ISO/IEC 27701: What the Privacy Standard Requires

What is ISO/IEC 27701?

ISO/IEC 27701 is a management system standard for privacy. ISO's page for the standard says it sets out requirements for establishing, implementing, maintaining and continually improving a Privacy Information Management System, and that it is designed for organizations that act as personally identifiable information (PII) controllers and processors.

PII is the standard's term for personal data. A PIMS is the set of policies, roles, processes and records an organization uses to manage how it handles that data, and to keep improving how it does so.

The full title is "Information security, cybersecurity and privacy protection - Privacy information management systems - Requirements and guidance." It is developed by ISO/IEC JTC 1/SC 27, the joint ISO and IEC subcommittee for information security, cybersecurity and privacy protection.

What is the current edition of ISO/IEC 27701, and what did it replace?

The current edition is ISO/IEC 27701:2025, Edition 2, as of October 26, 2026. ISO's page lists it as published, with the International Standard published on 2025-10-14, and shows 64 pages.

It replaces ISO/IEC 27701:2019, which ISO's page lists as withdrawn. If a vendor, customer questionnaire or contract refers to "ISO 27701," check whether it means the 2019 or the 2025 text, because the two are different documents.

ISO's lifecycle record shows the project was approved on 2022-10-17 and went through two draft international standard ballots before publication. That history is useful context if you need to explain the date of the change to a customer or auditor.

Is there an amendment or a successor edition?

No amendment, corrigendum or successor edition is listed on ISO's page for the standard, as of October 26, 2026. The page shows the 2025 edition as the current published International Standard. The 2019 edition is the only earlier edition it lists, as withdrawn.

Standards can change, and a page read on one day is not a guarantee about the next. Before you cite or buy the standard, check ISO's page again and confirm which edition your certification body, customer or regulator expects.

Do you need ISO 27001 before ISO 27701?

No. BSI, a national standards body, says the 2025 edition "is a stand-alone standard," that its application is no longer dependent on the implementation of ISO/IEC 27001 or ISO/IEC 27002, and that it no longer requires ISO/IEC 27001 certification as a prerequisite for implementation or audit.

The Purplecop Privacy page says the same in its own words: the second edition, published in October 2025, is an independent standard that can be used alone.

Standalone does not mean unrelated. BSI says Annex A of the 2025 edition was restructured to align with ISO/IEC 27002:2022. If your organization already runs an information security management system under ISO 27001, you may have management processes that a privacy program can build on. Whether they fit is a decision for your own scope and your certification body.

Who is ISO/IEC 27701 for: controllers or processors?

It is for both. ISO describes the standard as designed for PII controllers and processors, and BSI adds that the revision refines definitions and responsibilities for controllers, processors and subcontractors, with those requirements consolidated into a single annex structure.

The two roles are easiest to see in regulator language. The UK Information Commissioner's Office, describing the UK GDPR, defines a controller as the body that determines the purposes and means of processing personal data, and a processor as a body that processes personal data on behalf of the controller. Other laws use other words. The Purplecop Privacy page notes, for example, that India's DPDP Act speaks of Data Fiduciaries and Data Principals, while GDPR speaks of controllers and data subjects.

An organization can hold more than one role, depending on the processing activity. BSI says clearer role definitions help when an organization has multiple roles. Work out which role applies to each activity before you decide which controls matter.

How is the 2025 edition structured?

BSI describes the 2025 edition as a Type A management system standard aligned to ISO's Harmonized Structure, with privacy risk work built into the core management system clauses. BSI says this means the standard sits on its own rather than building on other standards.

BSI also describes the annexes:

• Annex A lists the PIMS controls for PII controllers and processors, restructured to align with ISO/IEC 27002:2022.
• Annex B explains how to implement and evidence each Annex A control in different contexts.
• Annex D maps the standard to the EU GDPR.
• Annex F gives the correspondence with ISO/IEC 27701:2019 for migration.

How does ISO/IEC 27701 relate to GDPR?

ISO/IEC 27701 is not a law, and it does not replace GDPR or any other privacy law. BSI says the 2025 edition includes an Annex D mapping to the EU GDPR, and describes the standard as providing alignment with frameworks such as GDPR.

A mapping shows where a requirement in one document corresponds to a requirement in another. It is not a legal conclusion. Whether a specific processing activity meets GDPR, the DPDP Act or any other law is a question for your legal counsel and, where relevant, your regulator. For the legal side, see our guides to GDPR and the DPDP Act.

