Skip to content

ISO 27001, SOC 2, the DPDP Act and manual VAPT. Book a Free Scoping Call

ISO 27701

ISO/IEC 27701 Explained: Scope, Roles and What a Certificate Proves

ISO/IEC 27701 sets requirements for a privacy information management system (PIMS): the policies, roles, risk process, controls and records an organisation uses to manage personal data as a controller, a processor or both. The current edition, ISO/IEC 27701:2025, is a standalone management system standard, so it can be implemented and certified with or without ISO/IEC 27001. A certificate shows that an accredited certification body found the management system conforming; it is not proof of compliance with GDPR, the DPDP Act or any other law. SecureRoot helps organisations build and prepare a PIMS; the certificate comes from an accredited certification body.

Request an ISO implementation proposalSee ISO pricing

About this guide

Written by SecureRoot Risk Advisory LLP.

Scope

What a privacy information management system covers

A PIMS is not a privacy policy or a consent banner. It is the way an organisation decides, records and checks how it handles personal data, run as a management system with owners, objectives, internal audit and management review.

The scope is the part of the organisation the PIMS covers: which products, processing activities, teams, locations and suppliers. A clear scope usually names:

  • The processing activities inside the boundary, such as customer accounts, payments, support tickets, analytics, recruitment and payroll.
  • For each activity, whether the organisation acts as a controller, a processor or both.
  • The systems and third parties that store or touch that personal data, including cloud services, sub-processors and internal tools such as shared spreadsheets.
  • The laws, regulators and contracts that set requirements for that data, in each country where it is collected or used.
  • Anything deliberately left out, and why, so that a customer reading the certificate scope understands its limits.

A narrow first scope, such as one product and the team that runs it, is easier to build and audit, and can be widened later. A scope drawn so tightly that it excludes the systems customers actually care about will not answer their questions.

The edition question

The 2025 edition: what changed

ISO's catalogue lists ISO/IEC 27701:2025 as the current edition, published in October 2025 as Edition 2, and shows ISO/IEC 27701:2019 as withdrawn. ISO describes the 2025 edition as an independent management system standard that can be used on its own.

That is the practical change. The 2019 edition extended ISO/IEC 27001, so a PIMS sat on top of an information security management system. Under the 2025 edition, an organisation whose customers only ask how it handles personal data can build and certify a PIMS without first holding ISO/IEC 27001. Its controls are organised by role, with sets for controllers, for processors and for both.

If you hold a certificate against the 2019 edition, the move to 2025 is handled through transition arrangements that accreditation bodies set and your certification body applies. Ask your certification body for the deadline and the audit approach that applies to you rather than relying on a general date.

ISO/IEC 27701: the 2019 and 2025 editions compared
AspectISO/IEC 27701:2019ISO/IEC 27701:2025
Status in ISO's catalogueWithdrawnCurrent: Edition 2, published October 2025
Relationship to ISO/IEC 27001An extension of ISO/IEC 27001: the PIMS sat on top of an information security management systemAn independent management system standard that can be used on its own
Certifying a PIMS without ISO/IEC 27001Not on its own: the PIMS extended an ISMSPossible: a PIMS can be built and certified without first holding ISO/IEC 27001
Existing certificatesMove to the 2025 edition under transition arrangements that accreditation bodies set and your certification body applies; ask it for your deadlineNot applicable
Status, edition and standalone use are as ISO's catalogue entry for ISO/IEC 27701 showed them on 13 November 2026.

Roles

Controller, processor or both

The role you play for each processing activity decides which controls apply. Under GDPR, a controller determines the purposes and means of processing personal data, and a processor processes personal data on a controller's behalf. ISO/IEC 27701 is written for both. The DPDP Act uses its own term, Data Fiduciary, for the party that decides.

  1. 01

    List the processing activities first

    Start from what the business actually does with personal data, not from the control list. Each activity gets a purpose, the categories of people and data involved, where the data goes and how long it is kept.

  2. 02

    Assign a role to each activity

    A SaaS company is typically a controller for its own staff, prospects and customer account data, and a processor for the data its customers load into the product. Many organisations are both, and the PIMS has to handle each activity under the right role.

  3. 03

    Apply the controls that match the role

    Controller-side work centres on the basis for processing, notices, consent where it is used, rights requests and privacy by design. Processor-side work centres on acting only on documented instructions, helping customers answer rights requests, managing sub-processors, and returning or deleting data when a contract ends.

  4. 04

    Make contracts match the map

    Data processing agreements with customers and with your own sub-processors should say the same thing as the role map. Auditors and customers both compare them.

ISO/IEC 27001

How ISO/IEC 27701 relates to ISO/IEC 27001

ISO/IEC 27001:2022 manages information security risk; ISO/IEC 27701 manages privacy risk to the people whose data you hold. They overlap heavily, because a privacy programme depends on security controls such as access management, logging, backup and incident response.

