Frequently asked questions about ISO/IEC 27701

Each FAQ gives a URL to the page section with the full rule.

Disclaimer

This page gives general information. It is not legal advice.

What is ISO/IEC 27701?

ISO/IEC 27701:2025 is a voluntary International Standard for a privacy information management system (PIMS), with requirements and guidance for organizations of all types, large or small. It is for PII controllers, with joint PII controllers, and PII processors with responsibility and accountability for PII processing (Clause 1, Clause 4.1). The second edition, of October 2025, replaces the 2019 edition and does not require ISO/IEC 27001. See Structure of the standard for normative Annexes A and B. See certification for optional PIMS certification.

Which edition of ISO/IEC 27701 should I cite?

Refer to ISO/IEC 27701:2025, the second edition, of October 2025. It cancels and replaces ISO/IEC 27701:2019, withdrawn on 14 October 2025. The 2019 edition added privacy requirements to the standards ISO/IEC 27001 and ISO/IEC 27002, with different control numbers. The Modulos Frameworks OFF-12 and MFF-13 name the 2025 edition. See The standard and its edition.

What changed between ISO/IEC 27701:2019 and the 2025 edition?

ISO/IEC 27701:2025 became a stand-alone management system standard. For PII processing in an ISMS, the withdrawn 2019 edition added privacy requirements to the standards ISO/IEC 27001 and ISO/IEC 27002. The 2025 Annex A has Tables A.1 to A.3 with different control numbers and does not include some 2019 information security controls. But Clause 6.1.3 c) requires the organization to identify and document its information security program with the "appropriate" security controls. Annex F gives correspondence only for Table A.3 and identifies 2019 controls that are not included, not correspondence for Tables A.1 and A.2. See The standard and its edition.

How is ISO 27701 different from ISO 27001?

ISO/IEC 27001:2022 gives requirements for an information security management system (ISMS), and ISO/IEC 27701:2025 gives requirements for a PIMS. A PIMS is for privacy protection where PII processing can have an effect on privacy (3.23). The two standards use the same structure, thus an organization can integrate them. But one does not require the other, and each keeps its requirements, Annex A, and statement of applicability.

ISO/IEC 27701 adds privacy requirements, with an information security program (6.1.3 c)). This can be different from an ISO/IEC 27001 ISMS (3.24). See Use with ISO/IEC 27001 and ISO/IEC 42001.

Do I need ISO 27001 certification before ISO 27701?

No. ISO/IEC 27701:2025 does not require ISO/IEC 27001 or its certification, and it sets no certification rule. Its only normative reference is ISO/IEC 29100 (Clause 2).

But Clause 6.1.3 c) requires the organization to identify and document its information security program with the "appropriate" security controls. That information security program can be an ISO/IEC 27001 ISMS or a different information security program (3.24 Note 1). The withdrawn 2019 edition applied to PII processing in an ISMS. A combined audit is possible but not required (3.18 Note 1). See The certification audit cycle.

How does ISO 27701 relate to GDPR?

Conformity with voluntary ISO/IEC 27701 is not sufficient to show compliance with the GDPR, which is binding EU law in its Article 3 scope. Annex D is indicative, and the organization assesses its legal obligations. Its mapping is to Articles 5 to 49, but not 43, with no entry for Article 23. The two instruments use different names for roles.

ISO/IEC 27701 is not an Article 42 certification mechanism. Approved mechanisms can help demonstrate compliance or the "sufficient guarantees" of a processor (Articles 24(3), 25(3), 28(5), 32(3)), with no decrease in responsibility (42(4)). See Conformity and compliance.

How are the ISO 27701 privacy controls organized?

ISO/IEC 27701:2025 Annex A (normative) has Table A.1 for PII controllers, Table A.2 for PII processors, and Table A.3 with information security controls for the two roles. Annex B (normative) gives guidance with the same numbers. Annex A is not complete, and not all its controls are necessary.

The organization determines necessary controls through privacy risk treatment (6.1.3) and justifies each Annex A exclusion in its statement of applicability. The organization can exclude controls because of the risk assessment or applicable legal requirements that do not require the control or make an exception. If the organization has the two roles, each has a "separate" set of controls (4.1). See Annex A.

Can an organization be certified to ISO/IEC 27701?

Yes. A certification body can audit and certify an organization's PIMS against ISO/IEC 27701, but the standard sets no certification rule. Certification is optional, although interested parties can want independently audited conformity (4.2 NOTE 6). The organization sets intervals for its internal audits (9.2) and top management reviews (9.3). A certificate does not show GDPR compliance, and Modulos has no Requirement for certification.

The IAF MD 5 cycle is for quality, environmental, and occupational health and safety systems. Its section 0.5 tells you that some parts can apply in other ISO/IEC 17021-1 certification schemes. See The certification audit cycle.

