ISO/IEC 27701:2025: What Changed, What It Means for Certification, & What Auditors Are Already Seeing

ISO 27701 (ISO/IEC 27701) is the international standard for a Privacy Information Management System (PIMS). The 2025 edition changed one thing that matters more than all the rest: it is now a standalone standard. An organization no longer needs ISO 27001 certification to pursue ISO 27701 certification. This article covers what changed in the ISO 27701 update between the 2019 and 2025 editions, what the transition means for organizations already certified, where AI and cross-border data handling fit, and what I am already seeing in PIMS audits under the new structure.

A few years ago I sat on a scoping call with a payroll software company that had a privacy program most of my ISO 27001 clients would envy: a current data inventory, tested data subject request handling, a real retention schedule. They wanted ISO 27701 certification. I had to tell them the conversation stopped there, because they were not ISO 27001 certified and ISO/IEC 27701:2019 only existed as an extension to an ISMS. They left the call to go start a security certification they did not particularly want. In October 2025, ISO/IEC 27701:2025 was published, and the 2019 edition was withdrawn. That company would get a different answer today.

ISO 27701 vs 27001: The Dependency Is Gone

Where ISO 27001 manages risk to information, ISO 27701 manages risk to the people behind it. A perfectly encrypted database can still hold data that was collected without a purpose, kept too long, or handed to a vendor nobody briefed. The ISO 27701 standard addresses two roles: the PII controller, who decides why and how personal data is processed, and the PII processor, who handles it on a controller’s behalf. Most organizations are both.

Under the 2019 edition, those privacy requirements were bolted onto ISO 27001 clause by clause. Under 2025, the standard has its own complete set of ISO 27701 requirements in management system clauses (4 through 10) in the harmonized structure shared with ISO/IEC 27001:2022 and ISO/IEC 42001, its own privacy risk assessment in clause 6, and its own control set in Annex A. Organizations can still integrate the two standards into one management system. Most that already hold ISO 27001 will, but the prerequisite is gone.

ISO/IEC 27701:2025 Changes: 2019 vs 2025 at a Glance

There are no net-new control concepts in the 2025 edition; everything existed somewhere in 27701:2019 or ISO/IEC 27002:2022. What changed is where each requirement lives, every control number, and the fact that an organization can now be certified against them without a separate ISMS certificate. For anyone maintaining an ISO 27701 checklist or an evidence library keyed to the 2019 numbering, the remapping in Annex F is the single most useful page in the document.

What the Transition Looks Like in Practice

The transition runs three years from publication and ends in October 2028. Certification bodies have been completing their own accreditation transitions through 2026, so transition audits for 2019 certificate holders are available now and are usually folded into a scheduled surveillance or recertification visit, with some added audit time. The current certificate’s expiration date does not change; the transition does not start a new cycle.

Clients with an existing certificate ask the same question in different words: what actually has to change, and what carries over? In my experience, the answer splits cleanly. What carries over is the substance: the PII inventory, the processing purposes, the retention schedule, the data subject request process, the processor agreements, the breach notification procedure. If those worked under 2019, they work under 2025. What has to change is the scaffolding around them. The organization needs a change analysis against the new clauses, a gap assessment against Annex A, a Statement of Applicability rebuilt on the 2025 control numbers, an updated risk treatment plan, and an internal audit and management review that have looked at the revised PIMS before the auditor does.

The transition gap I see most often is structural rather than substantive. Organizations that certified under 2019 built their PIMS inside the ISMS: one risk register with privacy rows added, one SoA with 27701 columns appended, one internal audit program that touched privacy when it got to the relevant 27001 clause. That design was efficient and completely reasonable at the time. Under 2025, it means the PIMS has no independent clause 4 context, no standalone privacy risk assessment, and an SoA that cannot be read on its own. On one transition engagement, the privacy lead could answer every question I asked about processing activities but could not produce a document that described the PIMS scope without opening the ISMS manual. Nothing about their privacy practice was deficient; the management system simply had no shape of its own. Organizations in that position do not need to separate the two systems, but they do need the PIMS to be describable, auditable, and risk-assessed as a system in its own right.

AI, Biometrics, & Cross-Border Data Under ISO 27701:2025

The questions I field most this year are not about clause numbering. They are about AI features and international data flows, and the 2025 edition gives auditors more to work with on both. The dedicated privacy risk assessment in clause 6 expects the organization to consider risks to individuals from automated processing and profiling, not only risks to the organization from a breach. Annex B guidance for the controller and processor controls speaks more directly to sensitive categories such as biometric and health data, to transparency when decisions are automated, and to the legal basis and safeguards for transfers between jurisdictions.

