In 2025, the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) published the new edition of ISO/IEC 27701:2025 — Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance.
It replaces the 2019 edition, which was a technical extension to ISO/IEC 27001 and ISO/IEC 27002.
The new edition has been completely revised and now constitutes a stand-alone management system standard, applicable both independently and in integration with other management systems.
 
What is ISO/IEC 27701:2025?
ISO/IEC 27701:2025 specifies requirements and provides guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS).
The purpose of a PIMS is to help organizations manage risks related to the privacy of personally identifiable information (PII) and ensure compliance with applicable legal, regulatory, and contractual requirements.
The standard can be applied by:
• PII controllers — organizations that determine the purposes and means of processing PII;
• PII processors — organizations that process PII on behalf of others;
• as well as organizations that perform both roles simultaneously.
The standard provides a practical framework enabling organizations to:
• demonstrate compliance with applicable regulatory requirements (such as the GDPR);
• identify and manage risks associated with the processing of personal data;
• implement privacy policies, procedures, and controls.
 
Purpose and Scope
The main objective of ISO/IEC 27701:2025 is to provide organizations with a model for the systematic and transparent management of personal data.
The standard applies to:
• all types of organizations — private, public, and non-governmental;
• all roles in data processing — both controllers and processors;
• all stages of the personal data life cycle — collection, storage, use, sharing, and disposal.
It sets requirements related to the development and maintenance of a privacy policy, performing risk assessment and privacy impact assessment (PIA), as well as managing incidents and continuously improving the Privacy Information Management System.
 
Main Changes Compared with the Previous Edition (ISO/IEC 27701:2019)
The 2025 edition is a technically revised and substantially expanded standard.
Key changes include:

1. Redrafted as a stand-alone standard — the previous version was an extension to ISO/IEC 27001, whereas the new one can be applied independently.
2. Updated structure following the Annex SL model — providing greater compatibility with other ISO management system standards (e.g. ISO 9001, ISO/IEC 27001 and others).
3. Expanded scope of controls — new controls and guidance added, including those related to:
   • consideration and management of risks associated with climate change;
   • cloud services and sub-contractors;
   • processing of sensitive categories of data.
4. Enhanced alignment with the GDPR and ISO/IEC 29100 — new Annexes D and E provide updated mappings to European legislation and other privacy standards.
5. Clearer distinction between the roles of PII controller and PII processor, with separate control tables (Annex A.1 and A.2).

 
Structure of the Standard
ISO/IEC 27701:2025 follows a logical structure based on the PDCA (Plan–Do–Check–Act) cycle and includes the following main clauses:

1. Scope — defines the purpose and applicability of the standard;
2. Normative references — including ISO/IEC 29100 as the core terminology reference;
3. Terms and definitions — defines key concepts such as organization, risk, and compliance;
4. Context of the organization — understanding internal and external issues, interested parties, and the scope of the PIMS;
5. Leadership — requirements for top management commitment and definition of a privacy policy;
6. Planning — identification of risks and opportunities, setting of objectives and plans to achieve them;
7. Support — resources, competence, awareness, and communication;
8. Operation — implementation and management of processes related to PII processing;
9. Performance evaluation — internal audit, management review, monitoring, and measurement;
10. Improvement — corrective actions and continual improvement.

The Annexes A–F contain:
• Annex A: Controls for PII controllers and PII processors;
• Annex B: Implementation guidance;
• Annex C: Mapping to ISO/IEC 29100 (Privacy Framework);
• Annex D: Mapping to the GDPR;
• Annex E: Relationship to ISO/IEC 27018 and ISO/IEC 29151;
• Annex F: Correlation with the previous edition (ISO/IEC 27701:2019).
 
Significance and Benefits
Implementation of ISO/IEC 27701:2025 offers numerous strategic and operational benefits for organizations:
• Regulatory compliance — supports demonstrable alignment with the GDPR and other national data-protection laws;
• Enhanced trust — demonstrates commitment to privacy and ethical handling of information to customers and partners;
• Risk reduction — through systematic management of threats to privacy and information security;
• Integration with other management systems — enables combination with ISO/IEC 27001, ISO 9001, ISO 22301, and others;
• Competitive advantage — certified organizations gain greater trust and credibility in international business relations.
 
ISO/IEC 27701:2025 is a strategic instrument for any organization aiming to build an effective, transparent, and sustainable culture of personal data protection.
It extends the foundations of information security by incorporating a modern approach to privacy management, in line with current legal and ethical requirements.
Its implementation not only ensures compliance but also enhances corporate reputation and the trust of interested parties.

 

ISO/IEC 27701:2025 Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance