What Is ISO 27701? 2025 Edition, Certification, Transition

ISO/IEC 27701:2025 is the second edition of the international standard for privacy information management systems (PIMS). ISO published it on 14 October 2025 and withdrew the 2019 edition on the same day. The headline change is its status: ISO/IEC 27701 is now an independent management system standard, not an extension to ISO/IEC 27001, so an organisation can build and certify a PIMS on its own. The full title is "Information security, cybersecurity and privacy protection: Privacy information management systems: Requirements and guidance".

This guide explains what changed, how certification works with or without ISO/IEC 27001, how current 2019 certificate holders can plan their transition and where the standard sits alongside UK data protection law. For details of the certification service, see ISO 27701 certification.

What is ISO 27701?

ISO/IEC 27701 is the international standard for privacy information management systems. According to the IEC abstract, it "specifies requirements for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS)". The abstract says it is "intended for personally identifiable information (PII) controllers and PII processors" and is "applicable to all types and sizes of organizations".

In practice, a PIMS is the set of policies, processes and controls an organisation uses to manage how it handles personal data. The current version is the 2025 edition, published on 14 October 2025.

What is the difference between ISO 27001 and ISO 27701?

ISO/IEC 27001 protects information; ISO/IEC 27701 manages privacy obligations. An information security management system (ISMS) under ISO/IEC 27001 protects an organisation's information assets. A PIMS under ISO/IEC 27701 manages the obligations that come with processing personally identifiable information (PII), whether the organisation acts as a PII controller, a PII processor or both.

The two overlap, because you cannot protect personal data without sound security. The difference is the question each one asks. An ISMS asks whether information is secure. A PIMS asks whether personal data is processed in line with the organisation's obligations as a controller or processor, and whether that is managed and improved over time.

Many organisations will still run both. The 2025 edition simply means privacy no longer has to be bolted on to an ISMS. If you also need an ISMS, see ISO 27001 certification.

What changed between the 2019 and 2025 editions

The 2025 edition turns ISO/IEC 27701 from an add-on into a management system standard in its own right. The 2019 edition described a PIMS "in the form of an extension to ISO/IEC 27001 and ISO/IEC 27002". The 2025 edition specifies its own requirements for a PIMS and, according to ISO's FAQ, can be used alone "as it is an independent management system standard (MSS)".

Some of the detail below comes from ISO's catalogue. The rest is reported by certification bodies and specialist guides, and is marked as such, because this guide has not checked it against the purchased text of the standard.

Two points matter most in practice. First, ISO/IEC 27001 is no longer a prerequisite for certification to the 2025 edition, as reported by certification bodies and supported by ISO's independent MSS wording. Second, the reported reorganisation of Annex A into controller, processor and shared security tables means a 2019 Statement of Applicability will not carry across unchanged.

How to get ISO 27701 certified

You can certify a PIMS on its own or as part of an integrated system with ISO/IEC 27001. The standard is "applicable to all types and sizes of organizations", and the same core steps apply on either route.

• Standalone PIMS. Suitable if you do not hold ISO/IEC 27001, or want privacy certified separately. You build the PIMS, including the security controls it needs, without an ISMS underneath it.
• Integrated with ISO/IEC 27001. Suitable if you already run an ISMS or plan to. Shared processes such as risk assessment, internal audit and management review can serve both standards. The page on integrated management systems explains how combined audits work.

Illustrative image, AI-generated.

The steps below follow the logic of a management system standard. They are a planning outline, not a substitute for the requirements in the standard itself.

1. Define the scope. Decide which parts of the organisation, which services and which processing activities the PIMS covers. A scope that matches how personal data actually flows is easier to audit.
2. Confirm your roles as controller or processor. For each processing activity, record whether you act as a PII controller, a PII processor or both. Your role decides which reported Annex A tables apply.
3. Build a PII inventory. List the personal data you process, where it comes from, where it goes and who can access it. Data-flow maps are a practical way to find gaps.
4. Run a privacy risk assessment. Assess risks to individuals and to the organisation from your processing, and decide how to treat them.
5. Select controls and prepare a Statement of Applicability (SoA). Record which controls apply, which do not and why.
6. Run an internal audit. Check that the PIMS meets the standard and works as described.
7. Hold a management review. Top management reviews performance, audit results and risks, and decides on improvements.
8. Complete the certification audit. Stage 1 checks whether the PIMS is ready for audit. Stage 2 assesses whether it works in practice across the scope.