In practice, this shows up as a new line of questioning in Stage 2. If a product uses a model to score, rank, or route individuals, I want to see that processing activity in the inventory, a purpose and legal basis attached to it, a risk entry that considers the people being scored, and a way for them to find out it is happening. If PII moves between countries, I want to see the transfer mechanism named and the sub-processor list current. Organizations whose ISO/IEC 27018 or GDPR work already covers these points will find the evidence exists; the work is connecting it to the PIMS.

What Auditors Are Already Seeing: Common PIMS Audit Findings

Certification bodies audit a PIMS under ISO/IEC 27706:2025, the privacy counterpart to ISO/IEC 27006-1, and the audit follows the same two-stage shape as ISO 27001. If you are building an ISO 27701 audit checklist, these are the components that generate findings:

• Role determination is not done per activity. A SaaS vendor that calls itself “a processor” is still the controller for its own employee and marketing data. I have watched more than one scope get rewritten on day one of Stage 1 for exactly that reason.
• The inventory does not match reality. On one engagement, the records of processing listed a marketing analytics vendor that had been offboarded two years earlier and omitted the support-ticket tool that held the most sensitive data in the company. The inventory is the backbone of the SoA, so gaps there cascade into everything else.
• Retention is a policy, not a practice. Nearly every client has a schedule that says data is deleted after a defined period. Far fewer can hand me a job log or ticket showing it ran. That is what gets sampled.
• Processor obligations are signed but not monitored. Controllers show me the data processing agreement and stop. The question is who checked the sub-processor list this year.
• Security gets thin in standalone programs. Mature privacy teams sometimes arrive with light evidence for access reviews, logging, or data classification. Annex A.3 does not care which department owns the control.

Is ISO 27701 Certification Worth It for Your Organization?

The standalone route tends to fit processors that already hold a SOC 2 and keep getting privacy questionnaires anyway; organizations already running ISO 27001 surveillance audits will almost always find integration more efficient. Either way, the certificate earns its keep only where customers ask for it.

My usual test: pull the last twelve months of customer security and privacy questionnaires and count how many asked about ISO 27701 or a privacy management framework. More than a handful, and the certificate will likely pay for itself in questionnaire time alone. Zero, and the budget probably belongs elsewhere. A certificate nobody requests is an expense, not a differentiator.

Frequently Asked Questions About ISO 27701

These are the questions I hear most often from organizations weighing ISO 27701 certification or planning the move from the 2019 edition.

What Is the Current Version of ISO 27701?

ISO/IEC 27701:2025, published in October 2025. This update replaced ISO/IEC 27701:2019, which has been withdrawn.

How Many Controls Are There in ISO 27701?

The 2025 edition has about 78 controls in Annex A, split into A.1 for PII controllers, A.2 for PII processors, and A.3 for the information security controls that apply to both. Which ones apply to a given organization is documented in its Statement of Applicability.

What Is the Difference Between ISO 27701 & 27001?

ISO 27001 addresses risk to information from the organization’s perspective. ISO 27701 addresses risk to the individuals behind the data and adds controller and processor requirements such as purpose limitation, consent, data subject rights, and processor instructions. Since 2025, the two are independent standards that share a structure and can run as one integrated system.

How Much Does It Cost to Get ISO 27701 Certified, & How Long Does It Take?

Cost depends on PIMS scope, PII volume and sensitivity, the roles in scope, locations and sub-processors, and whether the audit is standalone or combined with ISO 27001. On timing, an organization with a current ISO 27001 certificate can often add the PIMS within one audit cycle; a standalone PIMS starting from policies and a spreadsheet typically needs six to twelve months before Stage 1, mostly to build a reliable PII inventory and generate operating evidence.

Is There a Free Certification for ISO 27701?

No. ISO 27701 certification requires an audit by an accredited certification body, and the standard itself is purchased from ISO or a national standards body. Free self-assessments and readiness checklists exist, but they are not certification, and before relying on a vendor’s certificate, it is worth verifying it with the issuing body.

Privacy Certification Without the Prerequisite

ISO/IEC 27701:2025 removed the biggest structural barrier to privacy certification. For organizations with a real privacy program and customers who ask, the standalone option deserves a close look; for those already certified to ISO 27001, the harmonized structure makes adding privacy more efficient than it has ever been; and for 2019 certificate holders, the transition is mostly about giving the PIMS a shape of its own before October 2028. If you have questions about ISO 27701 compliance, the transition, or how a PIMS fits with the certifications you already hold, contact me today to learn more about our ISO 27701 certification services.