What ISO 27701 is and why buyers ask for it
ISO/IEC 27701 is the international standard for a Privacy Information Management System (PIMS). Following its 2025 revision it is a standalone management-system standard — a PIMS can be established on its own, or integrated with ISO 27001 and other management systems. It sets out the requirements and controls needed to protect personally identifiable information (PII). In short: where ISO 27001 addresses information security, ISO 27701 addresses privacy.
As privacy regulation has tightened worldwide, buyers and regulators increasingly want evidence that an organisation runs a deliberate, audited privacy programme rather than relying on good intentions. ISO 27701 certification provides that evidence, and it supports compliance efforts under regimes such as GDPR, HIPAA and PCI DSS. It is part of the broader ISO Certifications portfolio ABS supports.
What the audit covers
A PIMS audit assesses how your organisation manages PII across its lifecycle, whether the PIMS is implemented on its own or alongside an ISO 27001 ISMS. Key areas include:
- The roles your organisation plays — PII controller, PII processor, or both — and the distinct controls for each
- Mapping of the personal data you process, and the lawful, transparent basis for doing so
- Privacy-specific controls covering consent, purpose limitation, retention and the support of data subject rights
- Management of processors and sub-processors handling PII on your behalf
Certification follows the same two-stage assessment as other ISO management systems, with surveillance audits across the three-year cycle. The PIMS can be certified independently or integrated with an existing ISO 27001 ISMS — the work is most efficient when the two are aligned.
Typical timeline
For an organisation that already holds ISO 27001, adding ISO 27701 typically takes around 10–14 weeks. Implementing both together from a standing start takes longer and depends on the scope of PII processing and the number of sites. Each engagement begins with a fixed-price scoping call, and we send a proposal within 24 hours with a firm timeline.
Common questions
Do we need ISO 27001 before ISO 27701?
No longer. The 2025 edition of ISO/IEC 27701 is a standalone management-system standard, so a PIMS can be established and certified without first holding ISO 27001. It still integrates cleanly with ISO 27001 and other management systems, and many organisations run them together — but ISO 27001 is no longer a prerequisite.
How does ISO 27701 relate to GDPR?
ISO 27701 is a certifiable management system standard whose controls map onto many GDPR requirements, so certification is a recognised way to demonstrate a managed privacy programme to customers and regulators. It is not, by itself, an automatic legal guarantee of GDPR compliance — but it provides much of the audited framework.
Who needs ISO 27701?
Organisations that process significant volumes of personally identifiable information — healthcare providers, financial institutions, IT and SaaS companies, e-commerce businesses and education organisations — use ISO 27701 to evidence that privacy is managed to an independent, recognised standard.
What is the difference between a PII controller and a PII processor under ISO 27701?
ISO 27701 sets out separate sets of controls for organisations acting as a PII controller (which determines why and how personal data is processed) and as a PII processor (which processes data on a controller’s behalf). The audit scopes whichever role — or both — applies to your business.
