ISO 27701 requirements explained: what clauses 4 to 10 of the 2025 edition ask of your PIMS

How are the ISO 27701 requirements organised?

The 2025 edition turned ISO/IEC 27701 from an add-on into a management system standard of its own. Where the 2019 text extended ISO/IEC 27001 and ISO/IEC 27002, the current text gives a privacy information management system, or PIMS, its own clauses 4 to 10 on the structure shared by ISO management system standards, so it can stand alone or sit beside an ISMS.

Read it in three layers: the clauses say what the system must do, Annex A lists the controls you select from by role, and Annex B explains how to put those controls into practice.

The detail of each control set belongs to our Annex A guide; this page stays with the clauses.

Clause 4: context of the organisation

Clause 4 asks you to identify the internal and external issues that bear on privacy, the interested parties and what they require of you, and the boundaries of the system. For privacy those parties are concrete: the people whose data you hold, the regulators who enforce the laws that apply, and the clients whose contracts dictate how you handle their data.

Two decisions here shape everything after. The first is your role for each processing activity: a payroll bureau, for instance, is usually a processor for its clients' staff data and a controller for its own employees. The second is the scope: the processing activities, services, sites and systems the certificate will cover. Both rest on an inventory of the personal data you hold and why. Role and scope decisions have their own guide, PII controller or PII processor: scoping your PIMS.

What goes wrong here: a scope that names the whole company while the inventory covers two systems, and a role declared once for the entire business when different services demand different answers.

Clauses 5 and 6: leadership and planning

Leadership

Clause 5 makes privacy a management responsibility, not a legal-department project. Top management commits to the PIMS, approves a privacy policy and makes sure privacy roles and authorities are assigned. A data protection officer alone does not satisfy it; the auditor looks for senior accountability and privacy decisions on the management agenda.

Planning

Clause 6 is the risk engine of the PIMS. The distinctive point for privacy is that risk runs in two directions: risk to the organisation, such as regulatory action, contract loss or reputational damage, and risk to the individuals whose data you process, such as exposure, discrimination or loss of control over their information. A risk method that only scores harm to the business misses half of what the standard is about.

From the assessment come treatment decisions, which link to the Annex A controls you apply and record why any are left out, and privacy objectives that can be measured and dated. Changes to the PIMS are planned rather than improvised.

Clause 7: support

Clause 7 covers what the system needs to run: resources, competence, awareness, communication and documented information. Privacy competence is specific to the task: whoever answers access requests must recognise a valid one and know the deadline, a developer must know what privacy by default means for a design, and procurement must know what a data processing agreement contains.

Communication reaches outside the organisation, through notices, replies to individuals and notifications to clients or regulators. Documents stay under version control, so the notice a customer saw last March can still be produced.

The usual finding: a single annual awareness session recorded for everyone, with no proof that the people who handle requests or build systems have the knowledge their tasks demand.

Clause 8: operation

Clause 8 puts the controls selected in planning to work. You control the processes that deliver privacy, keep the risk assessment current as processing changes and manage processing done with or for other parties: current records of processing, impact assessments before new processing goes live, contracts with clients and sub-processors, transfer safeguards, and retention that ends in deletion.

Most audit evidence comes from here. Test yourself by following one processing activity from collection to deletion:

If any row has no record, the requirement exists on paper only.

Clauses 9 and 10: performance evaluation and improvement

Clause 9 asks you to prove the PIMS works. You decide what to monitor and measure and use the results; useful measures include request turnaround against deadline, breach response time and the share of processing activities with a current record. Internal audits cover the clauses and the controls you apply, and top management reviews the system and records decisions. The method for the audit itself is set out in ISO/IEC 27701 internal audit: planning, conduct and reporting.

Clause 10 closes the loop. Nonconformities, whether found by an audit, a complaint, a client or a breach, are corrected, their causes are investigated and removed, and the effectiveness of the action is checked. Continual improvement should be visible in the measures from clause 9, not only asserted in the management review minutes.

The classic weak point: breaches closed with no root cause, so the same one recurs.

Meeting the requirements without starting from nothing

A certified ISO/IEC 27001 system already supplies a risk method, document control, internal audit and management review; the PIMS scope can be aligned with it, and the work concentrates on the data inventory, risks to individuals, the Annex A controls for your role and their records. Without an ISMS those foundations are built for privacy first. Holders of a 2019 certificate should read ISO/IEC 27701:2025: what changed and how to transition.

A PIMS helps you evidence accountability under laws such as the EU GDPR, the Philippine Data Privacy Act, India's Digital Personal Data Protection Act or the UAE's personal data protection law, but it is not legal advice; ISO/IEC 27701 and data protection law explains where the standard and the law meet.

ISO 27701 requirements: questions buyers ask