Two-minute brief
ISO/IEC 27701 requirements explained: video brief
A two-minute brief on what ISO/IEC 27701:2025 requires of a privacy information management system and how its controls divide between controllers and processors.
Key takeaways
- The PIMS follows clauses 4 to 10, adapted to privacy.
- Annex A controls are grouped for controllers, for processors and for both.
- An inventory of the personal data you hold is part of the context evidence.
- Annexes map the standard to the GDPR and related ISO privacy standards.
- Certification shows a working PIMS; it does not by itself establish legal compliance.
Clauses 4 to 10, adapted to privacy
ISO/IEC 27701:2025 has two parts. Clauses 4 to 10 set out the management system requirements on the harmonised structure shared with ISO/IEC 27001 and ISO 9001, adapted to privacy. Annex A lists the reference controls in three groups: for PII controllers, for PII processors, and information security controls for both roles. This short film walks through that structure.
Context asks you to determine the issues that affect privacy, the interested parties, including the individuals whose data you process, regulators and clients, your role as controller, processor or both, and the scope of the PIMS. In practice that means a scope statement naming the processing activities, services, sites and roles covered, a register of the privacy laws, contracts and client requirements that apply and an inventory of the personal data you hold. Leadership means a privacy policy approved and communicated and an accountable privacy lead.
Controls, guidance and mappings
Planning, support, operation, performance evaluation and improvement follow the same pattern as the other ISO management system standards, applied to personal data: privacy risks assessed and treated, people made competent and aware, controls operated, the system audited and reviewed, and nonconformities corrected. Annex B gives implementation guidance, and further annexes map the standard to ISO/IEC 29100, ISO/IEC 27018, ISO/IEC 29151 and the GDPR.
Those mappings help organisations show how their privacy controls relate to their legal obligations, but a certificate does not by itself establish compliance with any data protection law. ISO/IEC 27701:2025 replaced the 2019 edition on 14 October 2025, and existing certificates transition on the timetable the certification body confirms. Certification is decided by an independent certification body accredited for PIMS certification.
In practice the most useful evidence is often the simplest: knowing what personal data the organisation holds and why, answering requests within the deadline, and controlling the sub-processors and transfers that carry data outside the organisation.
ISO/IEC 27701 at a glance
- Purpose
- Privacy information management: governing how personally identifiable information (PII) is collected, used, shared, retained and deleted, as a controller, a processor or both
- Relevant to
- Any organisation that processes personal data: software and SaaS, BPO, healthcare, financial services, HR and payroll, e-commerce, and every processor serving clients
- Edition
- ISO/IEC 27701:2025, published 14 October 2025, a standalone management system standard; 2019 certificates transition on the timetable your certification body confirms, expected to close on 31 October 2028
- Certification
- Assessed and decided by an independent certification body accredited under ISO/IEC 17021-1 and ISO/IEC 27706
- Sterling's role
- Consulting with your team, Effivity, training, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for an ISO/IEC 27701 PIMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 8 months
ISO/IEC 27701: questions people ask
Do we need ISO/IEC 27001 before we can be certified to ISO/IEC 27701?
Not any more. The 2019 edition could only be certified as an extension of an ISO/IEC 27001 certificate. ISO/IEC 27701:2025 is an independent management system standard and can be certified on its own. It still contains information security controls, so a standalone PIMS has to operate them; where an ISO/IEC 27001 system exists, integrate the two.
Are we a PII controller or a PII processor?
Usually both. You are a controller for the personal data of your own employees, customers and contacts, and a processor for the data you handle on a client's instructions. The role is determined activity by activity; the certificate scope states the roles covered, which decides which controls apply.
Does ISO/IEC 27701 certification mean we comply with the GDPR or our national data protection law?
No. The certificate confirms that an accredited body found your PIMS conforming to the standard. Laws such as the EU GDPR, the Philippine Data Privacy Act, India's Digital Personal Data Protection Act and the UAE Personal Data Protection Law have their own requirements, which your legal advisers interpret; the PIMS gives you organised, audited evidence of how you meet them.
What changed between ISO/IEC 27701:2019 and 2025, and when must we transition?
The 2025 edition is a standalone management system standard with its own clauses 4 to 10 and a consolidated Annex A of controller, processor and information security controls, with guidance in Annex B. Accreditation bodies have published a three-year transition ending on 31 October 2028; 2019 certificates remain valid until then if maintained. Certification bodies are completing their own accreditation transitions first, so agree your audit date early.
Does Sterling issue the ISO/IEC 27701 certificate?
No. Sterling builds, trains and prepares. An independent certification body accredited for PIMS certification under ISO/IEC 17021-1 and ISO/IEC 27706 audits the PIMS in two stages and decides. A provider that offers the consulting and the certificate on one invoice is selling paper.
Keep exploring
Related to this video
Read next
The complete guide
Everything on ISO/IEC 27701
Start with the ISO/IEC 27701 page, or go straight to the guide you need.
On the ISO/IEC 27701 page
- What are the main ISO/IEC 27701 requirements?
- How do you get ISO/IEC 27701 certified?
- How much does ISO/IEC 27701 certification cost?
- How long does ISO/IEC 27701 certification take?
- Who needs ISO/IEC 27701 certification?
- How ISO/IEC 27701 turns privacy obligations into a working system
- Frequently asked questions about ISO/IEC 27701
Guides
- ISO 27701:2025 transition
- ISO 27701 Annex A controls explained
- The ISO 27701 certification process, step by step, from scope and role to certificate
- ISO 27701 PII controller or processor
- ISO 27701 certification cost
- ISO 27701 and GDPR
- Effivity ISO 27701 guide
- ISO 27701 internal audit
- ISO 27701 requirements explained
- ISO 27701 vs ISO 27001
Often combined with ISO/IEC 27701
More videos: Privacy and data protection
- How to comply with GDPRCompliance walkthrough · 3 min 24 s
- GDPR requirements explainedTwo-minute brief · 2 min
- How to comply with the Philippine Data Privacy ActCompliance walkthrough · 3 min 15 s
- Philippine Data Privacy Act requirements explainedTwo-minute brief · 2 min
- How to comply with India's DPDP Act 2023Compliance walkthrough · 3 min 15 s
- India's DPDP Act 2023 requirements explainedTwo-minute brief · 2 min
- How to comply with Singapore's PDPACompliance walkthrough · 3 min 15 s
- Singapore PDPA requirements explainedTwo-minute brief · 2 min
- How to comply with Saudi Arabia's PDPLCompliance walkthrough · 3 min 15 s
Talk to a consultant
Plan your ISO/IEC 27701 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice