Docs

Appearance

ISO/IEC 27701 — PII roles, PIMS scope, and certification ​

ISO/IEC 27701:2025 gives requirements to an organization that operates a privacy information management system (PIMS). This page gives two of these requirements: the PII roles of the organization (Clause 4.1) and the scope of the PIMS (Clause 4.3). It also gives information about the certification of a PIMS by a certification body. ISO/IEC 27701 is a voluntary standard, and its requirements apply to an organization that implements it.

For PII, PII controller, PII processor, and PII principal, Clause 3 of ISO/IEC 27701 uses the terms and definitions of ISO/IEC 29100. NOTE 4 to Clause 4.2 gives information about PII principals. In ISO/IEC 27701, an "individual person" is a PII principal when the processing of the PII of that person occurs in a "business association". The NOTE gives examples of this type of relation: a "consumer", "employee", "vendor", or "visitor" relation.

PII controller and PII processor roles (Clause 4.1) ​

ISO/IEC 27701 Clause 4.1 requires the organization to determine if it is a PII controller or a PII processor. A joint PII controller is a PII controller for this role determination. It is not a different role. In 3.21, a joint PII controller determines the purposes and means for the processing of PII together with one or more other PII controllers.

If the organization has the two roles, Clause 4.1 requires it to determine each role as a "separate" role. Each role has a "separate" set of controls. NOTE 2 to Clause 4.1 adds that the organization can have a different role in each instance of the processing of PII. The cause is that the role follows the person or organization that determines the purposes and means for the processing. NOTE 2 gives information. It is not a requirement.

Clause 4.1 does not require the organization to record its roles as documented information. But the scope of the PIMS is documented information. When the organization determines the scope, it considers the issues of Clause 4.1 (see The scope of the PIMS (Clause 4.3)).

This table compares the two roles in ISO/IEC 27701:

ItemPII controllerPII processor
Purposes and means of the processingThe PII controller determines them. In 3.21, a joint PII controller determines them together with one or more other PII controllers.The PII processor processes PII only for the purposes in the documented instructions of its customer (control A.2.2.3).
The customer (Clause 4.2)An organization that has a contract with the PII controllerA PII controller that has a contract with the PII processor
Annex A table for the roleTable A.1, and Table A.3 for the two rolesTable A.2, and Table A.3 for the two roles

In ISO/IEC 27701, the customer is different for each role (Clause 4.2 and 3.22 Note 2). A PII processor can use a subcontractor to process PII. Then the customer of the subcontractor is the PII processor that has a contract with it for the processing of PII (Clause 4.2 c)). Controls A.2.5.7 to A.2.5.9 in Table A.2 are about the subcontractors that a PII processor uses to process PII (Table A.2).

In Table A.1, control A.1.2.8 is about joint PII controllers. Control A.1.2.8 requires the organization to determine roles and responsibilities with each joint PII controller. These roles and responsibilities are for the processing of PII. They include the requirements for the protection and security of PII.

In Table A.1, Table A.2, and Table A.3 of Annex A, the organization can exclude controls. The statement of applicability gives the justification for each exclusion (Annex A).

For an AI system, the PII role also follows the person or organization that determines the purposes and means for the processing (NOTE 2 to Clause 4.1).

The GDPR uses the names controller and processor for its roles (Article 4(7) and 4(8)). ISO/IEC 27701 uses the names PII controller and PII processor, from ISO/IEC 29100. To compare the roles, see Controller and processor in the GDPR and ISO/IEC 27701.

The scope of the PIMS (Clause 4.3) ​

ISO/IEC 27701 Clause 4.3 requires the organization to determine the boundaries and applicability of its PIMS. These boundaries and this applicability set the scope of the PIMS. When the organization determines the scope, it considers all of these items:

  • the external and internal issues that it determines in Clause 4.1
  • the requirements of interested parties that it determines in Clause 4.2.

The scope is available as documented information. The scope includes the processing of PII.

Clause 4.3 refers to the issues of Clause 4.1, and Clause 4.1 also holds the role determination. ISO/IEC 27701 does not tell the organization which step to do first. Modulos recommends the role determination first.

Clause 4.2 is about interested parties. In its interested parties, the organization includes the PII principals and the other interested parties related to the processing of PII (Clause 4).

Clause 4.3 does not give other items for the documented information about the scope. Clause 4.3 does not require this documented information to identify the processing activities, the categories of PII, the PII principals, or the roles. Clause 4.3 also gives no procedure to examine the scope again. The organization can add these items to the documented information about its scope. That is a decision of the organization.

Where the organization is one part of a larger entity, "organization" is only the part of the larger entity in the PIMS scope (3.1 Note 2).

