Privacy Information Management System Requirements
Where the requirements live
In the 2019 edition, ISO/IEC 27701 is an extension to ISO/IEC 27001 and ISO/IEC 27002. Clauses 4 to 10 of ISO/IEC 27001 apply in full, with PIMS-specific extensions in clause 5 (requirements), clause 6 (guidance linked to ISO/IEC 27002), clause 7 (additional guidance for PII controllers) and clause 8 (additional guidance for PII processors). Annex A provides PIMS-specific control objectives and controls for controllers; Annex B for processors. Annex C maps to ISO/IEC 29100 and ISO/IEC 27018; Annex D maps the standard to the GDPR.
What the extensions add
The PIMS layer adds privacy roles and responsibilities, a privacy risk assessment that considers harm to individuals and is integrated with the ISMS risk assessment, privacy impact assessments, a privacy policy, privacy competence and awareness, and documented information such as records of PII processing, consent records and processor agreements. Because it is an extension, certification to the 2019 edition requires a certified ISO/IEC 27001 ISMS with an aligned scope. The revised 2025 edition restructures ISO/IEC 27701 as a standalone management system standard on the harmonized structure, usable alone or with ISO/IEC 27001 - confirm which edition your scheme targets.
Traps
Believing ISO/IEC 27701 replaces ISO/IEC 27001. Applying Annex A to a processor (use Annex B). Omitting Annex controls from the Statement of Applicability without justification. Treating privacy risk as identical to security risk: privacy risk weighs harm to PII principals, not only harm to the organization.
Rule of thumb: determine the organization's role for each processing activity first; the role decides which annex, which guidance clause and which safeguards apply.