Appearance
ISO/IEC 27701 — Clauses 4 to 10
ISO/IEC 27701:2025 gives the requirements for a privacy information management system (PIMS) in Clauses 4 to 10. The standard is for PII controllers and PII processors of all types of organization (Clause 1). Annexes A and B are normative, and Annexes C to F are informative (see Structure of the standard).
Each requirement of ISO/IEC 27701 uses "shall". The guidance in Annex B uses "should". A NOTE gives information only and adds no requirement. Some requirements contain a limit, for example "as appropriate" (5.2), "if practicable" (6.2), "where applicable" (7.2), "to the extent necessary" (8.1), and "as applicable" (9.1). The limit is part of the requirement.
Clauses 4 to 10 give most requirements to the organization. Top management has the requirements of 5.1 to 5.3 and does the management review (9.3). Clause 7.3 sets the awareness requirements for the persons who do work that the organization controls. Clause 7.2 requires the organization to make sure that these persons are competent if their work has an effect on its "privacy information management performance".
ISO/IEC 27701 and the harmonized structure
ISO/IEC 27701:2025 uses the ISO structure for management system standards (Introduction 0.2). ISO/IEC 42001:2023 (Introduction) and ISO/IEC 27001:2022 (Foreword) give this structure the name harmonized structure. ISO/IEC 27001:2022 Introduction 0.2 also refers to Annex SL of the ISO/IEC Directives, which gives this structure. The 2025 edition is a stand-alone management system standard (Foreword). Introduction 0.2 lets an organization align or integrate its PIMS with other management system standards and their requirements. Of these standards, 0.2 names ISO/IEC 27001 and its ISMS "in particular" (see Use with ISO/IEC 27001 and ISO/IEC 42001).
ISO/IEC 27701, ISO/IEC 27001, and ISO/IEC 42001 use the harmonized structure for Clauses 4 to 10. In the three standards, Clauses 4 to 10 have the same clause numbers and clause titles, and much of the text is the same (ISO/IEC 27001:2022 0.2, ISO/IEC 42001:2023 Introduction). Some subclause titles and some requirements are different. ISO/IEC 42001:2023 also has 6.1.4 and 8.4, AI system impact assessment. The table gives the privacy requirements that the text of ISO/IEC 27701 adds to the clauses, and one difference in 9.3.2:
| Clause | In the text of ISO/IEC 27701 |
|---|---|
| 4.1 | The organization determines if it is a PII controller or a PII processor. |
| 4.2 | The interested parties include the PII principals and all others with "interests or responsibilities" in the processing of PII. Which organization is the customer changes with the role. |
| 4.3 | The PIMS scope includes the processing of PII. |
| 6.1.2 | The privacy risk analysis examines the consequences for the organization and for PII principals. |
| 6.1.3 | The privacy risk treatment includes the risks to PII principals and the security of PII. The items of 6.1.3 are below the table. |
| 9.3.2 | The management review has five inputs, and ISO/IEC 27001:2022 9.3.2 has seven. The differences are below the table. |
In 6.1.3, the privacy risk treatment of ISO/IEC 27701 has these items:
- 6.1.3 c): the organization identifies and documents its information security program, with its security controls.
- 6.1.3 d): the organization compares the controls of b) and c) with the controls in Annex A. It makes sure that it includes all necessary controls.
- 6.1.3 e): the organization makes a statement of applicability. It holds the necessary controls of b), c), and d), the justification to include them, and if the organization implements them. It also gives the justification for each Annex A control that the organization excludes.
- 6.1.3 h): the organization considers the Annex B guidance for the controls of b) and c).
In ISO/IEC 27001:2022 and ISO/IEC 42001:2023, the organization compares its controls with the Annex A of that standard. It also makes a statement of applicability. ISO/IEC 42001:2023 6.1.3 e) has the same step for its Annex B.
In 9.3.2, the management review inputs of ISO/IEC 27701 are different from those of ISO/IEC 27001:2022 in these points:
- ISO/IEC 27001 has an input for the feedback from interested parties. ISO/IEC 27701 does not have this input.
