ISO 27701 Transition common mistakes
ISO 27701 Transition · Understand the traps and how to avoid them.
Treating ISO/IEC 27701:2025 as a standalone management system standard and describing certification against 27701 alone, rather than as an extension of an ISO/IEC 27001 information security management system with an added privacy extension.
Candidates carry over habits from the 2019 edition, which was structured as an extension to 27001 and 27002 but was widely marketed as a standalone privacy certification; marketing language reinforces the wrong mental model, and the 2025 restructure into a self-contained document makes the confusion worse.
What to do instead
Memorise the architectural relationship: 27701:2025 is used together with 27001 (requirements) and 27002 (controls); the privacy-specific requirements and guidance are additive, and the ISMS clauses still govern. When a question asks 'what must an organisation have in place', anchor the answer in the 27001 ISMS first, then layer the privacy extension.
Assuming the 2025 revision added a new certifiable 'privacy management system' standard with its own clause 4-10 requirements that replace the ISMS context, leadership, planning and support clauses.
The 2025 edition restructured content so that privacy guidance appears alongside each management clause, which reads superficially like a full standalone standard; candidates skim the table of contents and infer replacement rather than extension.
What to do instead
Learn the mapping explicitly: for each of clauses 4-10, know which part is the 27001 requirement being applied and which part is 27701 privacy-specific addition or guidance. Practise stating, for a given clause, 'the ISMS requirement is X; the privacy extension adds Y'.
Confusing the roles of PII controller and PII processor when answering questions about which obligations attach to the organisation, and applying controller obligations to a processor (or vice versa).
The 2019 edition had separate control sets in Annex A (controllers) and Annex B (processors); candidates memorised annex letters and control IDs, and the 2025 edition re-presents this material as privacy-specific guidance rather than parallel annexes, so the old memorised anchors no longer map cleanly.
What to do instead
Rehearse the distinction functionally: a controller determines the purposes and means of processing; a processor processes on behalf of and on the instructions of a controller. For each guidance area (lawful basis, consent, PII subject rights, breach notification, transfer), state in one sentence what changes when you are the processor. Drop annex-letter memorisation.
Answering questions about the 2025 changes from memory of secondary summaries, asserting specific clause numbers or control counts that the candidate cannot actually verify.
Transition exams reward precision about what changed, and candidates rely on blog posts and vendor webinars that paraphrase or simplify; under time pressure they convert a vague recollection into a confident but wrong clause reference.
What to do instead
Build a one-page change log in your own words covering only the changes you can source from the standard's own introduction and scope text, and mark anything else as 'verify'. In the exam, prefer answers phrased around intent and structure over invented clause numbers.
Treating the privacy-specific guidance in clauses 4-10 as optional good practice that can be skipped if the organisation already has a 27001 certificate.
Because 27701 is an extension, candidates reason that the 'real' requirements are all in 27001 and the privacy text is explanatory; the guidance-style formatting of the 2025 edition reinforces the impression that nothing is binding.
What to do instead
Distinguish carefully between normative requirements ('shall') and guidance ('should'/'consider'), and remember that to claim conformity with 27701 the organisation must implement the privacy-specific requirements as part of its ISMS scope. Prepare by tagging each privacy topic as requirement or guidance and justifying the tag.
Missing the extended scope of 'PII' in the 2025 edition, for example still treating the standard as covering only customer or employee data held in obvious systems, and ignoring pseudonymised data, data held by suppliers, or data in development and test environments.
The 2019 edition's terminology and examples were narrower and heavily consumer-facing; candidates reuse those examples and fail questions that probe the boundary of what counts as PII and where it can reside.
What to do instead
Work through the definition of PII and related terms (PII principal, PII controller, PII processor, pseudonymisation) and then deliberately list non-obvious locations: backups, logs, analytics, test data, supplier systems, HR records. Practise classifying borderline items as PII or not, with a reason.
Answering clause 6 planning questions with generic risk-management language and omitting the privacy-specific requirement to assess risks to PII principals (individuals), not only risks to the organisation.
Candidates are trained on 27001 risk assessment, which centres on information security risks to the organisation; the privacy lens inverts the perspective, and under exam pressure the familiar framing wins.
What to do instead
For every risk question, write two lines: the risk to the organisation and the risk to the PII principal (harm such as discrimination, reputational damage, financial loss, physical harm). Check that your chosen answer mentions impact on individuals where the question concerns privacy risk.
Collapsing the two distinct roles in clause 5 leadership, assuming top management accountability for the ISMS automatically satisfies the privacy-specific leadership expectations, and ignoring the need for assigned privacy responsibilities and reporting.
The 2025 structure places privacy content under the same clause headings as the ISMS, so candidates assume one leadership commitment covers both; they also under-weight the requirement for defined roles and accountability for PII protection.
What to do instead
Study clause 5 as two layers: the 27001 leadership requirements (policy, roles, commitment) and the privacy additions (privacy policy integrated with the ISMS, assigned responsibility and authority for PII protection, direction and support for privacy). Be ready to name who is accountable and how performance is reviewed.
Ignoring the interaction between clauses 8 and 9 when answering operational questions, for example describing PII processing operations without linking them to the risk treatment plan, or describing monitoring without linking it to privacy objectives and internal audit scope.
Candidates revise clause by clause and never practise cross-clause reasoning; transition exams increasingly ask scenario questions that require connecting operation, performance evaluation and improvement.
What to do instead
Practise 'thread' questions: take one privacy control (for example, managing PII subject access requests) and trace it through planning (objective, risk treatment), operation (procedure, records), performance evaluation (metric, audit), and improvement (nonconformity, corrective action). Answer scenario questions using that thread.
Failing to recognise that the 2025 edition provides privacy-specific guidance mapped to the 27002 control themes (organisational, people, physical, technological) and answering control questions with a flat list of privacy activities disconnected from those themes.
The 2019 annexes grouped controls by controller/processor role, so candidates memorised that grouping; the 2025 alignment to the 27002 structure means the same privacy topic can appear under a different heading, and candidates cannot locate it.
What to do instead
Rebuild your mental index by 27002 theme: for each theme, list the privacy-relevant controls and the PII-specific guidance attached to them (for example, supplier relationships under organisational, remote working under people/physical, logging and access control under technological). Test yourself by naming the theme for a given privacy activity.