Appearance
ISO/IEC 27701 — annexes
ISO/IEC 27701:2025 gives its requirements for a privacy information management system (PIMS) in Clauses 4 to 10. Six annexes come after these clauses, and Clause 11 gives short information about Annexes C to F. This page gives the function of each annex and the controls of the three Annex A tables. It also shows how an organization uses Annex A in its privacy risk treatment (Clause 6.1.3). ISO/IEC 27701 is a voluntary standard, and an organization that implements it applies its requirements.
The six annexes
ISO/IEC 27701:2025 has six annexes. Annexes A and B are normative, and Annexes C to F are informative:
| Annex | Name | Normative or informative | Function of the annex |
|---|---|---|---|
| A | PIMS reference control objectives and controls for PII controllers and PII processors | Normative | Control objectives and controls in Table A.1 (PII controllers), Table A.2 (PII processors), and Table A.3 (the two roles). In its privacy risk treatment, the organization compares its necessary controls with Annex A (6.1.3 d)). |
| B | Implementation guidance for PII controllers and PII processors | Normative | Guidance for each Annex A control, with the same number. For example, the guidance for A.1.2.2 is in B.1.2.2. ISO/IEC 27701 requires the organization to consider this guidance for the controls that it determined in 6.1.3 b) and c) (6.1.3 h)). |
| C | Mapping to ISO/IEC 29100 | Informative | Table C.1 and Table C.2: an indicative mapping between the provisions of ISO/IEC 27701 and the privacy principles of ISO/IEC 29100. |
| D | Mapping to the General Data Protection Regulation | Informative | Table D.1: an indicative mapping to GDPR Articles 5 to 49, but not Article 43. The section Annex D gives more information. |
| E | Mapping to ISO/IEC 27018 and ISO/IEC 29151 | Informative | Table E.1: an indicative mapping. ISO/IEC 27018 is for PII processors that supply public cloud services. ISO/IEC 29151 gives more controls and guidance for PII controllers. An entry in Table E.1 does not show that the two provisions are equivalent. |
| F | Correspondence with ISO/IEC 27701:2019 | Informative | Tables F.1 and F.2: the correspondence between the information security controls of Table A.3 and the controls of Clause 6 of the 2019 edition. Annex F is for organizations that use the 2019 edition and want to change to the 2025 edition. In Table F.1, "N/A" identifies a control that the 2025 edition does not include. "New" identifies a control that the 2019 edition did not have. In Table F.2, "N/A" identifies a 2019 control that the 2025 edition does not include. Annex F has no correspondence for the controls of Tables A.1 and A.2. |
Table A.1, Table A.2, and Table A.3 give each control with "shall". Annex B gives the same control with "should", together with its implementation guidance. Annex B does not add controls to Annex A.
Annex A — reference controls for PII controllers and PII processors
Annex A of ISO/IEC 27701:2025 is normative. Annex A is for organizations that are PII controllers, PII processors, or the two. The Annex A introduction gives the function of each table:
- Table A.1 applies to PII controllers. A joint PII controller is a PII controller (3.21).
- Table A.2 applies to PII processors.
- Table A.3 "relates to" the information security controls for PII controllers and PII processors.
An organization with the two roles determines each role as a "separate" role, and each role has a "separate" set of controls (Clause 4.1). The section PII controller and PII processor roles gives the role determination.
Annex A is normative. But it is not necessary for the organization to use each control objective and each control of Annex A in its PIMS. ISO/IEC 27701 requires the organization to justify the exclusion of a control objective in its statement of applicability (Annex A introduction, 6.1.3 e)). Clause 6.1.3 e) also requires a justification for each excluded Annex A control. For example, the justification can be one of these:
- The risk assessment does not find the control necessary.
- The applicable legal requirements do not require the control or do not apply to it, or they make an exception to it. In 6.1.3 e), these include the legal requirements that apply to the PII principal.
