Digital Lexicon Hub

International standard that sets requirements and guidance for a Privacy Information Management System (PIMS) covering PII controllers and processors.

Organizations handling client personal data use a certified privacy management system to answer due-diligence questionnaires and show GDPR accountability; buyers and auditors now expect certification plans to reference the 2025 edition.

A SaaS company already certified to ISO/IEC 27001 extends its scope to privacy: it maps its role as PII processor, adds records of processing, subprocessor controls and data subject request handling, and plans its audit against ISO/IEC 27701:2025.

Certification shows a managed privacy process, not legal compliance, and does not replace GDPR duties such as lawful basis or breach notification. Certificates issued against the withdrawn 2019 edition need a transition to the 2025 edition.

The 2025 edition restructures ISO/IEC 27701 as an independent management system standard that can be certified alone or alongside ISO/IEC 27001:2022, instead of only as an extension of it. It follows the harmonized management system clauses, adds privacy-specific risk and control requirements, and keeps separate control sets for PII controllers and PII processors, with guidance on mapping them to the General Data Protection Regulation (GDPR). It replaced the 2019 edition, withdrawn in October 2025.