- ISO/IEC 27001 has an input for the results of the risk assessment and the "status" of the risk treatment plan. ISO/IEC 27701 does not have this input.
- In ISO/IEC 27001, the input on performance also includes trends in the "fulfilment" of the information security objectives. The performance input of ISO/IEC 27701 does not include these trends.
An organization can integrate a PIMS with an ISMS or an AI management system. But it conforms to a standard only if it conforms to the requirements of that standard. For example, the internal audits of ISO/IEC 27701 examine conformity with the requirements of ISO/IEC 27701 (9.2.1).
Clause 4 — Context of the organization
ISO/IEC 27701 Clause 4 requires the organization to determine its context, its PII role, its interested parties, and the scope of its PIMS. It also requires the organization to establish and operate the PIMS.
4.1 Issues. The organization determines which external and internal issues are "relevant" to its purpose. It also determines which external and internal issues are "relevant" to its context. Each of these issues has an effect on how the organization can get the intended results of its PIMS. NOTE 1 gives examples of these issues: applicable privacy legislation, regulations, and judicial and administrative decisions. Other examples are the governance, policies, and procedures of the organization, and contractual requirements.
4.1 Climate change. Clause 4.1 also requires the organization to determine if climate change is a "relevant" issue. Clause 4.1 sets no requirement for documented information about this decision. NOTE 1 to 4.2 tells organizations that "relevant" interested parties can have requirements about climate change.
4.1 PII role. Clause 4.1 also requires the organization to determine if it is a PII controller (this includes a joint PII controller) or a PII processor. If it has the two roles, it determines each role as a "separate" role, and each role has a "separate" set of controls (see PII controller and PII processor roles).
4.2 Interested parties. The organization determines all of these items:
- Which interested parties are "relevant" to the PIMS.
- Which "relevant" requirements these interested parties have.
- Which of the "relevant" requirements "will be addressed" through the PIMS.
The organization includes in its interested parties all persons and organizations with "interests or responsibilities" in the processing of PII. The PII principals are in this group. NOTE 2 gives examples of other interested parties: customers, supervisory authorities, other PII controllers, and PII processors with their subcontractors. NOTE 6 tells organizations that some interested parties can want "independently audited conformity" to standards such as ISO/IEC 27701 (see The certification audit cycle).
In Clause 4.2 a) to c), the customer is a different organization for each role of the organization (see PII controller and PII processor roles).
4.3 Scope. Clause 4.3 requires the organization to determine the boundaries and applicability of its PIMS. When it determines the scope, the organization considers the issues of 4.1 and the requirements of 4.2. The scope includes the processing of PII and is available as documented information (see The scope of the PIMS).
4.4 PIMS. The organization establishes, implements, maintains, and continually improves its PIMS, with the necessary processes and the relations between these processes, as ISO/IEC 27701 requires.
Clause 5 — Leadership
ISO/IEC 27701 Clause 5 gives its requirements to top management.
5.1 Leadership and commitment. Top management shows leadership and commitment for the PIMS. Clause 5.1 gives eight tasks for this:
- Make sure that the organization has the privacy policy (5.2) and privacy objectives (6.2), and that they fit its "strategic direction".
- Make sure that the PIMS requirements are part of the "business processes" of the organization.
- Make sure that the necessary resources are available.
- Make known that "effective privacy information management" is important, and that conformity to the PIMS requirements is also important.
- Make sure that the PIMS gets its intended results.
- Give direction and help to persons, to help them add to the effectiveness of the PIMS.
- Help the organization to continually improve.
- Help other "relevant" roles to show their leadership in their areas of responsibility.
5.2 Privacy policy. Top management establishes a privacy policy. The policy is "appropriate" for the purpose of the organization and gives a framework to set privacy objectives. It includes a commitment to conform to the applicable requirements and a commitment to continually improve the PIMS. The policy is available as documented information. Top management makes the policy known in the organization, and makes it available "as appropriate" to interested parties.
