Annex A tables, the Annex B guidance, and the mapping annexes.

ISO/IEC 27701 and the GDPR

Annex D, certification, the data protection impact assessment, and breach notification in the GDPR.

ISO/IEC 27701 in Modulos

The Frameworks OFF-12 and MFF-13, the set-up steps, and the Requirement table.

ISO/IEC 27001

The standard for an information security management system.

See it in Modulos

Use the ISO 27701 Frameworks in Modulos for your PIMS: OFF-12 for the Organization, and MFF-13 for each AI System in the scope of the PIMS.

Request a demo

Frequently asked questions about ISO/IEC 27701

See Frequently asked questions about ISO/IEC 27701 for the full FAQ.

Sources of this page

• ISO/IEC 27701:2025, "Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance", second edition, October 2025 (ISO catalog page). Parts used:
  • the table of contents, the Foreword, the Introduction (0.1, 0.2), and Clauses 1 to 3 (3.1, 3.18, 3.21, 3.22, 3.23, 3.24, 3.25)
  • 4.1, 4.2, 4.3, 6.1.2, 6.1.3, 9.2, 9.3, and Clause 11
  • the text before Table A.1, Tables D.1, F.1, and F.2 with the text before them (with the NOTE of Annex D), and the titles of Annexes A to F.
• ISO/IEC 27701:2019, "Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines", first edition, August 2019, withdrawn (ISO catalog page).
• ISO/IEC 29100:2024, second edition, February 2024 (ISO catalog page).
• ISO/IEC 27001:2022: the Foreword, the Introduction (0.2), the clause titles of Clauses 4 to 10, 6.1.3 d), and Annex A.
• ISO/IEC 42001:2023: the Introduction and the clause titles of Clauses 4 to 10.
• IAF MD 5:2023, "Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems", of 14 June 2023: clauses 0.1, 0.3, 0.5, 5, and 6 (IAF).
• GDPR, Regulation (EU) 2016/679: Articles 24(3), 25(3), 28(5), 32(3), and 42(4) (EUR-Lex).

Disclaimer

This page gives general information and is not legal advice. It does not replace the audit of a certification body.