Build an ISO 27701 privacy management system with less effort

ISO 27701:2025 is the international standard for a privacy information management system (PIMS). Published by ISO and IEC in October 2025, it sets requirements for establishing, implementing, maintaining and continually improving how an organisation manages personal data as a PII controller or processor. Unlike the 2019 edition, it is a standalone management system standard with its own clauses 4 to 10 and 78 Annex A controls.

The main change is that ISO 27701 is now standalone. The 2019 edition was an extension to ISO 27001 and ISO 27002, so certification required an ISMS. The 2025 edition follows the harmonised structure used by other ISO management system standards and moves its controls into Annex A: 31 controller controls, 18 processor controls and 29 information security controls, with implementation guidance in a separate annex.

No, not under the 2025 edition. ISO 27701:2025 can be certified on its own because it includes its own management system requirements and a set of information security controls in Annex A Table A.3. Many organisations still combine it with ISO 27001, because the two standards share the same structure and much of the same evidence, which keeps audits and documentation efficient.

No. ISO 27701 is a voluntary international standard and no law requires it. It is commonly requested by enterprise customers and in supplier due diligence, and it helps an organisation show it manages personal data accountably. Certification does not by itself prove compliance with the UK GDPR, EU GDPR or other privacy laws, but it provides a structured way to meet many of their expectations.

ISO 27701 supports GDPR compliance but does not replace it. GDPR is law, while ISO 27701 is a voluntary management system standard. The 2025 edition includes an informative annex mapping its controls to GDPR articles, so organisations can reuse the same privacy controls and evidence for both. It covers areas such as lawful basis, records of processing, data subject rights, processor contracts and privacy risk assessment.

Table A.1 contains 31 controls for PII controllers, the organisations that decide why and how personal data is processed. Table A.2 contains 18 controls for PII processors, which act on a controller's instructions. Table A.3 contains 29 information security controls that apply to both. An organisation selects the tables and controls relevant to its role and records its choices in a Statement of Applicability.

It depends on scope, existing maturity and whether you already hold ISO 27001. An organisation with a working ISMS can usually reuse much of its documentation, risk process and evidence, which shortens the effort. Certification itself follows the usual two-stage audit by an accredited certification body, followed by surveillance audits during the certificate cycle. Starting with a gap assessment against the 2025 clauses gives the clearest timeline.

Yes, on request. ISO 27701:2025 is mapped in OneClickComply's control library and available on request, rather than switched on by default. Once enabled, you can reuse controls and evidence from ISO 27001, GDPR or SOC 2, generate privacy policies, collect evidence automatically and get guidance from our in-house audit team. Certification is issued by an independent accredited certification body, not by OneClickComply.