Before you book a certification audit, an online ISO gap analysis offers a structured self-assessment of where your system stands; it is not consultancy.

Transitioning from the 2019 edition

If you hold a 2019 certificate, plan a gap analysis first and confirm your deadline with your certification body before you book a transition audit. ISO withdrew the 2019 edition on 14 October 2025, and existing certificates move across under transition arrangements set by accreditation bodies.

ISO 27701 and UK data protection milestones. Sources: ISO; legislation.gov.uk; ICO; UKAS dates as reported. Diagram by UniCert.

In the UK, the UKAS Technical Bulletin, "Transition Arrangements for Privacy Information Management Systems (PIMS)", was reportedly published in March 2026. Its dates are reported by Assent Risk Management as 31 October 2027 for certification bodies and 31 October 2028 for certified organisations. This guide has not verified them from the bulletin itself, and they are not binding on UniCert clients. UniCert is accredited by the United Accreditation Foundation (UAF), not by UKAS. UniCert will confirm the deadline that applies to your certificate under its accreditation; ask us before planning your transition audit.

A practical sequence for current holders:

1. Run a gap analysis against the correspondence annex. The reported Annex F maps the 2019 edition to the 2025 edition. Use it to find requirements and controls that are new, moved or changed.
2. Update the Statement of Applicability. Rebuild it around the reported A.1, A.2 and A.3 tables, and check that each justification still holds.
3. Set up the PIMS risk process. If your privacy risks sat inside the ISMS risk assessment, make sure the PIMS now has its own privacy risk process, or a shared one that clearly covers privacy.
4. Review PIMS objectives. Set or update measurable privacy objectives and assign owners.
5. Hold a management review. Record decisions on the transition, resources and any remaining gaps.
6. Plan the transition audit. Transition audits usually take place at a surveillance audit or at recertification, but your certification body sets the timing.

Illustrative scenario (not a real organisation or UniCert client). A UK SaaS company processes customer personal data as a PII processor and holds a 2019 ISO/IEC 27701 certificate alongside ISO/IEC 27001. It keeps the integrated route, runs a gap analysis against the correspondence annex (reported as Annex F), rebuilds its Statement of Applicability around the processor table and the shared security table (reported as A.2 and A.3), updates its privacy risk assessment, and asks its certification body to schedule the transition audit at the next surveillance visit.

If you also run, or plan to run, an ISMS alongside your PIMS, the ISO 27001 certification guide for UK SMEs covers that side of the system.

Illustrative image, AI-generated.

ISO 27701 and UK data protection law

ISO/IEC 27701 is a management framework, not the law. In the UK, the legal duties sit in the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. A PIMS helps you organise how you meet those duties and keep evidence that you do.

The Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Under the Commencement No. 6 Regulations 2026 (SI 2026/82), most of its Part 5 data protection changes came into force on 5 February 2026. Section 103, on data subject complaints, followed on 19 June 2026.

The ICO has explained what the complaints duty means: controllers must provide a way for people to complain and must acknowledge complaints within 30 days. The ICO also said that all outstanding provisions are now in force.

The Information Commission

On 30 September 2026 the Information Commissioner's functions transferred to the Information Commission. The government says the regulator's role and powers are unchanged, and it is still known as the ICO.

ISO 27701 and UK GDPR Article 42 certification

ISO/IEC 27701 is not an approved UK GDPR certification scheme. Article 42 of the UK GDPR allows approved certification schemes, and the ICO keeps a register of approved criteria, such as ADISA, Age Check and Age Appropriate Design. ISO/IEC 27701 is not among them, so it can support, but does not prove, compliance.

Even an approved scheme would not shift legal duties. Article 42(4) states that certification "does not reduce the responsibility of the controller or the processor".

The reported Annex D also maps the standard to the EU GDPR, not the UK GDPR. There is no UK-specific ISO mapping, so UK organisations should check their own obligations directly against UK law.

Illustrative image, AI-generated.

Using your PIMS as evidence

A PIMS gives you a structured place to keep records that UK law already expects. Two examples:

• The complaints process. Document how people can complain, how complaints are logged and how you meet the 30-day acknowledgement duty. Internal audit can then test whether the process works.
• Processor assurance under Article 28. Controllers carry out due diligence on the processors they use. A processor's PIMS records, or its certificate and scope, can form part of that evidence, alongside contract terms and the controller's own checks.

Who benefits from ISO 27701

Any organisation that processes personal data can use ISO/IEC 27701, but some gain more than others from certification.

