ISO 27701

ISO/IEC 27701 is the international standard for a privacy information management system (PIMS). The first edition (2019) was written as an extension to ISO/IEC 27001 and 27002, so an organization could only certify to it alongside an ISO 27001 certificate.

The second edition, published October 14, 2025, rewrites it as a standalone management system standard under the title "Information security, cybersecurity and privacy protection: Privacy information management systems: Requirements and guidance".

Organizations can now certify a PIMS on its own, though most still pair it with ISO 27001 because the security controls overlap heavily.

The standard covers both PII controllers and PII processors, with separate annexes of controls for each role, and maps to GDPR-style obligations such as lawful basis, purpose limitation, data subject rights, processor contracts, and transfer records.

In writing, a PIMS needs a scope statement that identifies the organization's role (controller, processor, or both), a privacy policy, a privacy risk assessment method and results, a record of processing activities, a statement of applicability covering the privacy controls, procedures for consent, notices, data subject requests, retention and deletion, breach notification, and processor and subprocessor management, plus the usual management system records: objectives, competence, internal audit, management review, and corrective action.