ISO/IEC 27701 — Privacy Information Management System (PIMS)

ISO/IEC 27701 is the international management-system standard for privacy. It specifies requirements for a Privacy Information Management System (PIMS) — a structured operating model for managing the privacy of personally identifiable information (PII) across people, processes and technology, certifiable by an accredited third-party body.

This guide cites ISO/IEC 27701:2025 as the current published edition; ISO/IEC 27701:2019 is the withdrawn prior edition. The Modulos OFF-12 / MFF-13 templates label the standard ISO/IEC 27701:2025 directly.

Quick decision

• You already operate ISO 27001 and need a certifiable privacy spine → ISO 27701 is the natural extension; under the 2019 edition you must operate ISO 27001 first. The 2025 edition restructures the PIMS as a standalone management-system standard.
• You need to demonstrate GDPR operational compliance to customers / DPAs → the PIMS produces the documented evidence supervisory authorities expect. ISO 27701 maps controls to GDPR articles in informative Annex D.
• You act as both a PII controller and a PII processor → apply Annex A Table A.1 (controller controls) and Table A.2 (processor controls) to the relevant processing activities, plus Table A.3 (controls for both roles) throughout.
• You want a deep read of the management-system clauses → see Clauses 4–10.

TL;DR

• 2025 edition is the current published edition — restructures the PIMS as a standalone management-system standard following Annex SL. 2019 is the withdrawn prior edition.
• Annex SL backbone — Clauses 4–10 shared with ISO 27001 and ISO 42001.
• Annex A control tables: Table A.1 controls for PII controllers; Table A.2 controls for PII processors; Table A.3 controls for both roles (information-security controls adapted for PII). Annex B gives informative implementation guidance.
• GDPR mapping in Annex D — informative cross-reference between PIMS controls and GDPR articles.
• Certification cycle: same Stage 1 / Stage 2 / surveillance / recertification as ISO 27001 and 42001.
• Modulos operationalizes ISO 27701 through the OFF-12 (org, 28 ORF requirements) and MFF-13 (app, 5 MRF requirements) framework templates.

Primary source

ISO/IEC 27701:2025 — Privacy information management — Requirements and guidance. Available via the ISO Online Browsing Platform. © ISO. The withdrawn prior edition is ISO/IEC 27701:2019. The Modulos OFF-12 / MFF-13 templates label the standard ISO/IEC 27701:2025 directly.

Key facts

Publisher

ISO/IEC (joint)

Edition cited

ISO/IEC 27701:2025

Prior edition

ISO/IEC 27701:2019 (withdrawn)

Type

Certifiable management-system standard

Scope

Privacy of PII (PIMS)

Backbone

Annex SL (Clauses 4–10)

What the PIMS actually requires

ISO 27701 expects the organization to:

• determine the PIMS scope (Clause 4.3) including processing activities and the PII the organization handles;
• maintain a privacy policy (5.2);
• assign roles and responsibilities including (where required) the data protection officer or equivalent (5.3);
• perform a structured privacy risk assessment (6.1.2) and privacy risk treatment (6.1.3);
• set and pursue privacy objectives (6.2);
• operate the applicable Annex A controls — Table A.1 (if a PII controller), Table A.2 (if a PII processor) and Table A.3 (controls for both roles);
• monitor, measure, internally audit and review (Clause 9) and continually improve (Clause 10).

Go deeper: PIMS foundations · Clauses 4–10 · Annexes.

Controller vs processor — the Annex A control tables

The PIMS adapts to the organization's role under the privacy regime. The 2025 edition puts all normative privacy controls in Annex A, split into three role-based tables:

• PII controller = determines the purposes and means of processing personal data. Applies Table A.1 controls (e.g., conditions for collection and processing, obligations to PII principals, transfer-impact assessment).
• PII processor = processes personal data on behalf of a controller. Applies Table A.2 controls (e.g., obligations to the customer, sub-processor management, return / deletion of PII at end of processing).
• Both roles = Table A.3 controls apply whether the organization is a controller, a processor, or both — they adapt information-security controls to the protection of PII.

Role is not an either/or: a single organization often operates as a controller (for its own data), a processor (for customer data), and a joint controller (GDPR Article 26) for jointly determined processing — applying the relevant tables per processing activity. The role distinction mirrors GDPR's Article 4(7) controller / Article 4(8) processor / Article 26 joint-controller model.

Go deeper: Annexes (controls reference).

