ISO 27701 Transition flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

ISO/IEC 27701:2025

Standalone international standard specifying requirements and guidance for a privacy information management system (PIMS) that extends an ISMS, applicable to organizations acting as PII controllers, processors, or both.

PIMS

Privacy Information Management System: the management-system framework of policies, objectives, processes and controls an organization uses to protect PII and demonstrate privacy accountability, built on ISO/IEC 27001.

PII controller

The organization that alone or jointly with others determines the purposes and means of processing personally identifiable information; the 2025 standard provides a dedicated annex of guidance for this role.

PII processor

The organization that processes personally identifiable information on behalf of and under the instructions of a PII controller; the 2025 standard provides a separate annex of guidance for this role.

PII principal

The individual to whom personally identifiable information relates; the 2025 edition places explicit emphasis on privacy risk to these individuals, not only organizational risk.

Relationship to ISO 27001

ISO/IEC 27701 does not replace ISO/IEC 27001; a PIMS builds on an ISMS, and 27701 certification is normally obtained as an extension of an existing 27001 certification.

2019 vs 2025 structure

The 2019 edition was an extension to 27001:2013 and 27002:2013 with annexes A and B; the 2025 edition is standalone and aligned to the 27001:2022 and 27002:2022 structure.

Role-based annexes

The 2025 edition organizes normative privacy guidance into annexes differentiated by role, one for PII controllers and one for PII processors, so organizations apply only the relevant guidance.

Privacy principles

Foundational principles such as lawfulness, fairness, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality and accountability that underpin the PIMS requirements and controls.

Jurisdictional neutrality

ISO/IEC 27701 does not create legal obligations itself; it provides a framework that organizations can map to laws such as GDPR, PIPL, LGPD or CCPA to support compliance.

Applicability of 27701

The standard applies to any organization regardless of type, size or sector that processes PII as a controller or processor and wishes to establish, implement and maintain a PIMS.

Clause 4 context

Requires the organization to determine external and internal issues, interested parties and PIMS scope, explicitly considering privacy obligations and its controller or processor role.

Clause 5 leadership

Requires top management to demonstrate commitment to the PIMS, establish a privacy policy, and ensure that privacy roles, responsibilities and authorities are assigned and communicated.

Clause 6 planning

Requires planning that addresses privacy risks and opportunities affecting PII principals, plus establishment of measurable privacy objectives and plans to achieve them.

Clause 7 support

Requires resources, privacy competence, awareness and communication, and control of documented information, including records related to PII processing and the PIMS.

Clause 8 operation

Requires operational planning and control of PII processing, including privacy impact assessments and implementation of controls from the applicable role-based annexes.

Privacy impact assessment

A structured assessment of the privacy risks to PII principals arising from processing activities, used to determine appropriate controls before and during processing.

Clause 9 performance evaluation

Requires monitoring, measurement, analysis and evaluation of privacy performance, internal audit of the PIMS, and management review with privacy-specific inputs and outputs.

Clause 10 improvement

Requires the organization to react to nonconformities, take corrective action to address their causes, and continually improve the suitability, adequacy and effectiveness of the PIMS.

Documented information

Information the PIMS requires to be maintained or retained as evidence, including privacy policies, risk assessments, processing records and audit results, controlled per clause 7.5.

Privacy policy

A top-level documented statement, established under clause 5, that sets the organization's privacy commitments, objectives and principles and provides a framework for setting privacy objectives.

Privacy objectives

Measurable targets established under clause 6 that reflect the organization's privacy commitments, are consistent with the privacy policy, and are monitored under clause 9.

Management review inputs

Privacy-specific inputs for management review, including audit results, nonconformities, performance against privacy objectives, interested-party feedback and risk assessment status.

Internal audit of PIMS

A planned, independent evaluation under clause 9 that verifies the PIMS conforms to the organization's own requirements and to ISO/IEC 27701, and is effectively implemented.

Nonconformity and corrective action

A clause 10 process for identifying PIMS nonconformities, evaluating their causes, implementing corrective actions, and reviewing their effectiveness to prevent recurrence.

Scope of the PIMS

The documented boundary and applicability of the privacy management system, defined under clause 4, considering roles, processing activities, locations and interfaces with third parties.

Interested parties

Stakeholders relevant to the PIMS, such as PII principals, regulators, customers and processors, whose requirements the organization must determine and consider in planning.

Outsourced processing control

Under clause 8, the organization must ensure that externally provided PII processing, including by processors or sub-processors, is controlled and consistent with its privacy commitments.

Competence and awareness

Clause 7 requirements that personnel whose work affects privacy are competent, understand the privacy policy, and are aware of their contribution to PIMS effectiveness.

Transition re-mapping

Moving from 27701:2019 to 2025 requires re-mapping controls from 27001:2013 Annex A to the 27001:2022 Annex A structure of 93 controls in four themes.

Monitoring and measurement

Clause 9 activity of determining what privacy performance is measured, the methods used, when measurement occurs, and who analyses and evaluates the results.

Continual improvement

The clause 10 outcome of ongoing enhancement of PIMS performance, achieved by acting on performance evaluation results, audit findings and changes in privacy risk.