ISO 27701 vs ISO 27001: how privacy and security management differ, and how they fit together

ISO 27701 vs ISO 27001: the short answer

The two standards answer different questions about the same organisation. ISO/IEC 27001:2022, with its 2024 amendment on climate change, asks whether you protect the confidentiality, integrity and availability of your information through assessed risks and selected controls. ISO/IEC 27701:2025 examines whether you govern personal data as a controller, a processor or both: why you collect it, on what basis, who receives it, how long you keep it and how you answer the people it describes.

Security is a condition of privacy, not the whole of it. A company can encrypt every database, run access reviews on time and pass an ISMS audit, yet still collect more data than it needs, keep it for years without a reason or pass it to a sub-processor its client never approved. Those are privacy failures that an ISO/IEC 27001 audit is not designed to find. The reverse also holds: a privacy programme with excellent notices and a tidy request log offers little comfort if the systems holding the data are poorly protected.

So the useful question is rarely "which one?" in the abstract. It is which risk your clients, regulators and contracts are asking you to evidence first, and whether the other will follow.

The two standards side by side

Cost drivers follow the same logic for both: scope, sites, headcount, the maturity of what exists and the certification body's audit days. For ISO/IEC 27701 the processing activities and the roles in scope weigh most; the ISO/IEC 27701 certification cost guide sets out what moves the price.

How the 2025 edition changed the relationship

Until October 2025 the answer to "ISO 27701 or ISO 27001?" was forced. The 2019 edition was written as an extension to ISO/IEC 27001 and ISO/IEC 27002, and the certification rules of the time treated a PIMS certificate as an addition to an ISMS certificate, with the privacy scope sitting inside the security scope. An organisation that wanted privacy certification had to build and certify an ISMS first.

ISO/IEC 27701:2025 removed that dependency. The iso.org entry for the standard now describes it as an independent management system standard that can be used alone, with its own clauses 4 to 10, while noting that it aligns with existing ISO/IEC 27001 systems. Certification bodies audit it under ISO/IEC 27706:2025, which replaced the technical specification that had tied the two certificates together.

Two practical consequences follow. A processor whose clients ask only for privacy assurance can now pursue ISO/IEC 27701 on its own. And an organisation that already holds both certificates is not required to separate them: the PIMS scope can stay aligned with the ISMS scope and be audited alongside it. If you hold a 2019 certificate, the ISO/IEC 27701:2025 transition guide covers the dates accreditation bodies have published and how to plan the move.

Where the two standards overlap and where they part

Both standards use the harmonised structure shared by ISO management system standards, so the clause titles match. What differs is the subject each clause applies to. The table shows what the PIMS asks beyond what an ISMS already provides.

The controls

ISO/IEC 27001 sets out 93 controls in organisational, people, physical and technological themes, and you justify each inclusion or exclusion. ISO/IEC 27701:2025 arranges its Annex A differently: controls for PII controllers, controls for PII processors, and a set of information security controls aligned with ISO/IEC 27002 that apply whichever role you hold. That third set is what lets a standalone PIMS protect the data it governs without an ISMS behind it. Where both systems run together, the security controls are implemented once and referenced from both. The Annex A guide explains the controller and processor controls in detail.

Which one, or both?

Start from the demand, not the standard. Four situations cover most organisations we meet.

Clients send security questionnaires and name ISO/IEC 27001

Begin with the ISMS. It answers the widest range of due diligence, covers information that is not personal data, and gives you the risk method and audit programme a PIMS can later reuse.

You process personal data for clients, and their contracts ask about privacy

A processor handling payroll, customer records or patient data for others is judged on whether it follows instructions, controls sub-processors, supports rights requests and deletes on exit. ISO/IEC 27701 speaks directly to those questions. If security is also questioned, run both; if not, a standalone PIMS is now a legitimate route. The PII controller or processor guide helps settle the role your certificate should state.

You already hold ISO/IEC 27001

Adding ISO/IEC 27701 is the natural next step when privacy questions start arriving. The work is the privacy layer: mapping the data, deciding lawful bases, building request, impact assessment, retention and deletion processes, and bringing contracts into line.

You hold neither, and both are being asked for

Build them together as one system rather than one after the other. Designing the risk method, document control and audit programme once for both avoids reworking the ISMS a year later.

Running ISO/IEC 27001 and ISO/IEC 27701 as one system

An integrated system keeps one risk register in which each risk is judged for its security consequence and, where personal data is involved, for its consequence to the people concerned. It keeps one document control, one training plan, one internal audit programme that samples both sets of controls, and one management review with privacy and security measures on the same agenda. Scopes should be written so that the PIMS scope sits within the ISMS scope, or matches it, which keeps sampling and evidence simple.

A certification body accredited for both can audit them in a combined visit. Whether that shortens the total audit days depends on the body's own rules for your scope, so ask for the calculation in writing. The ISO/IEC 27001 integration guide covers running several standards on one frame.

Common mistakes when choosing between them

• Treating an ISO/IEC 27001 certificate as proof of privacy management. Clients reviewing a processor will ask about sub-processors, retention and rights requests, and the ISMS certificate does not answer them.
• Assuming ISO/IEC 27701 still needs an ISO/IEC 27001 certificate. That was true under the 2019 edition; plan on the 2025 rules and confirm them with your certification body.
• Writing two scopes that do not meet. A PIMS scope covering services the ISMS scope leaves out complicates the combined audit and confuses clients reading both certificates.
• Running two risk registers. Separate methods for security and privacy produce conflicting ratings for the same system and double the maintenance.
• Choosing a certification body without checking its accreditation for ISO/IEC 27706. Accreditation for ISO/IEC 27001 alone does not cover PIMS certification.

ISO 27701 vs ISO 27001: questions buyers ask