For an AI system, the use of PII in training data or in input data is processing of PII. Clause 4.3 requires the organization to include the processing of PII when it determines the scope.

The certification audit cycle ​

ISO/IEC 27701 is a voluntary standard. It sets no rule for certification. Certification of a PIMS is optional for an organization that implements the standard.

ISO/IEC 27701 gives two related points. Some interested parties can want independently audited conformity with a standard such as ISO/IEC 27701 (NOTE 6 to Clause 4.2). An organization that conforms to ISO/IEC 27701 can make evidence of how it processes PII. The use of the standard can give independent verification of this evidence (Introduction 0.1).

A certification body audits the PIMS of the organization against ISO/IEC 27701 and can then certify it. IAF MD 5:2023 gives this cycle for the certification of quality, environmental, and occupational health and safety management systems:

  • an initial certification audit in two parts, Stage 1 and Stage 2
  • surveillance audits each year during the initial three-year certification cycle
  • a recertification audit.

Section 0.5 of IAF MD 5:2023 adds that other certification schemes that use ISO/IEC 17021-1 can use some parts of it. IAF MD 5:2023 gives no audit time for a PIMS.

ISO/IEC 27701 requires the organization to do internal audits at planned intervals (Clause 9.2). It requires top management to do management reviews of the PIMS at planned intervals (Clause 9.3). The organization sets these intervals. For these intervals, see the planned intervals in Clauses 8 and 9. For the requirements of Clause 9, see Clause 9.

ISO/IEC 27701 gives no time limit to implement the PIMS and no minimum period of operation before an audit. It requires documented information as evidence that the organization implements its audit program, and as evidence of the audit results (Clause 9.2.2). It requires the same for the results of management reviews (Clause 9.3.3).

ISO/IEC 27701 gives the types of audit in 3.18 Notes 1 and 2. An internal audit is a first-party audit by the organization, or by an external person or organization for it. An external audit is a second-party or third-party audit. An audit can also be a combined audit of two or more management system areas.

ISO/IEC 27701:2025 is a stand-alone management system standard (Foreword). It does not require an ISO/IEC 27001 information security management system or ISO/IEC 27001 certification. Its only normative reference is ISO/IEC 29100 (Clause 2). Clause 6.1.3 c) requires the organization to identify and document the information security program that it implements, with the "appropriate" security controls. This information security program can be an ISO/IEC 27001 information security management system, but it can also be a different information security program (3.24 Note 1, Clause 6). ISO/IEC 27701 does not require a combined audit with ISO/IEC 27001.

No provision of ISO/IEC 27701 identifies the standard as a certification mechanism in GDPR Article 42. An ISO/IEC 27701 certificate is not sufficient to show compliance with the GDPR. For more information, see Certification in GDPR Article 42.

No Requirement of the Modulos Frameworks for ISO/IEC 27701 is for certification. The selection of a certification body and the certification audits are work with no Requirement in the Frameworks.

The roles and the scope in Modulos ​

In Modulos, ISO/IEC 27701 has two Frameworks, each with the name ISO 27701: the Organization Framework OFF-12 and the AI System Framework MFF-13. In OFF-12, the Requirement ORF-256 is for Clause 4.1, which includes the role determination. The Requirement ORF-258 is for Clause 4.3 only. For all Requirements and their provisions, see The Requirements.

Where to go next ​

ISO/IEC 27701 overview

Edition, structure, the GDPR, and use with ISO/IEC 27001

Clauses 4 to 10

Each clause, with risk treatment in Clause 6

Annexes

Tables A.1 to A.3, Annex B, and Annexes C to F

ISO/IEC 27701 and the GDPR

Annex D, GDPR certification, roles, and the data protection impact assessment

ISO/IEC 27701 in Modulos

OFF-12, MFF-13, the steps, and the Requirements

Sources of this page ​

  • ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance, edition 2, 2025-10 (ISO catalog page): Foreword and Introduction 0.1. Clauses 2 and 3 (3.1, 3.18, 3.21, 3.22, 3.23, 3.24). Clauses 4.1, 4.2, 4.3, 4.4, 6.1.3 c) and e), 9.2, and 9.3. The Annex A introduction and controls A.1.2.8, A.2.2.3, and A.2.5.7 to A.2.5.9.
  • ISO/IEC 27701:2019, edition 1, 2019-08, withdrawn 2025-10-14 (ISO catalog page).
  • IAF MD 5:2023, Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems, Issue 4, Version 3, 14 June 2023: sections 0.1, 0.3, 0.5, 4, 5, and 6 (IAF).
  • Regulation (EU) 2016/679 (GDPR): Articles 4(7), 4(8), and 42 (EUR-Lex).

Disclaimer

This page gives general information only. It is not legal advice. It does not replace the audit of a certification body.