ISO 27701: running a privacy management system auditors can certify

What a privacy information management system contains

A PIMS treats privacy the way ISO 27001 treats information security: as a managed system with a defined scope, leadership commitment, a risk process, controls, internal audit and management review. The difference is the object of protection. ISO 27001 protects information; 27701 protects people whose PII you hold, and asks you to show which role you play for each kind of processing.

PII

Personally identifiable information: any information that can identify the person it relates to, directly or indirectly.

PII principal

The person the PII relates to. GDPR calls this the data subject.

PII controller

The organisation that decides the purposes and means of processing PII.

PII processor

The organisation that processes PII on behalf of, and on the instructions of, a controller.

PIMS

Privacy information management system: the management system 27701 specifies.

The 2019 and 2025 editions

Most existing certificates and many implementation guides still refer to the 2019 edition, so it helps to know both shapes.

Controller duties and processor duties

27701 asks you to decide, for each processing activity, whether you act as a controller, a processor or both. Many organisations are both: a controller for their own employee and customer data, and a processor for the data their customers load into their service. The controls you must address depend on the role.

• As a controller: identify and document the purpose and lawful basis of each processing activity, obtain and record consent where it is the basis, run privacy impact assessments, give notices, and honour the rights of PII principals.
• As a processor: process only on documented instructions, help the controller meet its obligations, control the use of subprocessors, and return or dispose of PII when the contract ends.
• Both roles: limit collection and retention to what the purpose needs, secure transfers, and keep records that show what you did.

How certification works

Certification follows the familiar management system pattern: a stage one review of your documentation and scope, a stage two audit of how the system operates, then surveillance audits and recertification on the certification body's cycle. ISO/IEC 27706:2025 sets the requirements for bodies that audit and certify a PIMS, so check that your certification body is accredited for 27701.

Under the 2019 edition, a 27701 certificate is issued together with, or as an extension of, an ISO 27001 certificate. Under the 2025 edition it can stand on its own, though many organisations will still certify both and run a combined audit.

How ISO 27701 relates to ISO 27001, ISO 27018 and GDPR

ISO 27001 is the information security management system. Much of a PIMS rests on the same security controls, so a team running ISO 27001 already has a large share of the evidence a 27701 audit asks for.

ISO/IEC 27018 is a code of practice for protecting PII in public clouds where the cloud provider acts as a processor. It is guidance rather than a management system, and suits cloud providers who want to show processor-side privacy controls.

GDPR is law. Organisations commonly use 27701 to structure and evidence their GDPR accountability, because its controller and processor controls follow the same ideas. A 27701 certificate is not itself proof of GDPR compliance, and it is not a GDPR certification mechanism unless approved as one.