ISO/IEC 27701:2025 · Privacy information management system · Certifiable standard
What is ISO 27701?
ISO/IEC 27701 is the international standard for a privacy information management system, or PIMS: the governance, controls and records an organisation runs to handle personally identifiable information as a controller or processor. The second edition, published in October 2025, is an independent management system standard that can be certified on its own and is built to align with ISO/IEC 27001.
Sources: ISO/IEC 27701:2025, Privacy information management systems: Requirements and guidance, ISO; ISO/IEC 27001:2022, Information security management systems: Requirements, ISO; NABCB News Updates, May 2026: standalone accreditation for ISO/IEC 27701 PIMS; Regulation (EU) 2016/679 (GDPR), Art. 28 and Art. 42, EUR-Lex
Key facts
| Owner | ISO and IEC, joint technical committee JTC 1/SC 27 (information security, cybersecurity and privacy protection) |
|---|---|
| Published | October 2025 (second edition, 64 pages). The first edition, ISO/IEC 27701:2019, was an extension to ISO/IEC 27001 and ISO/IEC 27002 and could only be certified together with an ISO 27001 certificate |
| What changed in 2025 | ISO describes the 2025 edition as an independent management system standard. It no longer sits as an add-on to an ISMS certificate, although it keeps the same clause structure and is written to align with an existing ISO/IEC 27001 system. Accreditation bodies have begun to accredit PIMS certification separately from ISMS |
| Structure | Management-system clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation, improvement) with privacy-specific requirements and guidance, and control sets for organisations acting as PII controllers and as PII processors. The standard is aimed at both roles and at public, private and not-for-profit organisations alike |
| What is mandatory | A PIMS scope that states whether you act as a PII controller, a PII processor or both; a privacy risk assessment that considers harm to the people whose data you hold as well as to the organisation; PIMS objectives; the controls that apply to your role, documented and justified; internal audit and management review. Where you already run an ISMS, the risk method, audit programme and management review are shared |
| Certificate | Three years, with a Stage 1 and Stage 2 initial audit, a surveillance audit each year and recertification before expiry, on the same cycle as ISO 27001. Certification is quicker where an ISO 27001 ISMS already runs, because the management system clauses are shared and only the privacy risk assessment and privacy controls are new. |
| Accreditation | NABCB launched a standalone accreditation scheme for PIMS certification bodies against ISO/IEC 27701:2025 in May 2026, with its Accreditation Criteria for PIMS (April 2026); bodies now apply for PIMS accreditation separately from ISMS. |
| Who certifies in India | Not published yet. Infofacility will add this once it is sourced and checked. |
| Cost in India | Not published yet. Infofacility will post an Indian price range, with what it covers, once it has three comparable quotes. |
| Pairs with | ISO 27001 (same clause structure, one integrated audit), GDPR (the controller and processor controls track its obligations, though a certificate is not an Art. 42 certification), the DPDP Act 2023 and its Rules, and the privacy category of SOC 2 |
Who needs it
- ISO 27701 is for organisations that handle personal data for others or at scale and need to show how they govern it. In India that means IT services and BPO companies processing EU, UK or US customer data, SaaS providers whose customers sign data processing agreements, healthcare and fintech platforms, and the Indian captive centres of foreign groups. The buyer is usually a European or multinational customer whose own GDPR obligations under Art. 28 require it to check its processors, and who prefers a certificate to a questionnaire.
- Nobody in India is required to hold it. The DPDP Act 2023 and the Rules notified under it set duties for data fiduciaries and processors, including reasonable security safeguards and breach notification, without naming a standard. A PIMS gives those duties an owner, a risk assessment and an audit trail, which is why Indian companies preparing for the Act's phased commencement have started treating ISO 27701 as the privacy counterpart of the ISO 27001 certificate they already hold.
- The 2025 edition changed who can start. Under the 2019 edition you needed an ISO 27001 certificate first. The 2025 edition is an independent management system standard, and NABCB now accredits PIMS certification on its own, so a company whose main exposure is privacy rather than security can scope a PIMS directly. Most still do both, because the controls overlap and one audit is cheaper than two.
How certification works
Step 1
Decide your role and the scope
Controller, processor or both, for which processing, in which business units. An Indian BPO is mostly a processor; a consumer app is a controller; many SaaS companies are both. The role determines which control set applies.
Step 2
Map the personal data
What you collect, from whom, why, where it sits, who sees it, where it goes (including sub-processors and cross-border transfers). The map feeds the risk assessment and the records your customers and regulators will ask for.
Step 3
Assess privacy risk
Extend the ISMS risk method, or build one, to look at harm to the people whose data you hold as well as harm to the company. Record the treatment decisions and the controls you choose, with the justification for any you leave out.
Step 4
Implement the privacy controls
Consent and purpose records, notices, rights handling, retention and deletion, privacy by design in development, processor and sub-processor contracts, transfer safeguards, breach handling. Line each control up with the GDPR article or DPDP section it serves so the evidence does double duty.
Step 5
Audit yourself and hold a management review
Run the internal audit against the PIMS requirements and review the results with top management. If you already hold ISO 27001, fold both into the same programme.
Step 6
Stage 1 and Stage 2 with an accredited body
Pick a certification body whose accreditation covers ISO/IEC 27701:2025. If you hold ISO 27001 with the same body, ask for an integrated audit; the shared clauses are audited once.
Step 7
Keep it alive
Surveillance each year, recertification in year three. New processing, a new sub-processor or a new country of transfer goes through the privacy risk assessment before it starts.
Get there with Infofacility
GRC · Infofacility service
ISO 27701 privacy management
A privacy information management system, on its own or beside your ISO 27001, mapped to DPDP and GDPR. 2 to 4 months.
Request a callbackQuestions
Do we need ISO 27001 before ISO 27701?
Not under the 2025 edition, which ISO describes as an independent management system standard; NABCB now accredits PIMS certification separately from ISMS. Under the 2019 edition you did, because it was an extension to ISO 27001. Whether a particular certification body will certify a PIMS on its own depends on its accreditation scope, so ask before you plan.
Does ISO 27701 make us GDPR compliant?
It organises the work and gives EU customers an audited answer to their Art. 28 due diligence, but a certificate is not compliance and is not a GDPR certification under Art. 42, which requires a scheme approved by a supervisory authority or the EDPB. Treat it as evidence of a working privacy programme, not as a legal finding.
Does it help with the DPDP Act 2023?
Yes, as a way of organising the duties. The Act and its Rules require reasonable security safeguards, breach notification, consent management, retention limits and rights handling; a PIMS gives each an owner, a control and evidence. The Act does not require or recognise any certificate, so the value is in the programme, not the paper.
What happens to our ISO 27701:2019 certificate?
It stays valid until the transition period for the 2019 edition ends. As of this review the accreditation bodies had not published the transition deadline; expect your certification body to move you to the 2025 edition at a surveillance or recertification audit. Check the date with your body and with NABCB.
Change log
4 Nov 2026 First version.
This page explains the law in plain English. It is not legal advice.
Weekly · Watching 6 regulators