ISO/IEC 27701:2025 – The New Standard for Privacy, AI and Cloud Technologies
On 14 October 2025, the International Organization for Standardization (ISO) officially released the second edition of ISO/IEC 27701:2025 – Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance.The new version represents a significant revision of the 2019 edition and introduces key changes that align the standard with today’s technological, legal, and regulatory realities.
Key Updates
ISO/IEC 27701:2025 is now a standalone standard, which can be implemented and certified independently of ISO/IEC 27001.
This makes privacy management more accessible, especially for smaller organizations that do not maintain a full Information Security Management System (ISMS).
The new edition adopts the Harmonized Structure (HS) – the unified framework applied across all ISO management system standards – facilitating integration with ISO 9001, ISO 14001, ISO/IEC 27001, and the new ISO/IEC 42001 for artificial intelligence management systems.
Focus on Climate Change and Artificial Intelligence
For the first time, the standard requires organizations to assess the impact of climate change as part of their organizational context (Clause 4.1).
This includes analyzing extreme weather events, long-term environmental trends, and regulatory risks that may affect the privacy and security of personal data.
ISO/IEC 27701:2025 also introduces new requirements addressing risks related to artificial intelligence (AI), automated decision-making, and cross-border data transfers, ensuring closer alignment with ISO/IEC 42001.
Restructured Controls and Annexes
The controls for personal data controllers and processors are consolidated and clearly defined by role in the new Annex A, while Annex B provides practical implementation guidance.
Additional annexes (C–F) include mappings to GDPR, ISO/IEC 29100, ISO/IEC 27018, and ISO/IEC 29151, as well as a comparison with the 2019 edition, helping already certified organizations plan their transition more effectively.
The certification and transition details for ISO/IEC 27701:2025 are expected to be defined by accreditation and certification bodies in the coming months.
Business Relevance
The revised standard places stronger emphasis on leadership commitment, accountability, and the integration of privacy management into organizational strategy.
ISO/IEC 27701:2025 establishes PIMS (Privacy Information Management System) as a global framework for trust, transparency, and responsible personal data management, aligned with sustainability goals and the ethical use of technology.
Implementation of management standards
CONSEJO Ltd. is a consulting company with over 20 years of practical experience in the development, implementation and maintenance of management systems in accordance with international standards and regulatory requirements. The company provides consulting services in the areas of quality management, environmental management, occupational health and safety, food safety, information security, cybersecurity, risk management and sustainable development. Our expertise covers standards and schemes such as ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO/IEC 27001, IFS Food, BRCGS and HACCP, as well as consulting services related to NIS2, DORA, GDPR and EcoVadis.
The CONSEJO team has been involved in over 1,500 projects for organizations across various sectors of the economy, including manufacturing, construction, energy, information technology, transport, trade, the food industry and services. Our approach focuses on developing management systems that work effectively in practice, tailored to the specific characteristics and needs of each organization. We work closely with our clients, providing consulting support, staff training and assistance during implementation. We strive to deliver high-quality services within the agreed deadlines and solutions that support successful certification and create long-term value for businesses.
