Appearance
ISO/IEC 27701 in Modulos
Modulos has two Frameworks for ISO/IEC 27701:2025, and each has the name ISO 27701:
OFF-12at the Organization level, for the privacy information management system (PIMS) of the organization.MFF-13at the AI System level, for each AI System that processes PII in the scope of the PIMS.
This page tells you which decisions to make and which steps to do. It also tells you which Requirement holds which provision, and which work has no Requirement in the two Frameworks. On this page, "you" is the organization that operates the PIMS. For the standard, see ISO/IEC 27701.
Recommended AI System structure
For ISO/IEC 27701, Modulos uses two levels of AI System. ISO/IEC 27701 sets one PIMS for the organization, in the scope that the organization determines (Clauses 4.3 and 4.4). If the organization is a part of a larger entity, "organization" is only the part in the scope of the PIMS (3.1, Note 2). The two levels, Organization and AI System, are the Modulos structure, not a structure of the standard.
| AI System | Framework | Provisions in the Framework |
|---|---|---|
| The organization AI System | OFF-12 | Clauses 4.1 to 10.2, without 8.2 and 8.3 |
| Each AI System that processes PII in the scope of the PIMS | MFF-13 | Clauses 8.2 and 8.3, and Annex A (Tables A.1 to A.3) |
The table in The Requirements gives the Requirement and the level of each clause and each Annex A table.
- Clauses 8.2 and 8.3 and Annex A are only in
MFF-13.OFF-12has no Requirement for them. But Clauses 8.2 and 8.3 apply to all processing of PII in the scope of the PIMS, not only to one AI system. - Each AI System with
MFF-13gets allMFF-13Requirements.MFF-13does not select Requirements for an AI System. Thus an AI System gets the Requirements for all three Annex A tables, also if the organization has only one PII role for that processing. MFF-13does not replace the decisions of the organization. The organization determines the necessary controls and makes the statement of applicability for its full PIMS (Clause 6.1.3).
Organization AI Systems
Frameworks at the Organization level, for example OFF-12, attach to your organization AI System, which has the Type Organization in the AI Registry. You cannot make a new organization AI System in the AI Registry. If your organization does not have one, contact Modulos support before you add Frameworks at the Organization level.
Decisions before set-up
Before you add the ISO 27701 Frameworks, make these three decisions. In ISO/IEC 27701, Clause 4.3 tells the organization to consider the issues of Clause 4.1 when it determines the scope. Clause 4.1 also tells the organization to determine if it is a PII controller or a PII processor. Thus Modulos recommends the role decision before the scope decision.
- Determine your PII roles (Clause 4.1,
ORF-256).- Determine if your organization is a PII controller (a joint PII controller included) or a PII processor. If it has the two roles, determine each role as a "separate" role. A "separate" set of controls applies to each role. The role can be different in each instance of the processing of PII (NOTE 2 to 4.1).
- See PII controller and PII processor roles.
- Determine the scope of the PIMS (Clause 4.3,
ORF-258).- Determine the internal and external issues that are "relevant" to your purpose. Determine also the issues that are "relevant" to your context. Include only issues that have an effect on how your organization can get the intended results of the PIMS (Clause 4.1,
ORF-256). Determine if climate change is a "relevant" issue. - Determine which interested parties are "relevant" to the PIMS, and their "relevant" requirements (Clause 4.2,
ORF-257). Determine which of the "relevant" requirements "will be addressed" through the PIMS. Include as interested parties the PII principals and all others with "interests or responsibilities" in the processing of PII. - Determine the boundaries and applicability of the PIMS. Consider the issues of Clause 4.1 and the requirements of Clause 4.2.
- Include the processing of PII in the scope.
- Keep the scope available as documented information.
- See The scope of the PIMS.
