ISO/IEC 27701:2025 – Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance

On October 14, 2025, the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) published the much-anticipated new edition of ISO/IEC 27701:2025 – the global framework for Privacy Information Management Systems (PIMS).
The new version marks the most significant transformation since the standard’s creation in 2019, transforming it from an extension of ISO/IEC 27001 into a fully independent management standard.
 
Why Was a Revision Needed?
✅ Changes in ISO/IEC 27001 and ISO/IEC 27002
Following the 2022 revisions of ISO/IEC 27001 and ISO/IEC 27002, which updated the structure and controls for information security, it became clear that the privacy management standard also needed to evolve.
However, the new edition of ISO/IEC 27701 goes far beyond a simple update — it transforms the Privacy Information Management System (PIMS) into an independent management framework that can be implemented and certified separately from ISO/IEC 27001.
Organizations are no longer required to establish an Information Security Management System (ISMS) first in order to manage personal data privacy.
The new version removes the mandatory requirement for an implemented ISMS under ISO/IEC 27001, while maintaining full compatibility and integration capability with it.
✅ Strengthened Data Protection Requirements
In recent years, data protection regimes — such as the GDPR in the European Union and other national and international regulations — have become increasingly strict.
At the same time, technologies such as artificial intelligence (AI), cloud computing, automated decision-making, and cross-border data flows have introduced new ethical, legal, and operational risks.
ISO/IEC 27701:2025 aims to provide organizations with a practical framework and tools to manage these risks effectively.
✅ Greater Flexibility and a Standalone PIMS
While the 2019 edition was structured as an extension of ISO/IEC 27001 — meaning organizations first needed an ISMS — the 2025 version removes this dependency, allowing PIMS to operate as a standalone management system for personal data protection.
 
Key Structural and Conceptual Changes
One of the most important changes is that ISO/IEC 27701:2025 is no longer presented as an extension to ISO/IEC 27001 or ISO/IEC 27002 but as a fully independent, certifiable standard for privacy management.
This means that organizations without existing ISO/IEC 27001 certification can now implement and be certified for ISO/IEC 27701 alone.
The new edition follows the Harmonized Structure (HS; formerly High-Level Structure) — the unified ISO framework that ensures consistent terminology and documentation and facilitates integration with other management system standards (e.g., ISO 9001, ISO 14001, ISO/IEC 27001, ISO/IEC 42001).
This alignment allows organizations to consolidate their quality, environmental, information security, and privacy management processes within a single integrated framework.
The standard also introduces a requirement to consider climate change as part of the organization’s context (Clause 4.1).
This includes assessing how extreme weather events, long-term climate trends, and related regulatory requirements might impact privacy and data security.
When climate change is deemed a relevant factor, the organization must plan appropriate actions and integrate them into its risk assessment process (Clause 6.1).
Another major improvement is the restructuring of annexes and controls.
While the 2019 version separated controls for PII controllers and processors, ISO/IEC 27701:2025 consolidates them into clearly defined role-based groups and introduces common controls applicable to both.
The new Annex B provides practical implementation guidance for these controls — a structure that will make compliance assessment easier for both organizations and auditors.
 
Revised Clauses and Annexes
✅ Clauses 4–10
The standard now follows the typical ISO management system structure — context, leadership, planning, support, operation, performance evaluation, and improvement.
In ISO/IEC 27701:2019, only Clauses 4–5 contained PIMS-specific requirements, while the rest offered implementation guidance.
In the new version, all these clauses are mandatory requirements, meaning no exclusions are permitted if compliance is claimed.
✅ Consolidated and Expanded Annexes
The new edition includes expanded and clearly structured annexes providing implementation guidance and mappings to other standards and regulatory frameworks:

