Privacy information management system (PIMS)

A management system for the processing of personally identifiable information, built on the same clause structure as an ISMS and certified against ISO/IEC 27701. The second edition, published in October 2025, made ISO/IEC 27701 a stand-alone standard, so you no longer need an ISO/IEC 27001 certificate to hold one; the 2019 edition was an extension to ISO/IEC 27001 and is withdrawn. Annex A sets controls for PII controllers and PII processors, Annex B gives implementation guidance, and Annex D maps the controls to the GDPR, which makes a PIMS a practical scaffold for DPDP duties too.