- Determine the internal and external issues that are "relevant" to your purpose. Determine also the issues that are "relevant" to your context. Include only issues that have an effect on how your organization can get the intended results of the PIMS (Clause 4.1,
- Select the AI Systems that get
MFF-13.- Modulos recommends
MFF-13for each AI System that processes PII in the scope of the PIMS. - The scope includes the processing of PII in the training data or the input data of an AI system.
- If an AI system in the scope has no AI System in Modulos, make one in the AI Registry.
- Modulos recommends
Set up: a sequence that works
To set up the ISO 27701 Frameworks, Modulos recommends the eight steps below, in this sequence. Steps 1 to 3 are the three decisions of Decisions before set-up.
1
Determine your PII roles
Clause 4.1.
2
Determine the PIMS scope
Clause 4.3.
3
Select the AI Systems for MFF-13
Processing of PII in the PIMS scope.
4
Add OFF-12
To the organization AI System.
5
Do the other work of Clauses 4.4 to 7
In OFF-12.
6
Do the privacy risk treatment
Clause 6.1.3, with the statement of applicability.
7
Add MFF-13 and do Clauses 8.2 and 8.3
On each AI System in the scope.
8
Operate, monitor, audit, review, and improve the PIMS
Clauses 8.1, 9, and 10.
- Add
OFF-12to your organization AI System. If you do not have one, contact Modulos support. - Do the other work of Clauses 4.4 to 7 in
OFF-12. For example:- the PIMS, with its processes and the relations between them (4.4,
ORF-259) - the privacy policy, which top management sets (5.2,
ORF-261) - the responsibilities and authorities (5.3,
ORF-262) - the privacy risk assessment process that you set and use, with its risk acceptance criteria (6.1.2,
ORF-264) - the privacy objectives (6.2,
ORF-266) - the resources, competence, awareness, communication, and documented information (7.1 to 7.5.3,
ORF-268toORF-274).
- the PIMS, with its processes and the relations between them (4.4,
- Do the privacy risk treatment (6.1.3,
ORF-265).- Select "appropriate" risk treatment options. Use the results of the privacy risk assessment of step 5.
- Make the statement of applicability. Give a justification for each Annex A control that you exclude (6.1.3 e)).
- See Clause 6 for all items of Clause 6.1.3.
- Add
MFF-13to each AI System in the scope, and do Clauses 8.2 and 8.3 for it (MRF-243,MRF-244).- Do privacy risk assessments when "significant changes are proposed" or occur, or at planned intervals (8.2).
- Implement the privacy risk treatment plan (8.3).
- The Annex A table Requirements (
MRF-394toMRF-396) hold the reference controls of Tables A.1 to A.3. Use them for the Annex A controls that your statement of applicability of step 6 identifies as necessary. - Also do this work for processing of PII that has no AI System in Modulos. See Work with no Requirement in the Frameworks.
- See Clause 8.
- Operate, monitor, audit, review, and improve the PIMS (
ORF-275toORF-283).- These Requirements are for Clauses 8.1, 9.1 to 9.3.3, 10.1, and 10.2.
- Do the internal audits at planned intervals (9.2.1). Make sure that top management reviews the PIMS at planned intervals (9.3.1).
- Your organization sets the intervals. ISO/IEC 27701 does not set a period.
- See Clause 9 and the times for privacy risk assessments, internal audits, and management reviews.
For the work on Controls and the Reviews of Requirements in Modulos, see Reviews & Statuses.
The Requirements
OFF-12 and MFF-13 give Requirements for Clauses 4 to 10 and for the three Annex A tables of ISO/IEC 27701:2025. In the table, each Requirement has its name in Modulos, its level, its provisions, and the page for the standard.