  • If you already hold ISO/IEC 27001, adding a PIMS is mostly the privacy-specific work: the role map, records of processing, rights handling, retention and processor management, using the risk process, internal audit and management review you already run.
  • If you hold neither, the 2025 edition lets you start with privacy alone. Choose by what your customers and contracts actually ask for.
  • If customers ask for both, build them as one integrated system with one set of policies and one internal audit cycle, and ask your certification body whether it can audit both together.

Which framework or report to start with is covered in the help article on choosing a framework or report.

What it proves

A certificate is not proof of legal compliance

A PIMS certificate says that an accredited certification body audited the management system against the standard and found it conforming, for the scope written on the certificate. It does not say that every processing activity complies with GDPR, the DPDP Act or any other law.

GDPR is explicit on the point for its own certification schemes: Article 42 says certification does not reduce a controller's or processor's responsibility for compliance. ISO/IEC 27701 certification is not one of those GDPR schemes, and there is no single universal GDPR certification.

The same logic applies in India. The DPDP Act and the DPDP Rules, 2025 contain duties, such as specific notice content and breach intimation, that a management system standard cannot know about. A PIMS is the machinery that makes those duties repeatable and evidenced; the legal requirements still have to be mapped and met on top of it.

In practice, treat the certificate as strong evidence that personal data is managed systematically, and keep a separate mapping of each legal obligation to the control or record that meets it.

Implementation

What implementation involves

  1. 01

    Scope and role mapping

    Inventory the processing activities, classify each as controller or processor, and set the PIMS scope, aligned with any existing ISMS scope. Identify the privacy laws and contracts that apply.

  2. 02

    Gap assessment

    Compare current practice with the standard's requirements and controls, and with the legal duties that apply, and rank the gaps by legal exposure and effort.

  3. 03

    Control design

    Design the controls that close the gaps: consent and purpose limitation, the rights-request process, retention and deletion schedules, and processor and sub-processor agreements.

  4. 04

    Records and operation

    Build the records of processing activities and embed privacy checks into change and onboarding, then let the controls run long enough to leave dated evidence. Finding every place personal data lives, including exports and tools nobody listed, is usually the slowest part.

  5. 05

    Internal audit and management review

    Audit the PIMS, sample real rights requests and consent records, log nonconformities and fix their causes before the certification audit.

  6. 06

    Certification audit

    An accredited certification body runs its own audit and decides. Choose one accredited for ISO/IEC 27701, and where you also hold ISO/IEC 27001, one that can audit both together.

Where SecureRoot fits

What SecureRoot does in an ISO 27701 programme

SecureRoot's ISO 27701 work runs through PIMS scoping and role mapping, a privacy gap assessment, privacy control design, implementation and records of processing, an internal audit, and support through the certification audit. The deliverables are a privacy gap assessment report, records of processing activities, a PIMS policy set, a controller and processor control mapping, and certification audit support. A PIMS can stand alone or integrate with an existing ISMS.

Our published pricing row for ISO 27701: fee "Scoped, then quoted in writing"; third-party cost "The accredited certification body's two-stage audit, paid by you"; timeline "4 to 6 months to a first certificate". The pricing page shows the full row.

Scope boundaries

What this does not cover

  • SecureRoot is not an accredited certification body and does not issue ISO/IEC 27701 certificates. The certificate comes from the certification body you appoint, after its own audit.
  • No consultant can promise a certificate, and neither a PIMS nor its certificate establishes compliance with GDPR, the DPDP Act or any other law.
  • SecureRoot does not give legal advice. Where an obligation turns on interpreting a law, your legal counsel decides.
  • Your teams build and run the records of processing, answer rights requests and produce evidence. That time is not inside any fee, and the certification body's audit fee is contracted and paid by you directly.
  • No personal data, customer datasets or credentials are needed to scope the work.
  • This guide describes ISO/IEC 27701 in our own words. It does not reproduce the standard, which you should buy from ISO or your national standards body.

Questions

Common questions

  • Is ISO/IEC 27701:2025 the current edition?

    Yes. ISO's catalogue lists ISO/IEC 27701:2025, Edition 2, published in October 2025, and shows the 2019 edition as withdrawn.

  • Can we get ISO 27701 without ISO 27001?

    Under the 2025 edition, yes. ISO describes it as an independent management system standard that can be used on its own. Many organisations still run both, because privacy depends on security controls.

  • Does ISO 27701 certification mean we comply with GDPR or the DPDP Act?

    No. It shows the management system conforms to the standard for the certified scope. Legal compliance still has to be mapped and met obligation by obligation.

  • We are a processor for our customers. Does ISO 27701 still apply?

    Yes. The standard is written for controllers and processors, with controls for each role. Most SaaS companies are processors for customer data and controllers for their own.

Primary Sources

Where the Figures on This Page Come From

Figures and requirements above are taken from the sources below, linked to the primary text wherever one exists rather than to a summary of it.

Related

Services and help that go with this

Planning a privacy information management system?

Tell SecureRoot which products and processing activities you want covered, whether you act as a controller, a processor or both, and who is asking for the certificate. We will come back with a scope and a written quote, with the certification body's fee shown separately.

Request an ISO implementation proposalSee ISO pricing