Which Modulos Frameworks implement ISO/IEC 27701?

Modulos has OFF-12 (Organization) and MFF-13 (AI System) for ISO/IEC 27701. OFF-12 holds Clauses 4.1 to 10.2 but not 8.2 and 8.3. MFF-13 holds 8.2, 8.3, and Annex A. Each AI System with MFF-13 gets all its Requirements, also if the organization has only one PII role.

If you use only OFF-12, Clauses 8.2 and 8.3 and Annex A have no Requirement in Modulos. But ISO/IEC 27701 applies Clauses 8.2 and 8.3 to all PII processing in the PIMS scope. See Work with no Requirement in the Frameworks, also for certification and PII processing without an AI System.

See The Requirements for role determination (ORF-256) and the statement of applicability (ORF-265). For set-up, add OFF-12 to your organization AI System and contact Modulos support if there is none. Modulos recommends MFF-13 for each AI System that processes PII in scope.

What is a PIMS under ISO/IEC 27701?

A PIMS in ISO/IEC 27701:2025 is a management system for privacy protection where PII processing can have an effect on privacy (3.23). Clause 4.4 requires the organization to establish, implement, maintain, and continually improve it in conformity with the standard. The scope includes PII processing (4.3), and "organization" means only the part of a larger entity in that scope (3.1 Note 2). The 2025 standard does not require an ISO/IEC 27001 ISMS. See Clause 4 and The scope of the PIMS.

How do I write the PIMS scope statement?

ISO/IEC 27701 Clause 4.3 requires the organization to determine its PIMS boundaries and applicability. It considers the Clause 4.1 issues and Clause 4.2 requirements. The scope includes PII processing and is available as documented information.

Modulos recommends role determination first, but the standard sets no sequence. The organization can add processing activities, types of PII, PII principals, and roles to its scope document, but these are optional. For AI systems, PII in training or input data is PII processing. See The scope of the PIMS.

How do I determine PII controller vs PII processor role?

In ISO/IEC 27701 Clause 4.1, the organization determines its role from who determines the purposes and means of PII processing (NOTE 2). Joint PII controllers count as PII controllers. If the organization has the two roles, it determines each as a "separate" role with a "separate" set of controls (4.1). The role can be different for each instance of processing.

A PII processor processes PII only for purposes in its customer's documented instructions (A.2.2.3). See PII roles for the tables for each role and the different GDPR terms. Annex A controls that the organization excludes require justification through risk assessment or applicable legal requirements (6.1.3 e)).

How are Clauses 4–10 different from ISO 27001?

ISO/IEC 27701:2025 and ISO/IEC 27001:2022 use the same structure of Clauses 4 to 10, but ISO/IEC 27701 adds privacy requirements. These include PII roles (4.1), PII principals and customers (4.2), PII processing in scope (4.3), and consequences for PII principals (6.1.2). Clause 6.1.3 adds an information security program and requires the organization to compare its necessary controls with ISO/IEC 27701 Annex A. Clause 9.3.2 has five management review inputs, compared with seven in ISO/IEC 27001.

One standard does not require the other. If the organization integrates them, each keeps its requirements, with internal audit (9.2.1). See ISO/IEC 27701 and the harmonized structure.

What does Clause 4.1 of ISO 27701 require?

ISO/IEC 27701 Clause 4.1 requires the organization to determine external and internal issues "relevant" to its purpose and context that have an effect on its PIMS results. This includes if climate change is "relevant". It also requires PII role determination: joint PII controllers count as PII controllers, and an organization with the two roles determines each as a "separate" role with a "separate" set of controls. Roles can be different for each instance of processing, because the role follows who determines purposes and means (NOTE 2).

Clause 4.1 sets no requirement for documented information. The scope considers its issues and is documented information (4.3). See Clause 4 and PII roles.

Is the Statement of Applicability mandatory under ISO 27701?

Yes. ISO/IEC 27701 Clause 6.1.3 e) requires a statement of applicability with necessary controls, justifications to include them, implementation status, and justifications to exclude Annex A controls. The organization can exclude controls because of the risk assessment or applicable legal requirements that do not require a control or make an exception. This includes legal requirements that apply to PII principals. See Clause 6 and the Modulos Requirement ORF-265.

How does Clause 6.1.2 privacy risk assessment differ from a DPIA?

