ISO 27701 Annex A controls explained: controller, processor and security

What is Annex A in ISO/IEC 27701:2025?

ISO 27701 Annex A controls are the reference set a privacy information management system (PIMS) is checked against. Clauses 4 to 10 set out how the PIMS is run; Annex A lists the privacy safeguards themselves. The link between the two sits in planning: once you have assessed privacy risks, you decide how to treat them and trace each decision to the Annex A controls you apply, with a reason recorded for every control you leave out.

The 2025 edition organises the annex by role. Table A.1 holds the controls for organisations that decide why and how personal data is processed. Table A.2 holds the controls for organisations that process personal data on a customer's instructions. Table A.3 holds security controls for both; because the 2025 edition can be certified without an ISO/IEC 27001 certificate, the safeguards protecting personal data now sit inside the privacy standard itself.

Implementation guidance for each control sits in Annex B, laid out in the same three parts. The clauses have their own guide (ISO/IEC 27701 requirements), as does the move from the 2019 layout (what changed and how to transition).

The three control tables at a glance

Control counts below are those reported consistently by published commentaries on the 2025 edition.

Many organisations need all three: a platform provider processes what customers upload, yet controls its own staff and sales data if those are in scope.

A.1: controls for PII controllers

The controller controls follow personal data from the decision to collect it. In the 2019 edition these controls were grouped under four headings: conditions for collection and processing, obligations to PII principals, privacy by design and privacy by default, and PII sharing, transfer and disclosure. The same themes run through Table A.1.

Conditions for collection and processing

Each processing purpose is identified and documented, a lawful basis is recorded, consent is obtained and recorded where consent is the basis, and an impact assessment is carried out where the processing warrants one. Auditors pick activities from the records of processing and ask for the basis, notice and assessment of each.

Obligations to the individuals concerned

People are told what happens to their data and can access, correct or delete it, object or withdraw consent. The evidence is a dated request log and versioned notices.

Privacy by design and by default

Collection is limited to what the purpose needs, and personal data is retained no longer than necessary and then disposed of. A schedule nobody applies is the common gap; the auditor looks for disposal records.

Sharing, transfer and disclosure

Transfers between jurisdictions rest on a recorded basis, the countries and organisations that receive data are identified, and disclosures to third parties are logged.

A.2: controls for PII processors

The processor table is shorter because the processor does not choose the purposes. Its controls keep the processor to the customer's instructions, so reusing client data for its own marketing or analytics is exactly what they stop, and make it help the customer meet obligations that remain the customer's.

In practice the table asks for a contract with each customer that sets out the processor's privacy obligations, support for the customer's request handling and impact assessments, control over which sub-processors are used and where, a record of legally binding disclosure requests, and the return, transfer or deletion of customer data when the service ends. The strongest evidence is a sub-processor register that matches what customers were told.

Whether a given activity makes you a controller or a processor is a scoping decision covered in its own guide (PII controller or PII processor)

A.3: security controls, and the overlap with ISO/IEC 27001

Table A.3 brings a set of information security controls into the privacy standard, aligned with the ISO/IEC 27002:2022 structure. They cover safeguards such as access, logging, backup, supplier security and incident handling.

With an ISO/IEC 27001 system in place, most of this exists and can serve both systems, provided the evidence shows personal data explicitly: a breach register noting whether personal data was involved, access reviews covering the systems that hold it. For a standalone PIMS, Table A.3 is where the security baseline is built, often the largest block of effort.

How do you decide which Annex A controls apply?

Selection runs in four steps.

1. List the processing activities in scope and, for each, the role you play. This tells you which of Tables A.1 and A.2 are in play.
2. Assess the privacy risks to the organisation and to the individuals whose data you hold, using the criteria the PIMS defines.
3. Add the obligations you cannot choose: data protection law in the countries concerned and the privacy terms in client contracts.
4. Record the decision for every control: applied, with the evidence that shows it, or not applied, with the reason.

Worked example: a payroll service provider certifying one service line and its head office.

All three tables appear in one applicability record.

Where Annex A work goes wrong

• Declaring only one role. A processor that ignores Table A.1 for its own staff data leaves gaps the auditor finds quickly.
• Exclusions without reasons. Leaving a control out is allowed when it is justified; leaving it out silently is a finding.
• Policies in place of operation. A deletion policy does not show deletion; the records do.
• Stale sub-processor lists. Without an owner, the list customers see and the vendors in use drift apart.
• Treating Annex A as legal compliance. Evidencing accountability is not interpreting the law; see (ISO/IEC 27701 and data protection law).

ISO/IEC 27701 Annex A: questions buyers ask