ISO MeQualifications guide · UK
Menu

Privacy information management · PIMS

ISO/IEC 27701:2025

Requirements and guidance for a privacy information management system covering the processing of personal information (PII) as a controller or processor. Since 2025 it is a standalone standard rather than an extension of ISO/IEC 27001.

Full title
Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance
Edition
2nd edition, October 2025 (replaces ISO/IEC 27701:2019)
Status
New edition The 2025 edition turned ISO/IEC 27701 into a standalone management-system standard. UKAS expects certification bodies to have moved all certified clients to it by 31 October 2028.
Type
Requirements standard — organisations can be certified against it
Official page
View ISO/IEC 27701 on iso.org

1 What it covers

ISO/IEC 27701 helps organisations manage privacy risks when they process personally identifiable information (PII), with sets of controls for PII controllers and PII processors. Its controls map well onto data-protection laws such as UK GDPR, although certification does not by itself prove legal compliance.

According to UKAS, the 2025 edition mainly: made the PIMS a standalone management-system standard (the 2019 edition was an extension to ISO/IEC 27001 and 27002); adopted the Harmonized Structure; strengthened leadership, governance and performance evaluation; added climate-change considerations; embedded privacy risk management; and restructured the controller and processor controls.

2 Who uses it

Organisations handling significant amounts of personal data — software and cloud providers, data processors, healthcare, marketing and financial services — and their privacy, data protection and information security teams.

3 Structure and key clauses

The 2025 edition follows the Harmonized Structure (clauses 4–10), with privacy-specific controls for controllers and processors in its annexes. Course materials written for the 2019 edition (which was organised around ISO/IEC 27001 and 27002 clauses) will not match the new layout — check the edition your course uses.

4 Key facts for courses and exams

  • Current edition: ISO/IEC 27701:2025 (published 14 October 2025) — now standalone.
  • UKAS timeline: certification bodies transitioned by 31 October 2027; certified clients by 31 October 2028.
  • A companion standard, ISO/IEC 27706:2025, sets requirements for bodies certifying PIMS.
  • IRCA does not list a separate privacy auditor certification scheme; PECB offers ISO/IEC 27701 courses.

5 ISO/IEC 27701 qualifications

QualificationUK courses listed
ISO/IEC 27701 Foundation / requirements2
ISO/IEC 27701 Lead auditor1
ISO/IEC 27701 Implementer / lead implementer2
ISO/IEC 27701 Transition (new edition)1

S Sources

Facts on this page last checked 3 October 2026.

  1. iso.org, ISO/IEC 27701:2025 page — https://www.iso.org/standard/27701
  2. UKAS Technical Bulletin, Transition arrangements for PIMS ISO/IEC 27701:2025 (rev. 1, 18 August 2026)