ISO/IEC 27701 Clause 6.1.2 sets the organization's privacy risk assessment process. GDPR Article 35(1) requires a controller's DPIA before processing that "is likely to result in a high risk to the rights and freedoms of natural persons". See DPIA and privacy risk assessment for these other conditions:

• A.1.2.6: PII controllers assess if a privacy impact assessment is necessary for planned new or changed processing, and do it "where appropriate".
• Clause 6.1.3 e): A.1.2.6 applies if the organization includes it, and the statement of applicability gives the justification for an exclusion.
• Clause 8.2: when to do privacy risk assessments.
• Annex D: Articles 35 and 36 map to A.1.2.6, not 6.1.2.
• Article 36(1): the controller must "consult the supervisory authority prior to processing" if the DPIA shows high risk without measures to decrease it.
• Article 28(3)(f): the "contract or other legal act" with a processor must require the processor to help the controller with Articles 32 to 36, "taking into account the nature of processing and the information available to the processor".
• Article 35(10): an exception on conditions for some Article 6(1)(c) or (e) processing.

How often must ISO 27701 risk assessments, internal audits, and management reviews take place?

The organization sets planned intervals in ISO/IEC 27701:2025, which sets no period. Privacy risk assessments also occur when "significant changes are proposed" or occur (8.2). Audit planning considers the importance of the processes and previous audit results (9.2.2), and top management does management reviews (9.3.1). The standard sets no implementation time or minimum period of operation. See When to do the privacy risk assessments, audits, and reviews again.

How does Modulos model Clauses 4–10 for ISO 27701?

Modulos has ISO/IEC 27701 Clauses 4.1 to 10.2 in OFF-12 at the Organization level, but not 8.2 and 8.3. MFF-13 at the AI System level holds 8.2 (MRF-243), 8.3 (MRF-244), and one Requirement for each Annex A table. ORF-256 holds Clause 4.1, with PII role determination, and ORF-265 holds Clause 6.1.3, with the statement of applicability. See The Requirements.

What annexes does ISO/IEC 27701 contain?

ISO/IEC 27701:2025 has six annexes: normative Annex A gives control objectives and controls, and normative Annex B gives guidance with the same numbers. Informative Annex C maps to ISO/IEC 29100, Annex D to the GDPR, and Annex E to ISO/IEC 27018 and 29151. Their mappings are indicative only. Informative Annex F gives correspondence with the 2019 edition. Clause 6.1.3 h) requires the organization to consider Annex B guidance for its determined controls. See The six annexes.

Which control table applies to my organization?

In ISO/IEC 27701, PII controllers use Table A.1, PII processors use Table A.2, and the two roles use information security controls in Table A.3. A joint PII controller is a PII controller. An organization with the two roles determines each as a "separate" role with a "separate" set of controls (4.1). Roles can be different for each instance of processing.

None of the tables requires all controls: the organization determines necessary controls and gives the justification for each control it excludes in its statement of applicability. Justification can follow risk assessment or applicable legal requirements that do not require a control or make an exception (6.1.3 e)). See Annex A.

What kinds of controls are in Table A.1 (PII controllers)?

ISO/IEC 27701 Table A.1 has 31 controls for PII controllers with four control objectives. These are Conditions for collection and processing, Obligations to PII principals, Privacy by design and privacy by default, PII sharing, transfer and disclosure. These include purpose, lawful basis, consent, the privacy impact assessment, contracts, records, PII principal requests, processing limits, retention, disposal, and transfers. Table A.1 has no breach notification control or control to assess the effect of a transfer. See Table A.1.

What kinds of controls are in Table A.2 (PII processors) and Table A.3 (both roles)?

ISO/IEC 27701 Table A.2 has 18 PII processor controls with the same four objectives as Table A.1. These include the customer agreement, documented instructions, return or disposal of PII, disclosure requests, and subcontractors. The "marketing and advertising use" control requires PII principal consent before this use. Table A.3 has 29 information security controls for the two roles, with PII breach guidance in B.3.11 and B.3.12. This guidance considers when to notify and applicable legal requirements, but the standard sets no breach notification time limit. See Table A.2 and Table A.3.

How does Annex D map to GDPR?

ISO/IEC 27701 Annex D (informative) gives Table D.1, an indicative mapping to GDPR Articles 5 to 49, but not 43. It has no entry for Article 23. It maps Clauses 4.1 to 4.4, 5.2, 5.3, 6.1.2, and 6.1.3, plus Annex A controls through their Annex B numbers. A.3.3, A.3.4, A.3.8, and A.3.30 have no row. Conformity does not establish GDPR compliance: the organization assesses its legal obligations and selects how to comply with the GDPR. See Annex D for each Article, with the mapping of Clauses 6.1.2 and 6.1.3 only to Article 32.

How are the annexes modeled in Modulos?

Modulos has MFF-13 Requirements for ISO/IEC 27701 Annex A tables: MRF-394 for A.1, MRF-395 for A.2, and MRF-396 for A.3. Each AI System with MFF-13 gets these Requirements. The organization determines which controls apply through privacy risk treatment and its statement of applicability (6.1.3, ORF-265 in OFF-12). See The Requirements and The ISO 27701 Role tags: MRF-394 has PII Controller, MRF-395 has PII Processor, and all other Requirements have the two values.

