Foundations of ISO/IEC 27701:2025
What this domain tests
The Foundations domain checks whether you understand what ISO/IEC 27701:2025 is, what it extends, who it applies to, and how it relates to ISO/IEC 27001:2022 and ISO/IEC 27002:2022. Expect questions on the PIMS concept, roles, certification scope, and the 2025 edition's alignment with the 2022 ISMS standards.
Core rules and concepts
- ISO/IEC 27701:2025 is a privacy information management extension to ISO/IEC 27001:2022 and ISO/IEC 27002:2022. It does not replace either standard.
- It specifies PIMS requirements and guidance for organizations acting as PII controllers, PII processors, or both.
- A PIMS extends the ISMS: the organization reuses its ISMS processes and adds privacy-specific requirements, controls, and evidence.
- The 2025 edition follows the Harmonized Structure, integrates PIMS requirements into clauses 4–10, and consolidates PIMS-specific controls in Annex A.
- Certification to ISO/IEC 27701 is available as an extension to ISO/IEC 27001 certification; it is not a standalone management system standard in the same way as 27001.
- Key terms: PII, PII principal, PII controller, PII processor, privacy risk, and PIMS.
Worked example
An ISO/IEC 27001:2022-certified company wants to add ISO/IEC 27701:2025. It should define the PIMS scope, identify its controller/processor roles, perform a privacy risk assessment, select applicable Annex A controls, and integrate privacy objectives, monitoring, and internal audit into its existing ISMS. Reasoning: because 27701 is an extension, the company does not build a separate management system; it extends the ISMS and adds privacy-specific requirements and controls.
Traps that cost marks
- Treating 27701 as a replacement for 27001 rather than an extension.
- Mixing up PII controller and PII processor obligations.
- Assuming Annex A alone contains all PIMS requirements; clauses 4–10 also contain requirements.
- Believing 27701 certification proves legal compliance with GDPR or any privacy law.
- Using the 2019 clause and annex structure when answering 2025 questions.