ISO 27701:2025: What Changed and How to Transition

Last updated: 23 October 2026

Quick answer: ISO 27701:2025 is the second edition of the international standard for privacy information management systems (PIMS). Published in October 2025, it is now a standalone management system standard, so organisations can certify it without ISO 27001. It sets requirements and controls for PII controllers and processors, and existing 2019 certificates must transition.

For years, ISO/IEC 27701 was the privacy “bolt-on” to an ISO 27001 information security management system. You could not certify it on its own. The ISO 27701:2025 edition changes that, and it matters for any DPO who uses certification to show customers, regulators and boards that privacy is managed, not just documented.

This guide explains what changed, how the standard is structured, how it relates to the GDPR, UK GDPR and US privacy expectations, and how to plan either a new certification or a transition from the 2019 edition.

What is ISO 27701:2025?

ISO 27701:2025 is an international standard that sets requirements and guidance for establishing, implementing, maintaining and continually improving a privacy information management system. It applies to any organisation that processes personally identifiable information (PII), whether as a controller, a processor, or both.

The full title of ISO/IEC 27701:2025 is “Information security, cybersecurity and privacy protection: Privacy information management systems: Requirements and guidance”. ISO lists it as edition 2, published in October 2025, replacing ISO/IEC 27701:2019. It is published jointly by ISO and IEC.

A PIMS is the privacy equivalent of an ISMS: a set of policies, roles, processes and controls, run through a plan-do-check-act cycle, that keeps privacy risk under control as the organisation changes.

What changed from ISO 27701:2019?

The biggest change is independence: the 2025 edition is a standalone management system standard rather than an extension of ISO 27001. It also adopts ISO’s harmonised structure and reorganises its controls for controllers and processors.

According to BSI’s summary of the key changes, organisations can now implement the PIMS without first establishing ISO/IEC 27001 certification. Informative annexes provide implementation guidance and mappings, including to the GDPR and to the 2019 edition.

In practice: standalone does not mean security-free. The standard still expects information security controls that protect PII. If you already hold ISO 27001, integrating the two systems is usually the most efficient route; if you do not, you now have a privacy-first path to certification.

How is ISO 27701:2025 structured?

The standard follows the same clause pattern as ISO 27001, ISO 42001 and ISO 9001: context, leadership, planning, support, operation, performance evaluation and improvement. The privacy-specific content sits mainly in the risk process and in Annex A.

Management system clauses 4 to 10

• Clause 4, Context: identify internal and external issues, interested parties (including data subjects and regulators), your role as controller or processor, and the PIMS scope.
• Clause 5, Leadership: top management commitment, a privacy policy, and assigned roles and responsibilities.
• Clause 6, Planning: privacy risk assessment and treatment, privacy objectives, and planning changes.
• Clause 7, Support: resources, competence, awareness, communication and documented information.
• Clause 8, Operation: run the planned processes and apply the selected controls.
• Clause 9, Performance evaluation: monitoring, internal audit and management review.
• Clause 10, Improvement: nonconformity, corrective action and continual improvement.

Annex A controls

Annex A groups controls by role: those for PII controllers (for example, identifying lawful basis, handling data subject rights, privacy by design and records of processing), those for PII processors (for example, processing only on customer instructions, sub-processor management and return or deletion of PII) and those that apply to both. You justify which controls you include in a statement of applicability, just as in ISO 27001.

Common mistake: treating Annex A as a checklist. Controls are selected through privacy risk assessment, and auditors will ask why a control is included or excluded, not just whether a policy exists.

How does ISO 27701:2025 relate to the GDPR?

ISO 27701:2025 is a management framework that supports GDPR accountability, but it is not a GDPR certification in itself. Holding the certificate does not prove legal compliance; it shows that you run a structured system to manage privacy obligations and risks.

The GDPR requires controllers to implement appropriate measures and be able to demonstrate compliance (Article 24), and to apply data protection by design and by default (Article 25). Formal GDPR certification is a separate route under Articles 42 and 43: schemes must be approved by a supervisory authority or the EDPB, and the EDPB keeps a register of approved certification mechanisms, seals and marks.

That said, the PIMS maps well to day-to-day GDPR work. The table below shows where the standard’s outputs typically become GDPR evidence.

If your records and assessments already live in structured tools, such as a digital ROPA and a DPIA workflow, much of your PIMS evidence already exists. Our guides to the GDPR record of processing activities and running a DPIA under the GDPR cover those building blocks.

How does ISO 27701 help in the EU, UK and US?

The standard is the same everywhere, but its value differs by market: in the EU and UK it supports statutory accountability, while in the US it mainly works as customer assurance across a patchwork of state laws.

For multi-jurisdiction programmes, the PIMS gives you one set of processes, and each law becomes a set of requirements mapped to it. Tools such as cross-framework control mapping help show which PIMS controls satisfy which obligations in each country.

Want to see ISO 27701, ISO 27001 and the GDPR mapped in one workspace? Start your 14-day free trial of Enactia’s AI-powered GRC platform, no credit card needed.