• Annex A – Consolidated controls for PII controllers, PII processors, and common controls (A.1, A.2, A.3).
• These address topics such as legal basis, transparency, data subject rights, system security, and third-party management.
• Each organization must evaluate applicability and justify exclusions in its Statement of Applicability (SoA) — now a mandatory requirement.
• Annex B – Provides implementation guidance for the controls in Annex A, including setting objectives, defining lawful bases, managing consent, conducting Privacy Impact Assessments (PIA), and handling data subject requests.
• Annex C – Maps ISO/IEC 27701 to the privacy principles of ISO/IEC 29100, enabling alignment with internationally recognized privacy principles such as lawfulness, purpose limitation, data minimization, accountability, and transparency.
• Annex D – maps ISO/IEC 27701 controls to GDPR articles, helping organizations demonstrate compliance and demonstrable accountability to supervisory authorities and clients.
• Annex E – Provides mappings to ISO/IEC 27018 (protection of PII in public clouds) and ISO/IEC 29151 (PII protection principles).
• This integration is particularly relevant for cloud service providers, SaaS platforms, and multinational organizations operating in multi-regulatory environments.
• Annex F – Shows a direct comparison between the 2025 and 2019 editions, helping certified organizations perform a gap analysis and plan the transition by identifying retained, merged, or removed controls.

✅ Updated Control Catalogue
The control set has been restructured and consolidated, now comprising a unified catalogue of controls and control measures for PII controllers (A.1), PII processors (A.2), and common measures (A.3). Some of the previous controls have been removed or merged, while new ones have been introduced to address risk management, artificial intelligence, and data transfers. The updated control set reflects the revisions introduced in ISO/IEC 27001:2022 and ISO/IEC 27002:2022.
✅ Enhanced Governance and Leadership Accountability
In accordance with Clause 5 of the Harmonized Structure, ISO/IEC 27701:2025 reinforces the role of top management.
The new edition requires clearer leadership commitment to privacy, integration of privacy management into strategic planning, and accountability across all organizational levels.
Top management must ensure that adequate resources are allocated and that privacy objectives are embedded within the organization’s governance framework (Clauses 5.1–5.3).
 
✅ Expanded Requirements for Risk, Data Transfers, and AI
The 2025 edition introduces explicit alignment with ISO/IEC 42001 (AI management system — Requirements), promoting better coordination between privacy, risk, and ethical oversight in automated PII processing.
Controls governing cross-border data transfers, cloud services, and third-party relationships are now more stringent and require detailed documentation.
Risk assessments must also consider impacts on PII principals, not only operational risks to the organization.
 
What Do These Changes Mean for Organizations?
✅ Easier Access for Smaller Organizations
By removing the dependency on ISO/IEC 27001, smaller companies without a certified ISMS can now implement and certify a standalone PIMS, reducing costs and barriers to entry.
✅ Smooth Transition for Existing Certifications
Organizations certified to ISO/IEC 27701:2019 will need to perform a gap analysis and update their PIMS in line with the new requirements.
Most elements will remain familiar, particularly for those integrated with an ISMS.
✅ New Processes and Documentation

• Review and update of policies, roles, and responsibilities
• Revisions to risk assessment and management procedures
• Additional documentation for data transfers, AI use, and third-party controls
• Enhanced training and awareness programs

ISO/IEC 27701:2025 includes annexes mapping to GDPR, ISO/IEC 29100, ISO/IEC 27018, and ISO/IEC 29151 (Annexes C–E), while Annex F details alignment with the 2019 edition.
 
✅ Certification and Transition Period
Certification and transition details will be defined by accreditation and certification bodies in the coming months.
 
The publication of ISO/IEC 27701:2025 marks a major milestone in the evolution of global privacy standards.
Its core transformation is the establishment of PIMS as a standalone, independent, and easily integrable management system, with stronger emphasis on privacy, accountability, and emerging technologies such as AI and cross-border data flows.
For organizations, this means:

• early planning and gap analysis
• updated policies and processes
• training, leadership engagement, and coordinated certification transition

ISO/IEC 27701:2025 reinforces a global approach to privacy management — built on transparency, demonstrable accountability, and alignment with other ISO management system standards.