5.3 Roles, responsibilities and authorities. Clause 5.3 requires top management to give each "relevant" role its responsibilities and authorities, and to make them known in the organization. Top management also gives the responsibility and the authority for these two tasks:
- Make sure that the PIMS conforms to the requirements of ISO/IEC 27701.
- Report on the performance of the PIMS to top management.
Clause 5 does not require a data protection officer. The Annex B guidance B.3.4 recommends that the organization gives one or more persons the responsibility for its governance and privacy program. The NOTE to B.3.4 tells organizations that some jurisdictions use the name data protection officer for this person.
Clause 6 — Planning
ISO/IEC 27701 Clause 6 gives the requirements to plan the PIMS. These requirements are about actions on risks and opportunities (6.1), privacy objectives (6.2), and changes to the PIMS (6.3).
6.1.1 General. When the organization plans its PIMS, it considers the issues of 4.1 and the requirements of 4.2. Then it determines which risks and opportunities "need to be addressed" to do these three tasks:
- Give "assurance" that the PIMS can get its intended results.
- Prevent or decrease unwanted effects.
- Continually improve.
The organization plans actions on these risks and opportunities. It also plans how to make these actions part of the PIMS processes, and how to evaluate the effectiveness of the actions.
6.1.2 Privacy risk assessment. ISO/IEC 27701 requires the organization to set a process for privacy risk assessment and to apply it. The process does all of these tasks:
- a) It sets and keeps the privacy risk criteria. These criteria include the risk acceptance criteria and the criteria for privacy risk assessments.
- b) It gives "consistent, valid and comparable" results each time that the organization does the assessment again.
- c) It identifies the privacy risks in the PIMS scope that are related to the protection of privacy and to information security risks. It also identifies the risk owners.
- d) It analyzes the privacy risks. It assesses the possible consequences for the organization and for PII principals if a risk occurs, and the "realistic likelihood" of the risk. Then it determines the levels of risk.
- e) It evaluates the privacy risks. It compares the results of the analysis with the risk criteria of a). Then it puts the risks in a sequence for risk treatment, with the most important risks first.
The organization retains documented information about its process for privacy risk assessment. The NOTE to 6.1.2 refers to ISO/IEC 27557 for more information. Clause 6.1.2 does not set when the organization does the privacy risk assessments. Clause 8.2 sets this time. A data protection impact assessment of GDPR Article 35 is a different legal obligation of the controller. See Data protection impact assessment and privacy risk assessment.
6.1.3 Privacy risk treatment. ISO/IEC 27701 requires the organization to set a process for privacy risk treatment and to apply it to the risks of PII processing. These risks include the risks to PII principals and the security of PII. The process has these eight steps:
| Item | Task of the organization |
|---|---|
| a) | It selects the privacy risk treatment options that are "appropriate", with the results of the risk assessment. |
| b) | It determines all the controls that are necessary for the selected privacy risk treatment options. NOTE 1 tells organizations that they can make the controls, or identify them from a source that they select. |
| c) | It identifies the information security program that it implements, with the "appropriate" security controls, and documents it. |
| d) | It compares the controls of b) and c) with the controls in Annex A, to make sure that no necessary control is missing. |
| e) | It makes a statement of applicability. |
| f) | It writes a privacy risk treatment plan. |
| g) | It gets the approval of the privacy risk owners for the plan, and their acceptance of the residual privacy risks. |
| h) | It considers the Annex B guidance when it implements the controls of b) and c). |
The organization retains documented information about its process for privacy risk treatment. NOTES 3 and 4 to 6.1.3 tell organizations that Annex A contains possible privacy controls, but not all possible privacy controls. The organization can add more privacy controls if necessary (see How Annex A applies through risk treatment).
Information security program (6.1.3 c)). An information security program (3.24) is a set of policies, objectives, and processes for the risk management of the assets of an organization. Its purpose is to keep the confidentiality, integrity, and availability of information. An information security program can be, for example, an ISMS of ISO/IEC 27001 (3.24, Note 1). ISO/IEC 27701 does not require an ISMS of ISO/IEC 27001.
