ISO 27701:2025 transition: what changed from the 2019 edition and how to move your certificate

Who has to transition to ISO 27701:2025, and by when

Any organisation holding an accredited ISO/IEC 27701:2019 certificate has to move it to the 2025 edition before the transition period closes. Until then the 2019 certificate stays valid as long as surveillance continues normally; after the end date it lapses.

There is no single worldwide date yet; the published rules come from individual accreditation bodies.

In practice your deadline is the last audit your certification body can schedule before its end date, so map your surveillance and recertification visits against it.

What changed between ISO/IEC 27701:2019 and 2025

The 2019 edition was written as a set of additions to ISO/IEC 27001 and ISO/IEC 27002: its clause 5 added privacy to the ISMS requirements and its clause 6 added privacy guidance to the security controls. Certification followed the same logic, as an extension that had to sit inside an ISO/IEC 27001 certificate. The 2025 edition removes that dependency and restructures the document around the harmonised structure used by other ISO management system standards.

Secondary sources count 78 controls in the new Annex A: 31 for controllers, 18 for processors and 29 shared. The clause and control detail is covered in the requirements guide and the Annex A guide; this page stays with the move itself.

What the transition means if you also hold ISO/IEC 27001

Most 2019 certificates sit on an ISO/IEC 27001 system, and that system does not have to change for the PIMS to transition. What changes is the relationship. Under 2019 the PIMS borrowed the ISMS clauses; under 2025 it carries its own context, leadership, planning, support, operation, evaluation and improvement requirements, framed around privacy and the individuals whose data you process.

For an organisation that runs both, the practical answer is usually one integrated system: shared document control, one internal audit programme and one management review, with privacy-specific inputs where the 2025 edition requires them. The PIMS scope can stay aligned with the ISMS scope. The 2025 edition would also allow a standalone PIMS; whether dropping ISO/IEC 27001 suits your clients is a commercial decision to agree with your certification body first.

Watch the security layer. Where the PIMS previously relied on the ISMS for security controls, the 2025 edition expects A.3 controls to be addressed within the PIMS. If your ISMS already implements the equivalent ISO/IEC 27002:2022 controls, the task is to reference that evidence, not to duplicate it.

Planning the ISO 27701:2025 transition in five steps

Treat the transition as a managed change with an owner, a budget of people's time and a target audit. Five steps cover it.

Step 1: gap analysis against the 2025 text

Work from a licensed copy of ISO/IEC 27701:2025. Compare your current PIMS with clauses 4 to 10 and with the Annex A parts that apply to your role. Record for each requirement whether existing evidence already meets it, needs rewording or does not exist.

Step 2: confirm your role and remap the controls

Decide whether the certificate covers you as controller, processor or both, then retrace each privacy risk treatment to the A.1, A.2 or A.3 controls you apply, with a reason for each one you exclude. The old numbering will not carry across, so old cross-references in policies and procedures need updating. Role questions are explored in the scoping guide.

Step 3: update documented information

Revise the privacy policy, scope statement, risk method and objectives so they stand as PIMS requirements rather than additions to the ISMS.

Step 4: brief the people who carry the system

Leadership, the privacy lead, process owners and internal auditors need to understand the new structure and what they will be asked about.

Step 5: internal audit and management review to 2025

Audit the PIMS against the 2025 requirements and the controls in scope, close the findings with evidence, then hold a management review that records the decision to present for the transition assessment. Internal audit practice is covered in the internal audit guide.

Questions to put to your certification body

Your certification body decides how and when your certificate moves, so agree the arrangements early. Ask it in writing:

• When will it hold accreditation to certify against ISO/IEC 27701:2025 under ISO/IEC 27706, and which accreditation body granted it?
• Which of your scheduled visits can carry the transition, a surveillance audit, a recertification or a separate visit?
• How many audit days the transition assessment adds, and whether a PIMS audited with the ISMS keeps a combined programme.
• What happens to the certificate's expiry date, and how will your role and scope appear on the 2025 certificate?
• Which end date binds it, and what happens if findings are still open close to that date?

The risks of leaving the transition late

Leaving it to 2028 compresses the work into the months when every other certificate holder is asking for the same audit slots. A finding raised during a late transition visit leaves little time for corrective action before the end date, and a 2019 certificate that has not transitioned lapses with the edition; ask your certification body now what route back it would offer in that case. Clients who check your ISO/IEC 27701 certificate during due diligence can also see which edition it states.

ISO 27701:2025 transition: questions buyers ask