ISO 27701 Transition cheat sheet

ISO/IEC 27701:2025 replaces the 2019 edition and is a standalone management system standard for privacy information management, no longer a sector extension of ISO/IEC 27001 and 27002.

The 2025 edition is structured for use alongside ISO/IEC 27001:2022 and ISO/IEC 27002:2022; references to the 2013 annex structure of 27001/27002 no longer apply.

Core structure: clauses 4-10 mirror the harmonized management-system clause layout (context, leadership, planning, support, operation, performance evaluation, improvement) plus privacy-specific requirements.

Two role-based annexes carry the normative privacy guidance: one for PII controllers and one for PII processors; organizations determine applicability by role.

The standard applies to any organization type and size that processes PII as a controller, a processor, or both, within a privacy information management system (PIMS).

A PIMS extends an ISMS: ISO/IEC 27701 does not replace ISO/IEC 27001; certification to 27701 is normally pursued as an extension of a 27001-certified ISMS.

Privacy principles embedded include lawfulness and fairness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.

Relationship to law: the standard is technology- and jurisdiction-neutral; it does not itself create legal compliance, it provides a framework to support obligations such as GDPR, PIPL, LGPD or CCPA.

Clause 4 (Context): requires determining external and internal issues, interested parties, and the scope of the PIMS, with explicit consideration of privacy obligations and the organization's role as controller or processor.

Clause 5 (Leadership): top management must demonstrate leadership and commitment to the PIMS, establish a privacy policy, and assign roles, responsibilities and authorities for privacy.

Clause 6 (Planning): risk and opportunity planning now explicitly addresses privacy risk to individuals (PII principals), not only organizational information-security risk; privacy objectives must be set and planned.

Clause 7 (Support): adds privacy competence, awareness and communication requirements, and requires documented information for the PIMS to be controlled, including PII-related records.

Clause 8 (Operation): requires operational planning and control of PII processing, privacy impact assessments, and controls selected from the role-specific annexes; outsourced or outsourced-to-processor activities must be controlled.

Clause 9 (Performance evaluation): requires monitoring, measurement, analysis and evaluation of privacy performance, internal audit of the PIMS, and management review with privacy-specific inputs and outputs.

Clause 10 (Improvement): requires handling nonconformities and corrective actions related to privacy, plus continual improvement of the PIMS suitability, adequacy and effectiveness.

Documented information: the 2025 edition consolidates and clarifies required documented information across clauses, reducing duplication and aligning with the 27001:2022 Annex A/Clause 7.5 approach.

Transition impact: existing 27701:2019 controls mapped to 27001:2013 Annex A must be re-mapped to 27001:2022 Annex A (93 controls in 4 themes) and to the new 27701:2025 annex structure.