This rule applies to Table A.3 as it applies to Table A.1 and Table A.2. Annex A gives possible privacy controls, and it does not give all possible privacy controls (6.1.3 NOTE 3 and NOTE 4). The organization can add other controls if necessary. The section Clause 6 gives the contents of the statement of applicability.
Table A.1 — controls for PII controllers
Table A.1 of ISO/IEC 27701:2025 has 31 controls for PII controllers, A.1.2.2 to A.1.5.5. The controls are in four groups, and each group has one control objective:
| Control objective | Control | Name of the control |
|---|---|---|
| Conditions for collection and processing | A.1.2.2 | Identify and document purpose |
| Conditions for collection and processing | A.1.2.3 | Identify lawful basis |
| Conditions for collection and processing | A.1.2.4 | Determine when and how consent is to be obtained |
| Conditions for collection and processing | A.1.2.5 | Obtain and record consent |
| Conditions for collection and processing | A.1.2.6 | Privacy impact assessment |
| Conditions for collection and processing | A.1.2.7 | Contracts with PII processors |
| Conditions for collection and processing | A.1.2.8 | Joint PII controller |
| Conditions for collection and processing | A.1.2.9 | Records related to processing PII |
| Obligations to PII principals | A.1.3.2 | Determining and fulfilling obligations to PII principals |
| Obligations to PII principals | A.1.3.3 | Determining information for PII principals |
| Obligations to PII principals | A.1.3.4 | Providing information to PII principals |
| Obligations to PII principals | A.1.3.5 | Providing mechanism to modify or withdraw consent |
| Obligations to PII principals | A.1.3.6 | Providing mechanism to object to PII processing |
| Obligations to PII principals | A.1.3.7 | Access, correction or erasure |
| Obligations to PII principals | A.1.3.8 | PII controllers' obligations to inform third parties |
| Obligations to PII principals | A.1.3.9 | Providing copy of PII processed |
| Obligations to PII principals | A.1.3.10 | Handling requests |
| Obligations to PII principals | A.1.3.11 | Automated decision making |
| Privacy by design and privacy by default | A.1.4.2 | Limit collection |
| Privacy by design and privacy by default | A.1.4.3 | Limit processing |
| Privacy by design and privacy by default | A.1.4.4 | Accuracy and quality |
| Privacy by design and privacy by default | A.1.4.5 | PII minimization objectives |
| Privacy by design and privacy by default | A.1.4.6 | PII de-identification and deletion at the end of processing |
| Privacy by design and privacy by default | A.1.4.7 | Temporary files |
| Privacy by design and privacy by default | A.1.4.8 | Retention |
| Privacy by design and privacy by default | A.1.4.9 | Disposal |
| Privacy by design and privacy by default | A.1.4.10 | PII transmission controls |
| PII sharing, transfer and disclosure | A.1.5.2 | Identify basis for PII transfer between jurisdictions |
| PII sharing, transfer and disclosure | A.1.5.3 | Countries and international organizations to which PII can be transferred |
| PII sharing, transfer and disclosure | A.1.5.4 | Records of transfer of PII |
| PII sharing, transfer and disclosure | A.1.5.5 | Records of PII disclosure to third parties |
These Table A.1 controls have points that are important for PII controllers:
- A.1.2.6 — the organization examines if a privacy impact assessment is necessary when new processing of PII, or a change to its PII processing, is "planned". It does a privacy impact assessment where "appropriate". In GDPR Article 35, a data protection impact assessment is a different obligation of the controller. The section Data protection impact assessment and privacy risk assessment gives more information.
- A.1.2.8 — the organization determines, with each joint PII controller, the roles and responsibilities of the organization and of that joint PII controller in the processing of PII.
- A.1.3.7 — the control is about access to PII, and the correction or erasure of PII. The B.1.3.7 guidance recommends that the organization lets PII principals get access to their PII, and correct or erase it, when they make requests, "without undue delay". It also recommends that the organization sets a "response time" for requests of this type, and obeys it.