ISO/IEC 27701 recommends that the information security program includes a minimum of 15 areas, for example access control, supplier management, and incident management. NOTE 2 to 6.1.3 tells organizations that ISO/IEC 27002 contains possible information security controls.
The information security program of item c) is not in Clause 6.1.3 of ISO/IEC 27001:2022 or of ISO/IEC 42001:2023.
Statement of applicability (6.1.3 e)). A statement of applicability (3.25) contains all of these items:
- The necessary controls from b), c), and d).
- The justification to include each of these controls.
- If the organization implements each necessary control.
- The justification to exclude each Annex A control that the organization does not include.
It is not necessary to include all Annex A controls. For the justifications that the organization can give for an excluded control, see Annex A. ISO/IEC 27001:2022 (6.1.3 d)) and ISO/IEC 42001:2023 (6.1.3 f)) also require a statement of applicability.
Information security and privacy together. NOTE 5 to 6.1.3 tells organizations that they can "address" information security and privacy together for the security of PII processing. For example, they can do one risk assessment for the two areas. They can also "address" them as different areas that overlap. The NOTE gives information only.
6.2 Privacy objectives. The organization establishes privacy objectives for the "relevant" functions and levels. The objectives agree with the privacy policy, are measurable "if practicable", and consider the applicable requirements. The organization monitors the objectives, makes them known, and changes them "as appropriate". The objectives are available as documented information.
When the organization plans how to get its objectives, it determines the work, the resources, and the person who has the responsibility. It also determines when the work will be complete and how it will evaluate the results.
6.3 Planning of changes. If the organization determines that changes to its PIMS are necessary, it makes the changes in a planned manner. Clause 6.3 does not give the conditions that start a change. Clause 8.2 gives the conditions for a new privacy risk assessment.
Clause 7 — Support
ISO/IEC 27701 Clause 7 requires the organization to give the PIMS the necessary resources, competent persons, awareness, communication, and documented information.
7.1 Resources. The organization determines and supplies the resources that are necessary to establish, implement, maintain, and continually improve the PIMS.
7.2 Competence. The organization determines the necessary competence of each person who does work that it controls, if this work has an effect on its "privacy information management performance". The organization makes sure that these persons are competent by "appropriate" education, training, or experience. "Where applicable", it does actions to get the necessary competence and evaluates the effectiveness of these actions. Documented information that is "appropriate" is available as evidence of competence. Clause 7.2 applies to all of these persons, not only to some roles.
7.3 Awareness. Persons who do work that the organization controls know these three items:
- The privacy policy.
- How their work helps the effectiveness of the PIMS, with the good effects of an increase in privacy performance.
- The possible results if they do not conform to the PIMS requirements.
Clause 7.3 does not set a requirement for training.
7.4 Communication. The organization determines the internal and external communication that is "relevant" to the PIMS. It determines the information that it will give, when, to which persons, and how. The information for PII principals about the processing of their PII is in the controls A.1.3.3 and A.1.3.4 of Table A.1, not in Clause 7.4.
7.5 Documented information. The PIMS includes the documented information that ISO/IEC 27701 requires. It also includes the documented information that the organization determines is necessary for the effectiveness of the PIMS (7.5.1). When the organization makes or changes documented information, it makes sure that three items are "appropriate" (7.5.2). The items are the identification and description, the format and media, and the review and approval.
The organization controls documented information to make sure that the information is available and "suitable for use", at the necessary location and time. The organization also makes sure that the information has sufficient protection (7.5.3). "As applicable", the control of documented information includes retention and disposition, distribution, access, retrieval and use, control of changes, and storage and preservation with legibility. The organization also controls the documented information of external origin that it determines is necessary to plan and operate the PIMS. It identifies this information "as appropriate".
Clause 8 — Operation
ISO/IEC 27701 Clause 8 requires the organization to plan and control its processes. It also requires privacy risk assessments and the implementation of the privacy risk treatment plan.