| Requirement | Level | Provisions of ISO/IEC 27701 | Page for the standard |
|---|---|---|---|
ORF-256 Understanding the organization and its context | Organization | 4.1, with the PII role determination | Clause 4, PII roles |
ORF-257 Understanding the needs and expectations of interested parties | Organization | 4.2 | Clause 4 |
ORF-258 Determining the scope of the privacy information management system | Organization | 4.3 | The scope of the PIMS |
ORF-259 Privacy information management system | Organization | 4.4 | Clause 4 |
ORF-260 Leadership and commitment | Organization | 5.1 | Clause 5 |
ORF-261 Privacy policy | Organization | 5.2 | Clause 5 |
ORF-262 Roles, responsibilities and authorities | Organization | 5.3 | Clause 5 |
ORF-263 Actions to address risks and opportunities - General | Organization | 6.1.1 | Clause 6 |
ORF-264 Privacy risk assessment | Organization | 6.1.2 | Clause 6 |
ORF-265 Privacy risk treatment | Organization | 6.1.3, with the statement of applicability (6.1.3 e)) | Clause 6, Annex A |
ORF-266 Privacy objectives and planning to achieve them | Organization | 6.2 | Clause 6 |
ORF-267 Planning of changes | Organization | 6.3 | Clause 6 |
ORF-268 Resources | Organization | 7.1 | Clause 7 |
ORF-269 Competence | Organization | 7.2 | Clause 7 |
ORF-270 Awareness | Organization | 7.3 | Clause 7 |
ORF-271 Communication | Organization | 7.4 | Clause 7 |
ORF-272 Documented information - General | Organization | 7.5.1 | Clause 7 |
ORF-273 Creating and updating documented information | Organization | 7.5.2 | Clause 7 |
ORF-274 Control of documented information | Organization | 7.5.3 | Clause 7 |
ORF-275 Operational planning and control | Organization | 8.1 | Clause 8 |
ORF-276 Monitoring, measurement, analysis and evaluation | Organization | 9.1 | Clause 9 |
ORF-277 Internal audit | Organization | 9.2.1 | Clause 9 |
ORF-278 Internal audit program | Organization | 9.2.2 | Clause 9 |
ORF-279 Management review | Organization | 9.3.1 | Clause 9 |
ORF-280 Management review inputs | Organization | 9.3.2 | Clause 9 |
ORF-281 Management review results | Organization | 9.3.3 | Clause 9 |
ORF-282 Continual improvement | Organization | 10.1 | Clause 10 |
ORF-283 Nonconformity and corrective action | Organization | 10.2 | Clause 10 |
MRF-243 Privacy risk assessment | AI System | 8.2 | Clause 8 |
MRF-244 Privacy risk treatment | AI System | 8.3 | Clause 8 |
MRF-394 Table A.1 — Reference privacy controls for PII controllers | AI System | Annex A, Table A.1 (A.1.2.2 to A.1.5.5) | Table A.1 |
MRF-395 Table A.2 — Reference controls for PII processors | AI System | Annex A, Table A.2 (A.2.2.2 to A.2.5.9) | Table A.2 |
MRF-396 Table A.3 — Control objectives and matching controls for either PII role | AI System | Annex A, Table A.3 (A.3.3 to A.3.31) | Table A.3 |
ORF-264 and MRF-243 have the same name, and ORF-265 and MRF-244 also have the same name. The provisions in the table show the clause of each of these Requirements.
ORF-256 is the Requirement for Clause 4.1, and Clause 4.1 includes the PII role determination. ORF-258 is the Requirement for Clause 4.3 only, which is the scope of the PIMS.
ORF-265 is the Requirement for Clause 6.1.3, and Clause 6.1.3 e) includes the statement of applicability. Your organization, not Modulos, makes the statement of applicability. The statement of applicability, not the Framework, tells which Annex A controls are necessary for your PIMS.
For the Controls that are in OFF-12 or MFF-13 and also in other Frameworks, see Control overlap.