- A.1.3.9 — the control is about a copy of the PII that the organization processes. Portability is only in the B.1.3.9 guidance. The guidance recommends a copy of the PII in a "structured, commonly used, format". It adds that some jurisdictions set conditions in which the organization gives the copy for portability. It also recommends that the organization can transfer a copy directly to a different organization when the PII principal requests it. This applies where the transfer is "technically feasible".
- A.1.3.10 — the organization sets and documents policies and procedures for the "legitimate" requests of PII principals. ISO/IEC 27701 sets no time limit for these requests. The B.1.3.10 guidance tells the organization that some jurisdictions set "response times". It recommends that the organization gives the "appropriate response times" in its privacy policy. It also recommends that the organization obeys these "response times" for all requests.
- A.1.5.2 to A.1.5.5 — the organization identifies and documents the "basis" for each transfer of PII between jurisdictions. It also documents to which "countries and international organizations" PII can "possibly" go. It keeps a record of each transfer of PII to or from a third party. It makes sure that these third parties work with the organization. This work helps the organization with requests that it will get about its obligations to PII principals. It also keeps records of disclosures of PII to third parties. Table A.1 has no control for a transfer impact assessment.
- Breaches — Table A.1 has no control for breach notification. The incident controls are in Table A.3.
Table A.2 — controls for PII processors
Table A.2 of ISO/IEC 27701:2025 has 18 controls for PII processors, A.2.2.2 to A.2.5.9. The controls use the same four control objectives as Table A.1. The customer of a PII processor is a PII controller. Where the PII processor is a subcontractor, its customer is the PII processor that has a contract with it for PII processing (4.2 b) and c)). See PII controller and PII processor roles.
| Control objective | Control | Name of the control |
|---|---|---|
| Conditions for collection and processing | A.2.2.2 | Customer agreement |
| Conditions for collection and processing | A.2.2.3 | Organization's purposes |
| Conditions for collection and processing | A.2.2.4 | Marketing and advertising use |
| Conditions for collection and processing | A.2.2.5 | Infringing instruction |
| Conditions for collection and processing | A.2.2.6 | Customer obligations |
| Conditions for collection and processing | A.2.2.7 | Records related to processing PII |
| Obligations to PII principals | A.2.3.2 | Comply with obligations to PII principals |
| Privacy by design and privacy by default | A.2.4.2 | Temporary files |
| Privacy by design and privacy by default | A.2.4.3 | Return, transfer or disposal of PII |
| Privacy by design and privacy by default | A.2.4.4 | PII transmission controls |
| PII sharing, transfer and disclosure | A.2.5.2 | Basis for PII transfer between jurisdictions |
| PII sharing, transfer and disclosure | A.2.5.3 | Countries and international organizations to which PII can be transferred |
| PII sharing, transfer and disclosure | A.2.5.4 | Records of PII disclosures to third parties |
| PII sharing, transfer and disclosure | A.2.5.5 | Notification of PII disclosure requests |
| PII sharing, transfer and disclosure | A.2.5.6 | Legally binding PII disclosures |
| PII sharing, transfer and disclosure | A.2.5.7 | Disclosure of subcontractors used to process PII |
| PII sharing, transfer and disclosure | A.2.5.8 | Engagement of a subcontractor to process PII |
| PII sharing, transfer and disclosure | A.2.5.9 | Change of subcontractor to process PII |
These Table A.2 controls have points that are important for PII processors:
- A.2.2.3 — the organization processes the PII of a customer only for the purposes in the documented instructions of that customer.
- A.2.2.4 — the organization does not use PII that it processes by contract for "marketing and advertising" before it makes sure that the "appropriate" PII principal gave "prior consent". It does not make this consent a condition to get the "service".
- A.2.2.5 — the organization tells the customer when it thinks that an instruction infringes the applicable legal requirements.