8.1 Operational planning and control. In Clause 8.1, the organization plans, implements, and controls the processes that are necessary to conform to requirements and to do the Clause 6 actions. The organization sets criteria for the processes and controls the processes against these criteria. Documented information is available "to the extent necessary" to show that the processes occurred as in the plan. The organization controls planned changes, examines the results of unintended changes, and does actions to decrease bad effects "as necessary". It also controls the processes, and the "products or services", that external suppliers supply and that are "relevant" to the PIMS.
8.2 Privacy risk assessment. The organization does privacy risk assessments at planned intervals, and also when "significant changes are proposed" or occur. Each assessment uses the criteria of 6.1.2 a). The organization retains documented information of the results.
8.3 Privacy risk treatment. The organization implements the privacy risk treatment plan of 6.1.3 f). It retains the results of the privacy risk treatment as documented information.
Clause 8 has no process that is only for the obligations to PII principals, for PII breaches, or for subcontractors. Annex A has controls for these items: A.1.3.2 to A.1.3.11 and A.2.3.2 for the obligations to PII principals, A.3.11 and A.3.12 for incidents, and A.2.5.7 to A.2.5.9 for subcontractors (see Annex A).
For external suppliers, the general requirement of 8.1 applies. Annex A also has control A.3.10, Addressing information security within supplier agreements. This control is about the security requirements for PII processing that apply to each supplier. The organization sets these requirements for each supplier from the type of "supplier relationship", and agrees them with the supplier. For a PII controller, Annex A also has control A.1.2.7, Contracts with PII processors.
ISO/IEC 27701 sets no time limit for the obligations to PII principals or for breach notification. For the Annex B guidance on these items, see Table A.1 and Table A.3.
Clause 9 — Performance evaluation
ISO/IEC 27701 Clause 9 requires the organization to monitor, measure, audit, and review the PIMS.
9.1 Monitoring, measurement, analysis and evaluation. Clause 9.1 requires the organization to determine the items that it monitors and measures. The organization also determines the methods, "as applicable", for monitoring, measurement, analysis, and evaluation, to get "valid results". It determines when it monitors and measures, and when it analyzes and evaluates the results. Documented information is available as evidence of the results. Clause 9.1 also requires the organization to evaluate the effectiveness and the privacy performance of its PIMS.
9.2.1 Internal audit. The organization does internal audits at planned intervals. The audits give information on these items:
- If the PIMS conforms to the requirements of the organization for its PIMS.
- If the PIMS conforms to the requirements of ISO/IEC 27701.
- If the organization implements and maintains the PIMS with effectiveness.
9.2.2 Internal audit program. The organization plans, establishes, implements, and maintains one or more audit programs. An audit program sets how frequently audits occur, the methods, the responsibilities, the requirements to plan audits, and the reports. For the audit program, the organization considers how important the processes are, and the results of the previous audits. For each audit, the organization sets the objectives, the criteria, and the scope.
The organization selects auditors and does audits to make sure that the audit process has objectivity and impartiality. It makes sure that the "relevant managers" receive the audit results. Documented information is available as evidence that the organization implements the audit program, and as evidence of the audit results.
9.3 Management review. Top management reviews the PIMS at planned intervals, to make sure of the continued suitability, adequacy, and effectiveness of the PIMS (9.3.1). The management review includes these five inputs (9.3.2):
| Item | Input |
|---|---|
| a) | The "status" of the actions from the previous management reviews |
| b) | Changes in the external and internal issues of the PIMS |
| c) | Changes in the needs and expectations of the interested parties of the PIMS |
| d) | Information on the performance of the PIMS, with trends in nonconformities and corrective actions, in monitoring and measurement results, and in audit results |
| e) | Opportunities for continual improvement |
The results of the management review include decisions on opportunities for continual improvement and on each necessary change to the PIMS (9.3.3). Documented information is available as evidence of these results.
Clause 10 — Improvement
ISO/IEC 27701 Clause 10 requires the organization to improve the PIMS and to correct nonconformities.
10.1 Continual improvement. The organization continually improves the suitability, adequacy, and effectiveness of its PIMS.