What is the ISO 27701:2025 transition deadline?

Transition timelines are set by accreditation bodies. In the UK, UKAS requires certification bodies to transition all certified clients to the 2025 edition by 31 October 2028. Check your certification body’s own timetable, which may be earlier.

The UKAS technical bulletin on PIMS transition records that ISO/IEC 27701:2025 and ISO/IEC 27706:2025 were published on 14 October 2025, that UKAS aims to complete the transition of accredited certification bodies by 31 October 2027, and that those bodies must transition their certified clients by 31 October 2028. ISO/IEC 27706:2025 sets the requirements that certification bodies auditing a PIMS must meet.

Other accreditation bodies publish their own arrangements, so organisations certified outside the UK should ask their certification body which dates apply.

How do you implement or transition to ISO 27701:2025?

Start with a gap assessment against the 2025 clauses and Annex A, decide whether to run the PIMS standalone or integrated with your ISMS, then close gaps, run an internal audit and management review, and book the certification or transition audit.

Step-by-step plan

1. Buy the standard and brief leadership. Confirm who sponsors the PIMS and whether it will be standalone or integrated with ISO 27001.
2. Define scope and roles. List the services, entities and systems in scope, and whether you act as controller, processor or both for each processing activity.
3. Run a gap assessment. Compare current practice with clauses 4 to 10 and the Annex A controls relevant to your role. For 2019 holders, focus on the new clause structure and the reorganised controls.
4. Update the privacy risk process. Make sure risks to data subjects, not only to the organisation, are identified, evaluated and treated.
5. Refresh the statement of applicability. Justify each included and excluded Annex A control.
6. Update policies and procedures. Align your privacy policy, DSAR, DPIA, breach and processor procedures with the new structure.
7. Review processors. Check contracts and assurance for sub-processors, using a vendor risk management process to track evidence and renewals.
8. Train and communicate. Record competence for privacy roles and awareness for wider staff.
9. Audit and review. Run an internal audit and a management review before the external audit.
10. Book the audit. Agree with your certification body whether the transition happens at a surveillance audit, a recertification, or a special visit.

Organisations that already run an ISO 27001 programme can reuse much of steps 1, 7, 8 and 9. A shared risk register, internal audit programme and management review for both systems avoids duplicated effort. For GDPR-specific depth, keep your GDPR compliance workspace linked to the PIMS rather than running it separately.

Key takeaways

• ISO/IEC 27701:2025 (edition 2, October 2025) replaced the 2019 edition and is now a standalone PIMS standard.
• It uses the harmonised clause structure and Annex A controls for controllers, processors and both.
• It supports GDPR accountability but is not a GDPR Article 42 certification.
• In the UK, certified clients must be transitioned by 31 October 2028; confirm your own certification body’s timetable.
• Integrating the PIMS with ISO 27001 and your ROPA, DPIA and vendor processes avoids duplicated work.

Frequently asked questions

Do I still need ISO 27001 to get ISO 27701 certified?
No. Under the 2025 edition, ISO 27701 is a standalone management system standard, so an organisation can be certified against it without holding ISO 27001. Many organisations still integrate the two, because a PIMS relies on sound information security controls and a combined system avoids duplicated audits, risk registers and management reviews.

Is ISO 27701 certification the same as GDPR certification?
No. GDPR certification mechanisms under Articles 42 and 43 must be approved by a supervisory authority or the EDPB, and they are listed in the EDPB register. ISO 27701 is an international management system standard. It helps demonstrate accountability, but it does not in itself certify that processing complies with the GDPR.

What happens to my ISO 27701:2019 certificate?
It remains valid during the transition period set by your accreditation and certification bodies, after which it must be replaced by a 2025 certificate. In the UK, UKAS requires certification bodies to transition all certified clients by 31 October 2028. Plan the transition around an existing surveillance or recertification audit to save cost.

Does ISO 27701 apply to processors as well as controllers?
Yes. The standard covers PII controllers and PII processors. Annex A groups controls into those for controllers, those for processors and those that apply to both. A cloud or SaaS provider acting as a processor for most services would select mainly processor controls, plus controller controls for its own employee and marketing data.

How long does ISO 27701 implementation take?
It depends on scope, maturity and whether you already run ISO 27001. An organisation with a mature ISMS, a current ROPA and working DPIA and DSAR processes will mostly be closing gaps. An organisation starting from scratch will need to build the management system, risk process and evidence first, which takes considerably longer.

Is ISO 27701:2025 worth it for your organisation?

If customers ask how you manage privacy, if you act as a processor for regulated clients, or if you operate across several jurisdictions, ISO 27701:2025 gives you an internationally recognised way to show it. The 2025 edition makes that route open to privacy-led organisations, not only those with an ISO 27001 certificate, while rewarding those who integrate both.

To plan your PIMS, map it to the GDPR and ISO 27001, and keep evidence in one place, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.