- A.2.4.3 — the organization can "return", transfer, or "dispose of" PII safely. It makes its policy for this available to the customer.
- A.2.5.2 — the organization tells the customer in time about the "basis" for each transfer of PII between jurisdictions. It also tells the customer in time about each "intended" change to that "basis". The customer can then object to the change or end the contract.
- A.2.5.5 and A.2.5.6 — the organization tells the customer about legally binding requests for PII disclosure. It rejects requests that are not legally binding, and it speaks with the customer before a disclosure. It accepts the requests that the contract agrees to and that have the approval of the customer.
- A.2.5.7 to A.2.5.9 — the organization tells the customer if it uses subcontractors to process PII, before it uses them. It obeys the customer contract when it engages a subcontractor. With a general written authorization, it tells the customer about each "intended" change that adds or replaces a subcontractor, and the customer can object.
- Breaches — Table A.2 has no control for breach notification. The incident controls are in Table A.3.
Table A.3 — controls for PII controllers and PII processors
Table A.3 of ISO/IEC 27701:2025 has 29 information security controls, A.3.3 to A.3.31, for PII controllers and PII processors. The table has one control objective: the security of PII processing (B.3.1). The same Annex B guidance applies to the two roles, unless a provision of Table A.3 or the organization gives a different rule (B.3.2).
| Control | Name of the control |
|---|---|
| A.3.3 | Policies for information security |
| A.3.4 | Information security roles and responsibilities |
| A.3.5 | Classification of information |
| A.3.6 | Labelling of information |
| A.3.7 | Information transfer |
| A.3.8 | Identity management |
| A.3.9 | Access rights |
| A.3.10 | Addressing information security within supplier agreements |
| A.3.11 | Information security incident management planning and preparation |
| A.3.12 | Response to information security incidents |
| A.3.13 | Legal, statutory, regulatory and contractual requirements |
| A.3.14 | Protection of records |
| A.3.15 | Independent review of information security |
| A.3.16 | Compliance with policies, rules and standards for information security |
| A.3.17 | Information security awareness, education and training |
| A.3.18 | Confidentiality or non-disclosure agreements |
| A.3.19 | Clear desk and clear screen |
| A.3.20 | Storage media |
| A.3.21 | Secure disposal or re-use of equipment |
| A.3.22 | User endpoint devices |
| A.3.23 | Secure authentication |
| A.3.24 | Information backup |
| A.3.25 | Logging |
| A.3.26 | Use of cryptography |
| A.3.27 | Secure development life cycle |
| A.3.28 | Application security requirements |
| A.3.29 | Secure system architecture and engineering principles |
| A.3.30 | Outsourced development |
| A.3.31 | Test information |
ISO/IEC 27701:2025 puts the controls for PII breaches in Table A.3 only:
- The incident controls are A.3.11 and A.3.12.
- The B.3.11 guidance recommends that the organization sets responsibilities and procedures for the notification of PII breaches to the "relevant parties". It also recommends such responsibilities and procedures for the disclosure to authorities. The notification procedures include the "timing" of each notification. The guidance also recommends that the organization considers the applicable legal requirements.
- B.3.12 gives one set of guidance for PII controllers and a different set for PII processors. For a PII processor, the B.3.12 guidance recommends that the contract with the customer includes the provisions for breach notification. It also recommends that the contract gives the "expected" limits for "notification response times", and also the limits that external requirements set.
- ISO/IEC 27701 sets no time limit for breach notification. The section Breach notification and requests from PII principals gives the GDPR time limits.
How Annex A applies through risk treatment (Clause 6.1.3)
ISO/IEC 27701:2025 connects Annex A to the privacy risk treatment process of the organization (Clause 6.1.3). For the controls, the process has these steps:
- The organization determines all the controls that are necessary for its risk treatment options (6.1.3 b)).
- The organization can make these controls or get them from a different source (6.1.3 NOTE 1).