How ISO 27701 supports GDPR

ISO 27701 is voluntary; GDPR is binding regulation. The PIMS produces the documented evidence GDPR compliance work requires:

• Article 5 principles → PIMS Table A.1 controls on lawfulness, transparency, data minimization, storage limitation.
• Article 6 lawfulness of processing → PIMS Table A.1 control on identifying the legal basis.
• Article 28 processor obligations → PIMS Table A.2 control set.
• Article 30 records of processing → PIMS Table A.1 processing-records controls.
• Article 33 personal-data breach notification → PIMS Clause 6.1.3 risk treatment + Table A.3 incident-management controls (adapted from ISO 27001 Annex A.5.24–A.5.28).
• Article 35 DPIA → PIMS Clause 6.1.2 privacy risk assessment + Clause 6.1.3 privacy risk treatment, with Table A.1 privacy-impact-assessment evidence where the organization is a controller.
• Article 37 data protection officer → PIMS Clause 5.3 roles.

The standard's informative Annex D maps PIMS controls to GDPR articles directly. An ISO 27701 certificate does not certify GDPR compliance, but the PIMS is one of the most efficient ways to produce the operational evidence supervisory authorities expect.

Go deeper: Integration with GDPR.

How to operationalize ISO 27701 in Modulos

Modulos models ISO 27701 through two framework templates:

Template	Scope	Mapped requirements
OFF-12	Clauses 4–10 PIMS spine	ORF-256…ORF-283 (28 requirements)
MFF-13	Per-AI-system privacy overlap + Annex A control tables	MRF-243 (Clause 8.2 privacy risk assessment), MRF-244 (Clause 8.3 privacy risk treatment), MRF-394 (Table A.1 controllers, 31), MRF-395 (Table A.2 processors, 18), MRF-396 (Table A.3 both roles, 29)

Standard rollout in Modulos:

• One organization project for the PIMS itself — scope, privacy policy, privacy risk-management process, internal audit, management review. Apply OFF-12.
• AI-system projects for the per-system privacy work (privacy risk assessment + treatment for the AI deployment, particularly when personal data is processed). Apply MFF-13.
• Where ISO 27001 (ISMS) or ISO 42001 (AIMS) also apply, share Clauses 4–10 with those management systems on the same organization project.

Go deeper: Operationalizing in Modulos.

Framework mapping

Four layers, one reusable spine.

Frameworks

EU AI ActRegulatory

ISO 42001Standard

Requirements

Art. 9.1Risk management

Art. 10.2Data governance

6.1.1Risk assessment

Components

Risk identification

Impact analysis

Evidence

Risk registerDocument

Test resultsArtifact

Controls

The reusable spine

One control satisfies many requirements across many frameworks, and groups the components and evidence beneath them.

Risk assessment process

Data validation checks

Reusable

Edge from any layer card crosses into the Controls spine — the same control may serve a regulatory article, a standards clause, a downstream component, and the evidence that closes it.

Cross-framework mapping (preview)

ISO 27701 element	Adjacent provision
Clause 4.3 PIMS scope	ISO 27001 Clause 4.3 ISMS scope; ISO 42001 Clause 4.3 AIMS scope
Clause 5.2 privacy policy	ISO 27001 Clause 5.2 information-security policy; ISO 42001 Clause 5.2 AI policy
Clause 6.1.2 privacy risk assessment	GDPR Article 35 DPIA; ISO 27001 Clause 6.1.2 information-security risk assessment
Annex A Table A.1 (controllers)	GDPR Articles 5, 6, 7, 12–22, 24, 30, 35
Annex A Table A.2 (processors)	GDPR Article 28; SCCs (Module 2 Controller-to-Processor)
Annex A Table A.3 (both roles)	GDPR Article 32 security of processing
PII breach notification	GDPR Article 33; ISO 27001 Annex A.5.24–A.5.28; EU AI Act Article 73 (distinct)
PII subjects' rights	GDPR Articles 12–22
Cross-border transfer	GDPR Articles 44–50; Annex A transfer-impact assessment control

Related pages

PIMS foundations (scope + audit context)

What a PIMS is, what auditors test, certification cycle

Clauses 4–10 (implementation guide)

Annex SL backbone — Context, Leadership, Planning, Support, Operation, Performance evaluation, Improvement

Annexes (controls reference)

Annex A Tables A.1–A.3 (controllers / processors / both) + Annex D GDPR mapping

Operationalizing in Modulos

OFF-12 + MFF-13 rollout, PIMS evidence patterns

Integration with GDPR

How the PIMS produces the operational evidence GDPR requires

ISO 27001

Information-security baseline — historically the prerequisite for ISO 27701:2019

Source attribution

ISO/IEC 27701:2025 — Privacy information management — Requirements and guidance. © ISO/IEC. Withdrawn prior edition: ISO/IEC 27701:2019. Available via the ISO Online Browsing Platform.

See it in Modulos

Modulos records and links ISO 27701 PIMS evidence alongside ISO 27001 ISMS evidence.

Request a demo

Disclaimer

This page is for general informational purposes and does not constitute legal or certification advice.