10.2 Nonconformity and corrective action. If a nonconformity occurs, the organization does all of these tasks:
- a) It does an action on the nonconformity. "As applicable", it controls and corrects the nonconformity and does work on its consequences.
- b) It evaluates if actions are necessary to remove the causes of the nonconformity. The purpose of these actions is that the nonconformity does not occur again, at the same location or at a different location. For this evaluation, it reviews the nonconformity, finds its causes, and finds if nonconformities of the same type occur or can occur.
- c) It implements each necessary action.
- d) It reviews the effectiveness of each corrective action.
- e) If necessary, it changes the PIMS.
Each corrective action is "appropriate" to the effects of the nonconformity. Documented information is available as evidence of the type of each nonconformity, the actions after it, and the results of each corrective action.
When to do the privacy risk assessments, audits, and reviews again
ISO/IEC 27701 sets no period for privacy risk assessments, internal audits, or management reviews. Where the standard uses "planned intervals", the organization sets the intervals. The standard gives these times:
| Task | Clause | When |
|---|---|---|
| Privacy risk assessment | 8.2 | At planned intervals. Also when "significant changes are proposed" or occur. |
| Monitoring and measurement | 9.1 | At the times that the organization determines. |
| Analysis and evaluation of the results | 9.1 | At the times that the organization determines. |
| Internal audit | 9.2.1 | At planned intervals. The audit program considers how important the processes are, and the results of the previous audits (9.2.2). |
| Management review | 9.3.1 | At planned intervals. |
| Changes to the PIMS | 6.3 | When the organization determines that changes to its PIMS are necessary. The organization makes the changes in a planned manner. |
ISO/IEC 27701 sets no implementation time and no minimum period of operation for a PIMS.
The Requirements in Modulos
In Modulos, the Organization Framework OFF-12 "ISO 27701" has one Requirement for each subclause from 4.1 to 10.2, but not for 8.2 and 8.3. The AI System Framework MFF-13 "ISO 27701" has the Requirements for 8.2 and 8.3 and for Tables A.1 to A.3. Each AI System that has MFF-13 gets all these Requirements. The page ISO/IEC 27701 in Modulos gives the Requirement for each clause.
Where to go next
ISO/IEC 27701 overview
The 2025 edition, the structure of the standard, the GDPR, and use with ISO/IEC 27001 and ISO/IEC 42001
PII roles, PIMS scope, and certification
How to determine the PII roles (4.1) and the PIMS scope (4.3), and how a PIMS gets certification
Annexes
The controls of Tables A.1 to A.3, the Annex B guidance, and the mapping Annexes C to F
ISO/IEC 27701 and the GDPR
Conformity and GDPR obligations, the indicative mapping of Annex D, and DPIAs
ISO/IEC 27701 in Modulos
OFF-12 and MFF-13, the decisions before set-up, and the Requirement for each clause
Sources of this page
- ISO/IEC 27701:2025 — Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance, second edition (2025-10): Foreword, Introduction 0.2, Clause 1, 3.21, 3.22, 3.24, 3.25, and Clauses 4.1 to 10.2. Also the Annex A introduction and the controls A.1.2.6, A.1.2.7, A.1.3.2 to A.1.3.11, A.2.3.2, A.2.5.7 to A.2.5.9, A.3.10, A.3.11, and A.3.12. Also the Annex B guidance B.3.4 and B.3.10, and Annex D. ISO catalog page.
- ISO/IEC 27001:2022 — Information security, cybersecurity and privacy protection — Information security management systems — Requirements: Foreword, Introduction 0.2, 6.1.3 c) and d), and 9.3.2.
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system: Introduction, 6.1.3 b), e), and f), 6.1.4, and 8.4.
- GDPR, Regulation (EU) 2016/679: Articles 28(3)(f) and 35(1). EUR-Lex.
Disclaimer
This page gives only general information. It is not legal advice and it does not replace help from a certification body. Always compare this page with the text of ISO/IEC 27701:2025.