- The organization identifies and documents its information security program, with the "appropriate" security controls (6.1.3 c)).
- The organization compares these controls with Annex A, to make sure that no necessary control is missing (6.1.3 d)).
- The organization makes a statement of applicability with the necessary controls and the justifications (6.1.3 e)).
- The organization considers the Annex B guidance when it implements the controls from steps 1 and 3 (6.1.3 h)).
The organization then implements its privacy risk treatment plan (Clause 8.3). The section Clause 6 gives all the steps of 6.1.3.
Annex D — informative mapping to GDPR
Annex D of ISO/IEC 27701:2025 is informative. Table D.1 of Annex D gives an indicative mapping between provisions of ISO/IEC 27701 and GDPR Articles 5 to 49, but not Article 43. The table has no entry for Article 23. Table D.1 maps these provisions:
- Clauses 4.1 to 4.4, 5.2, 5.3, 6.1.2, and 6.1.3.
- The Annex A controls, through the Annex B subclause with the same number. A.3.3, A.3.4, A.3.8, and A.3.30 have no row in Table D.1.
Annex D tells the organization that Table D.1 shows how conformity with the requirements and controls of ISO/IEC 27701 can be "relevant" to GDPR obligations. The NOTE to Table D.1 tells the organization that the table is only indicative. It also tells the organization to assess its legal obligations and to make its decision about how to comply with them. Conformity with a mapped control is not sufficient to show compliance with the GDPR Article. The GDPR is binding law, and ISO/IEC 27701 is a voluntary standard.
The section Annex D on the page ISO/IEC 27701 and the GDPR gives Table D.1 for each GDPR Article.
The annexes in Modulos
In Modulos, the Organization Framework OFF-12 and the AI System Framework MFF-13 have the name ISO 27701. MFF-13 has one Requirement for each Annex A table, and each AI System with MFF-13 gets these Requirements. The statement of applicability is part of Clause 6.1.3, and ORF-265 in OFF-12 is the Requirement for that clause. The Requirements of OFF-12 and MFF-13 have ISO 27701 Role tags, and the section The ISO 27701 Role tags gives their function. The table in The Requirements gives the Requirement for each clause and each Annex A table.
Where to go next
ISO/IEC 27701 overview
The standard, its edition, its structure, certification, and use with ISO/IEC 27001 and ISO/IEC 42001
PII roles, PIMS scope, and certification
The PII roles (Clause 4.1), the PIMS scope (Clause 4.3), and certification of a PIMS
Clauses 4 to 10
The requirements of Clauses 4 to 10, with privacy risk treatment and the statement of applicability
ISO/IEC 27701 and the GDPR
Table D.1 for each GDPR Article, GDPR certification, the data protection impact assessment, and breach time limits
ISO/IEC 27701 in Modulos
OFF-12 and MFF-13, the decisions before set-up, and the Requirement for each clause and Annex A table
Sources of this page
- ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance, second edition 2025-10 (ISO catalog page). This page uses these parts of it:
- The Contents section and Clause 11.
- Clauses 3.21, 3.22, 4.1, 4.2, 6.1.3, and 8.3.
- Annex A: the introduction and Tables A.1, A.2, and A.3.
- Annex B: B.1.2.6, B.1.2.8, B.1.3.7, B.1.3.9, B.1.3.10, B.1.5.2 to B.1.5.5, B.2.2.3 to B.2.2.5, B.2.4.3, B.2.5.2, B.2.5.5 to B.2.5.9, B.3.1, B.3.2, B.3.11, and B.3.12.
- Annexes C, D, E, and F: the introduction of each annex, Table D.1, and Tables F.1 and F.2.
- ISO/IEC 27701:2019, first edition 2019-08, withdrawn on 2025-10-14 (ISO catalog page).
- GDPR, Regulation (EU) 2016/679: Article 35 (EUR-Lex).
Disclaimer
This page gives general information only. It is not legal advice. It does not replace the help of a certification body.