This page is general information and not legal advice.

Can you be certified to ISO/IEC 27701, and who decides?

BSI describes ISO/IEC 27701 as a certifiable management system. ISO's own page for the standard does not address certification, so read the full text and ask a certification body how it handles it.

Certification, where an organization chooses it, is decided by an independent certification body. Purplecop Security does not issue certificates, and no software or advisory work can make an organization certified or compliant. A privacy program built on the standard is also not the same as a certificate.

If you hold a certificate to the 2019 edition, BSI says Annex F of the 2025 edition provides the correspondence with the 2019 text for migration. BSI's pages, as read, give no transition deadline, and this page states none. Ask your certification body for its transition arrangements and dates.

What does a PIMS typically involve day to day?

This section describes the kinds of records a privacy program tends to need. It is orientation, not a statement of what the standard requires, so check the standard itself.

• Records of processing. A current inventory of what personal data you hold, why, and where it goes.
• Consent and notice. Records of what people were told and what they agreed to.
• Rights requests. A process for handling requests from the people the data is about.
• Impact assessments. A way to assess processing that carries higher privacy risk.
• Transfers. A record of cross-border transfers and the mechanism relied on.
• Incidents. A workflow for personal data breaches and the notices a law may require.
• Evidence. Proof, kept as you go, that each of these is operating.

Does Purplecop help with ISO/IEC 27701?

Purplecop Privacy is Purplecop Security's privacy product, built for privacy information management under ISO/IEC 27701. The Purplecop Privacy page says it has eight modules, all included: Consent & Notice, Data Principal Rights, ROPA, DPIA, Cross-border Transfers, Breach Workflow, Privacy Controls and Privacy Evidence. The Privacy Controls module is described as the privacy half of the shared control library, mapped to 27701.

The page also says Purplecop Privacy maps consent, notice, data-principal rights, DPIA and breach workflow to India's DPDPA 2023, and that its global engine runs 17 privacy laws across 40 countries, including GDPR and CCPA/CPRA.

Purplecop Privacy runs on Purplecop One, alongside Purplecop GRC. The Purplecop GRC page says the two share one identity, one control library and one evidence store.

On the services side, Purplecop Security's GRC & Compliance Advisory is described as program design, framework adoption and audit readiness, led by senior practitioners. Its framework adoption list names ISO/IEC 27001, SOC 2, NIST CSF 2.0, PCI DSS, HIPAA, DPDPA and GDPR. ISO/IEC 27701 is not named in that list, so ask whether it is in scope for your engagement. You can contact Purplecop Security to scope it.

Mapping a product to ISO/IEC 27701 is not a certificate and not a compliance status. Purplecop Privacy is software and Purplecop Security's services support the work. The decision to certify, and the certificate, come from an independent certification body.

What is ISO/IEC 27701?

ISO/IEC 27701 is the international standard that sets requirements for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS). It is designed for organizations that act as PII controllers and processors.

What is the current edition of ISO/IEC 27701?

As of October 26, 2026, the current edition is ISO/IEC 27701:2025, Edition 2, published in October 2025. It replaced ISO/IEC 27701:2019, which ISO lists as withdrawn. ISO's page lists no amendment, corrigendum or successor edition.

Do I need ISO 27001 to use ISO/IEC 27701?

No. BSI says the 2025 edition is a stand-alone standard and no longer requires ISO/IEC 27001 certification as a prerequisite for implementation or audit. An existing ISO 27001 program may still share processes with a privacy program.

Is ISO/IEC 27701 only for data controllers?

No. It is designed for PII controllers and PII processors. BSI says the 2025 revision also refines the responsibilities of subcontractors, and that clearer roles help organizations that hold more than one role.

Does ISO/IEC 27701 make me compliant with GDPR?

No standard makes an organization legally compliant. BSI says the 2025 edition includes a mapping to the EU GDPR, but a mapping is not a legal conclusion. Ask your legal counsel whether your processing meets the law that applies to you.

Can Purplecop Privacy certify my organization to ISO/IEC 27701?

No. Purplecop Privacy is software built for privacy information management under ISO/IEC 27701, and its privacy controls are mapped to 27701. Certification, if you choose it, is decided by an independent certification body, not by Purplecop Security or any product.

Where can I read the standard itself?

ISO's page for ISO/IEC 27701:2025 is the official listing. Obtain the full text from ISO or your national standards body. This guide summarizes public pages only and does not reproduce the standard.