ISO 27701, a privacy layer on top of ISO 27001
Manage personal data in a structured, certifiable way, whether you control it or process it for others.
Official sources
Use these official places to read the text and find the latest version.
Official website
ISO shows the current edition (ISO/IEC 27701:2025), its status and a preview of the contents.
Visit iso.org/standard/27701 ↗What ISO 27701 is
ISO/IEC 27701 sets out requirements for a privacy information management system, with guidance for putting them into practice. It helps you show how you protect personal data.
It names two roles: controllers, who decide why data is used, and processors, who handle it for someone else.
How ISO 27701 got to where it is today
The milestones that changed what organisations have to do.
ISO/IEC 27701:2019
Published as an extension to ISO 27001 and 27002.
Revision
Edition 2 is published as a standalone standard, with requirements and guidance for controllers and processors.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You already hold or plan ISO 27001.
You process personal data for customers.
You need one framework that supports GDPR and similar laws.
Customers ask for privacy assurance.
What it asks of you
The requirements fall into six areas.
Privacy management system
Extend your security system to cover privacy.
Controller duties
Purpose, consent, rights and transparency.
Processor duties
Follow customer instructions and support their obligations.
Data sharing and transfers
Control where personal data goes.
Security of personal data
Technical and organisational safeguards.
Mapping to laws
Show how the controls support legal duties.
2 parts, 6 areas and 22 requirements
The 2025 edition of ISO/IEC 27701 is a standalone privacy information management standard, no longer only an extension to ISO/IEC 27001. This page shows clause level structure and privacy control themes in plain words; exact Annex numbering is not confirmed.
6 areas · 22 requirements
Management system requirementsClauses 4 to 10 build a privacy information management system on the ISO/IEC 27001 pattern.3 areas · 7 requirements
- Cl. 4
Understand your context, your role as controller or processor, interested parties and the scope of the privacy system.
What you do
- Map personal data processing activities and your role in each
- Record legal and contract privacy duties
- Cl. 5
Top management leads privacy, sets a privacy policy and assigns roles.
What you do
- Appoint a privacy lead or DPO equivalent
- Approve and publish a privacy policy
Evidence to keep
- Privacy scope statement
- Role statement (controller or processor)
- Privacy policy approved by leadership
- Cl. 6
Assess privacy risks to individuals and the organisation, set objectives and select controls.
What you do
- Run privacy risk assessments per processing activity
- Document control selection and justification
- Cl. 7
Provide resources, competence, awareness, communication and controlled documents for privacy.
What you do
- Train staff on handling personal data
- Control privacy documents and records
Evidence to keep
- Privacy risk assessment
- Privacy objectives
- Training records
- Cl. 8
Plan and operate privacy processes and repeat risk assessment as things change.
What you do
- Review privacy risk on new projects and changes
- Cl. 9
Monitor, audit and review the privacy system at planned intervals.
What you do
- Run internal audits and management reviews
- Cl. 10
Correct nonconformities and keep improving the privacy system.
What you do
- Track fixes and lessons from incidents and complaints
Evidence to keep
- Operational privacy procedures
- Internal audit report
- Corrective action log
Privacy controls (themes, numbering unverified)Control sets for organisations acting as controllers and as processors, plus security measures.3 areas · 15 requirements
- CTRL-purpose
Identify and document the purpose and legal basis for each processing activity.
What you do
- Keep a record of processing
- Link each activity to a lawful basis
- CTRL-consent
Obtain and record consent where it is the basis and allow withdrawal.
What you do
- Store consent proof
- Offer simple withdrawal
- CTRL-pia
Carry out privacy impact assessments where risk is high.
What you do
- Use a screening questionnaire
- Keep assessments and sign-offs
- CTRL-notice
Give individuals clear information about how their data is used.
What you do
- Publish and update privacy notices
- CTRL-rights
Support individuals in exercising access, correction, deletion and other rights.
What you do
- Run a request workflow with deadlines
- Log outcomes
- CTRL-minimise
Limit collection, use and retention to what is needed.
What you do
- Set retention schedules and delete on time
- Review fields collected in forms
- CTRL-share
Control sharing and transfer of personal data to others, including across borders.
What you do
- Use data sharing agreements
- Record transfers and safeguards
Evidence to keep
- Record of processing
- Consent and notice records
- Data subject request log
- Privacy impact assessments
- PROC-instr
Process personal data only as instructed by the customer and tell them if an instruction seems unlawful.
What you do
- Define instruction handling in contracts
- PROC-help
Assist customers with their obligations such as rights requests and impact assessments.
What you do
- Create a customer support procedure
- PROC-sub
Manage sub-processors and tell customers about changes.
What you do
- Keep a sub-processor register and notify changes
- PROC-breach
Tell customers promptly about personal data breaches.
What you do
- Set notification timelines in contracts
- PROC-return
Return or securely delete personal data at the end of service.
What you do
- Document exit and deletion steps
Evidence to keep
- Customer processing agreements
- Sub-processor list
- Breach notification records
- SEC-link
Align information security controls with privacy needs so personal data is protected.
What you do
- Map privacy risks to security controls
- SEC-access
Limit access to personal data to those who need it and protect it in storage and transit.
What you do
- Apply role based access and encryption
- SEC-incident
Handle privacy incidents and breaches through a defined process.
What you do
- Add privacy steps to the incident plan
Evidence to keep
- Updated ISO 27001 risk treatment with privacy
- Access and encryption records
- Incident log
Nothing matches. Clear the search or pick another part.
Outcomes and implementation examples are from ISO/IEC 27701:2025 Privacy information management systems, Requirements and guidance, published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Build on ISO 27001
Or implement both together.
- 2
Define your role
Controller, processor or both.
- 3
Map personal data
Where it is, why, and who sees it.
- 4
Add privacy controls
Rights, retention, transfers.
- 5
Audit and certify
Often alongside ISO 27001.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Privacy management system | Scope and policy records |
| Controller duties | Processing register and rights tracker |
| Processor duties | Customer instruction records |
| Data sharing and transfers | Vendor and transfer register |
| Security of personal data | Controls library with evidence |
| Mapping to laws | Control-to-law mapping |
Free ISO 27701 readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Personal data inventory
- Role matrix
- Rights request procedure
- Privacy audit checklist
Share or cite this page
Writing about ISO 27701? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/iso-27701/">ISO 27701 explained in plain English - Optimus CyberX</a>Common questions
Do we need ISO 27001 first?
Under the 2019 edition you needed ISO 27001 first or at the same time. The 2025 edition is a standalone standard, so check with your certification body how they will audit it.
Is it the same as GDPR compliance?
No. It supports compliance but is not a legal guarantee.
Who is it for?
Any organisation handling personal data.
Can we be certified?
Yes, by an accredited certification body.
Related frameworks
See how ready you are for ISO 27701
Answer questions across every area. We email you a report showing where you comply and where you do not.