ISO 27701

No changes recorded yet — we are watching, and nothing has been published.

1. 2025-10-14 ISO/IEC 27701:2025 and ISO/IEC 27706:2025 are published; ISO/IEC 27701:2019 and ISO/IEC TS 27006-2:2021 are withdrawn

1. 2025-10-14
   ISO/IEC 27701:2025 Major versionCurrent

   Second edition; replaced the 2019 edition, and the title no longer calls it an extension to ISO/IEC 27001 and ISO/IEC 27002. source

   More

   • The 2019 title was "Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management"; the 2025 title is "Privacy information management systems - Requirements and guidance".
   • The 2019 scope text covered controllers and processors "processing PII within an ISMS"; the 2025 scope text does not include those words.
   • ISO/IEC 27706:2025, the requirements for bodies certifying a PIMS, was published the same day and replaced ISO/IEC TS 27006-2:2021, which covered PIMS certification in combination with ISO/IEC 27001.
2. 2019-08-05
   ISO/IEC 27701:2019 Major version

   First edition, an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy management; withdrawn on 14 October 2025. source

Organizations that act as PII controllers or processors, of any type and size. It is voluntary.

Who it is for

PII controllers and PII processors holding responsibility and accountability for PII processing. source

Any organization

Public and private companies, government entities and not-for-profit organizations of all types and sizes. source

What it requires

Establishing, implementing, maintaining and continually improving a PIMS, with guidance on implementing the requirements. source

Legal status

ISO standards are voluntary and contain no contractual, legal or statutory requirements; national laws take precedence. source

Third-party certification of the PIMS by certification bodies that follow ISO/IEC 27706 on top of ISO/IEC 17021-1.

Rules for certifiers

ISO/IEC 27706:2025 sets requirements for bodies auditing and certifying a PIMS according to ISO/IEC 27701, in addition to ISO/IEC 17021-1. source

Accreditation use

ISO/IEC 27706 can be used as a criteria document for accreditation, peer assessment or other audit processes. source

Before 2025

Certification bodies used ISO/IEC TS 27006-2:2021, written for a PIMS according to ISO/IEC 27701 in combination with ISO/IEC 27001. source

Transition to 2025

Not confirmed by an official source yet.

A voluntary standard; it sets no legal requirements and does not replace national laws.

Legal force

ISO standards are voluntary and contain no contractual, legal or statutory requirements. source

Laws prevail

Voluntary standards do not replace national laws, with which users are understood to comply and which take precedence. source

1. Standard ISO/IEC 27701:2025 (catalogue entry; paid standard)
2. Standard ISO/IEC 27706:2025 Requirements for bodies certifying a PIMS (catalogue entry)
3. Standard ISO/IEC 27701:2019 (withdrawn edition, catalogue entry)

1. ISO 27001

   ISO/IEC 27001 is an information security management system; ISO/IEC 27701 is a privacy information management system for personal data.

2. ISO 27018

   ISO/IEC 27018 is guidance for public cloud processors of personal data; ISO/IEC 27701 is a certifiable management system for any controller or processor.

3. ISO 29100

   ISO/IEC 29100 sets the privacy vocabulary and principles; ISO/IEC 27701 turns privacy into management system requirements.

4. GDPR

   The GDPR is EU law with fines; ISO/IEC 27701 is a voluntary management system standard.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to ISO 27701 (RSS)