The ISO 27701 Role tags
In Modulos, each Requirement of OFF-12 and MFF-13 has one or two tags of the type "ISO 27701 Role". The tag values are "PII Controller" and "PII Processor". A tag shows the PII role of Clause 4.1 that the Requirement is for. Your organization determines its PII roles in Clause 4.1 (decision 1 in Decisions before set-up).
| Requirement | ISO 27701 Role tags |
|---|---|
MRF-394 Table A.1 — Reference privacy controls for PII controllers | "PII Controller" |
MRF-395 Table A.2 — Reference controls for PII processors | "PII Processor" |
All other Requirements of OFF-12 and MFF-13 | "PII Controller" and "PII Processor" |
In ISO/IEC 27701, Table A.1 applies to PII controllers, and Table A.2 to PII processors. Table A.3 holds information security controls for PII controllers and PII processors (Annex A). See Annex A.
Modulos wants to use these tags in a new release. The purpose is to remove a Requirement from the scope if the organization or the AI System does not have the PII role of that Requirement.
Work with no Requirement in the Frameworks
For these items, the ISO 27701 Frameworks OFF-12 and MFF-13 have no Requirement. Your organization does this work, but not in the two Frameworks.
- Certification. The Frameworks do not include the selection of a certification body or the certification audits. ISO/IEC 27701 sets no certification rule, and certification is optional. See The certification audit cycle.
- Processing of PII that has no AI System in Modulos. Only
MFF-13has Requirements for Clauses 8.2 and 8.3 and for the Annex A tables. ISO/IEC 27701 applies Clauses 8.2 and 8.3 to all processing of PII in the scope of the PIMS (4.3). Do this work in a different tool, or make an AI System for the processing. - Controls from other sources. The organization can make controls, or get them from other sources (NOTE 1 to 6.1.3). The Annex A table Requirements of
MFF-13are for the Annex A controls only. The statement of applicability includes all necessary controls (6.1.3 e)), andORF-265is the Requirement for Clause 6.1.3. - Obligations of the GDPR.
OFF-12andMFF-13do not hold the obligations of the GDPR. Modulos has different Frameworks for the GDPR. See Other Frameworks in Modulos and ISO/IEC 27701 and the GDPR.
Other Frameworks in Modulos
Modulos also has Frameworks for ISO/IEC 27001, ISO/IEC 42001, and the GDPR:
- ISO/IEC 27001:
OFF-9andMFF-9, with the name ISO 27001. See ISO/IEC 27001 in Modulos. - ISO/IEC 42001:
OFF-10andMFF-10, with the name ISO 42001. See ISO/IEC 42001 in Modulos. - GDPR:
OFF-11andMFF-12, with the name GDPR. See GDPR in Modulos.
OFF-9, OFF-10, and OFF-11 attach to the same organization AI System as OFF-12. ISO/IEC 27701 lets an organization align or integrate its PIMS with other management system standards, "in particular" with ISO/IEC 27001 (Introduction 0.2). But each standard keeps its requirements. See Use with ISO/IEC 27001 and ISO/IEC 42001.
Where to go next
ISO/IEC 27701 overview
The standard, its edition and structure, the GDPR, and use with ISO/IEC 27001 and 42001
PII roles, PIMS scope, and certification
PII roles in Clause 4.1, the scope of the PIMS, and the certification audit cycle
Clauses 4 to 10
The requirements of each clause, and the times for privacy risk assessments, internal audits, and management reviews
Annexes
Tables A.1 to A.3, the Annex B implementation guidance, and the mapping annexes
ISO/IEC 27701 and the GDPR
Annex D, certification, the data protection impact assessment, and breach notification
Sources of this page
- The standard: ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance, second edition, 2025-10. ISO catalog page. This page refers to these parts:
- Introduction 0.2
- Clause 3, with 3.1 and 3.24
- Clauses 4.1 to 10.2, as in the Requirement table, with NOTE 2 to 4.1, NOTE 6 to 4.2, and NOTE 1 to 6.1.3
- Annex A, with Tables A.1 to A.3
- Annex D.
- GDPR, Regulation (EU) 2016/679: Article 35(1) (EUR-Lex).
Disclaimer
This page gives general information only. It is not legal advice, and it does not replace the audit of a certification body. Before you make a decision, compare this page with ISO/IEC 27701:2025.