• PII controllers. Organisations that decide why and how personal data is processed can use the controller controls to structure their privacy programme and show it to boards, customers and partners.
• PII processors. Service providers that process data for clients can use the processor controls to answer due diligence questions with a single, independently audited system.
• Cloud and SaaS providers. Providers that host or process personal data in the cloud may pair a PIMS with ISO/IEC 27018 certification for cloud-specific PII protection.
• Supply chains. Where customers run Article 28 due diligence on processors, a certified PIMS gives them a consistent starting point for their checks.
• Organisations without ISO/IEC 27001. Since the 2025 edition, these organisations can certify a PIMS alone or build it into an integrated system later.

Frequently asked questions

Can ISO 27701 be used without ISO 27001?

Yes. ISO's FAQ says ISO/IEC 27701 can be used alone "as it is an independent management system standard (MSS)". Certification bodies also report that ISO/IEC 27001 is no longer a prerequisite for certification to the 2025 edition. You can still integrate the two if you run both.

Is ISO 27701 a UK GDPR certification?

No. It is not an ICO-approved certification scheme under Article 42 of the UK GDPR. It can support your compliance by organising your processes and evidence, but it does not prove compliance, and under Article 42(4) certification "does not reduce the responsibility of the controller or the processor".

When must 2019 certificates transition?

It depends on the accreditation behind your certificate. UKAS has reportedly published transition arrangements under which certified organisations are reported to have until 31 October 2028. UniCert will confirm the deadline that applies to your certificate under its accreditation; ask us before planning your transition audit.

Who needs ISO 27701?

The standard is written for PII controllers and PII processors and is applicable to all types and sizes of organisations. Certification tends to suit those that want an independently audited privacy management system, especially service providers, cloud and SaaS businesses and suppliers facing customer due diligence.

Planning your ISO 27701 next steps

ISO/IEC 27701:2025 gives privacy its own management system, with or without ISO/IEC 27001. If you are new to the standard, start by confirming your roles as controller or processor and building a PII inventory. If you hold a 2019 certificate, run a gap analysis against the correspondence annex and confirm your transition deadline with your certification body before you book an audit.

Training can help your team carry the work forward. The ISO 27701 internal auditor course covers auditing your own PIMS, and the ISO 27701 lead auditor course covers leading audits. When you are ready to discuss certification or a transition audit, you can request a quote.

About this guide

• Written by: Ersin Çetin, UniCert Certification. Ersin writes UniCert's guides to ISO management system standards and certification.
• Editorial process: This article was prepared with AI assistance and draws on the standards catalogues, legislation and public guidance listed below. Details marked "reported" come from certification bodies and specialist guides and were not checked against the purchased text of ISO/IEC 27701:2025 or the UKAS bulletin. The four photo-style images, including the header image, are AI-generated illustrations, not pictures of real people or events. This guide is general information, not legal advice.
• Interests: UniCert is a certification body accredited by UAF, not UKAS. It offers ISO/IEC 27701 certification and ISO 27701 auditor training.
• Questions or corrections: contact UniCert.
• Facts last checked on 23 October 2026. Legislation references are to the versions published on legislation.gov.uk on that date.

Sources

• ISO. ISO/IEC 27701:2025 Information security, cybersecurity and privacy protection: Privacy information management systems: Requirements and guidance. Edition 2, 14 October 2025.
• IEC Webstore. ISO/IEC 27701:2025. Abstract.
• ISO. ISO/IEC 27701:2019. Withdrawn 14 October 2025.
• ISO. ISO/IEC 27706:2025. Requirements for bodies providing audit and certification of PIMS. 14 October 2025.
• UKAS. Transition Arrangements for Privacy Information Management Systems (PIMS). Technical Bulletin, March 2026. Dates as reported by Assent Risk Management, 13 April 2026.
• Data (Use and Access) Act 2025 (c. 18). legislation.gov.uk.
• The Data (Use and Access) Act 2025 (Commencement No. 6) Regulations 2026 (SI 2026/82). legislation.gov.uk.
• ICO. New data protection complaints law now in force. 23 June 2026.
• GOV.UK. Information Commission succeeds the ICO as UK's data protection regulator. 30 September 2026.
• UK GDPR, Article 42 (certification). legislation.gov.uk.
• ICO. Certification scheme register.
• Annex A control counts reported by ISMS.online and Linford; no ISO/IEC 27001 prerequisite reported by Amtivo and NQA.