ISO & IEC / Requirements and guidance
ISO/IEC 27701:2025 Manage personal information responsibly
ISO/IEC 27701 specifies a management approach for organizations acting as controllers or processors of personally identifiable information. It helps align privacy responsibilities, decisions and improvement across the information life cycle.
The place in the system
Where it fits
It can be integrated with an ISMS but stands as its own management-system standard; it is a useful bridge to future legal and privacy-framework pages.
Practical interpretation
How to use this reference
These are editorial starting points, not copied requirements or an implementation checklist from the standard.
Questions and actions
- Map personal-information processing and the parties responsible for it.
- Assign decisions for collection, use, sharing, retention and deletion.
- Review privacy incidents and process changes against the management approach.
Evidence to look for
- Personal-information processing inventory
- Controller-processor responsibility map
- Privacy review and improvement record
Illustrative example
What it could look like
A service provider processes customer data in several regions and relies on subcontractors. It records the processing, assigns controller and processor duties, and reviews how changes affect privacy risk.
Boundary to keep clear
Do not describe the 2025 edition as only a 27001 extension, and do not imply that PIMS certification automatically proves GDPR compliance.
Source and edition check
Open the official record
Research checked 2026-10-20. Catalogue status and edition can change; the official publisher record controls. Full standard text is not reproduced here.