How should I structure AI Systems for a PIMS in Modulos?

For ISO/IEC 27701, Modulos recommends OFF-12 on your organization AI System and MFF-13 on each AI System that processes PII in your PIMS scope. Determine roles and scope first (4.1, 4.3): the standard sets one PIMS, while Modulos uses two levels. Each AI System with MFF-13 gets all its Requirements. For PII processing without an AI System, use a different tool or make an AI System. You cannot make an organization AI System in the AI Registry: contact Modulos support if there is none. See Recommended AI System structure and Decisions before set-up.

How do PII controller and PII processor roles work in Modulos?

The organization determines its ISO/IEC 27701 roles in Clause 4.1 (ORF-256), while ORF-258 holds only the scope (4.3). An organization with the two roles determines each as a "separate" role. The role can be different for each instance of processing. Each AI System with MFF-13 gets all three Annex A table Requirements.

The statement of applicability records necessary controls and gives the justification for each control it excludes (6.1.3 e), ORF-265). The ISO 27701 Role tags identify PII Controller for MRF-394, PII Processor for MRF-395, and the two values for the other Requirements. See The ISO 27701 Role tags and The Requirements.

Where do privacy risk assessments and privacy impact assessments sit in Modulos?

For ISO/IEC 27701, ORF-264 holds the privacy risk assessment process (6.1.2), and MRF-243 holds assessments on AI Systems with MFF-13 (8.2). Clause 8.2 requires assessments at planned intervals and when "significant changes are proposed" or occur. MRF-394 holds Table A.1, with the PII controller privacy impact assessment control A.1.2.6. A GDPR DPIA is a different obligation: Article 35(1) requires the controller to assess before processing that "is likely to result in a high risk to the rights and freedoms of natural persons". See The Requirements, DPIA conditions, and the different GDPR Frameworks OFF-11 and MFF-12.

Can I use ISO 27701 with ISO 27001 and ISO 42001 in Modulos?

Yes. ISO/IEC 27701 uses OFF-12 and MFF-13, ISO/IEC 27001 uses OFF-9 and MFF-9, and ISO/IEC 42001 uses OFF-10 and MFF-10. The three Organization Frameworks attach to the same organization AI System. Each standard keeps its requirements, with the PIMS internal audit (9.2.1). ISO/IEC 27701 requires an information security program, which can be different from an ISO/IEC 27001 ISMS (6.1.3 c), 3.24 Note 1). See Other Frameworks in Modulos and Control overlap.

Does ISO/IEC 27701 certification satisfy GDPR?

No. ISO/IEC 27701 is not a GDPR Article 42 certification mechanism. A certification "does not reduce the responsibility of the controller or the processor for compliance with this Regulation" (42(4)). An approved mechanism "may be used as an element" to demonstrate compliance (24(3), 25(3), 32(3)) or "sufficient guarantees" of a processor (28(5)).

Certification is voluntary (42(3)). Article 42(5) names the certification bodies or supervisory authority that issue certification. They use criteria approved by the competent supervisory authority or the Board. Annex D's mapping of Clause 4.1 to Articles 40 to 42 is indicative. See Certification in GDPR Article 42.

Does ISO 27701 set the GDPR 72-hour breach deadline?

No. ISO/IEC 27701 sets no breach notification time limit. Its guidance recommends procedures that consider applicable law (B.3.11), plus PII processor contract and external limits (B.3.12). In some jurisdictions, B.3.12 recommends that the PII processor notify the PII controller "without undue delay", when the breach is found. See Table A.3.

The GDPR has these breach notification rules:

• Article 33(1): the controller must notify the competent supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware of it". This applies "unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons". After 72 hours, notification must be "accompanied by reasons for the delay".
• Article 33(2): processor notification to the controller "without undue delay after becoming aware of a personal data breach".
• Articles 34(1) and 34(3): the controller's duty to tell the data subject "without undue delay" for breaches "likely to result in a high risk", unless a condition of Article 34(3) applies.

When should I treat a record as PIMS documentation or as GDPR documentation?

A record is ISO/IEC 27701 PIMS documented information if a clause or included control requires it, or the organization determines that it is necessary for PIMS effectiveness (7.5.1). Processing records (A.1.2.9, A.2.2.7) and the "basis" for transfers (A.1.5.2, A.2.5.2) can thus be part of the PIMS. PII controllers record the "basis" for transfers, while PII processors tell customers. GDPR Article 30 sets different record obligations, with an exception on conditions for "an enterprise or an organisation employing fewer than 250 persons". Processing that "is not occasional" is one condition that removes the exception. See Records and transfers for Article 30(5) and the Annex D mappings to Articles 30 and 44 to 49.