ISO 27701:2025: what changed and what to do now
ISO/IEC 27701:2025, published on 14 October 2025, turns the privacy standard into a standalone management system: you no longer need an ISO/IEC 27001 ISMS to implement or certify it. It follows the harmonized structure of clauses 4 to 10 and has an Annex A with 78 reference controls in three tables: A.1 for PII controllers, A.2 for PII processors and A.3 for the security of personal data. Organizations certified to the 2019 edition must transition within the period set by accreditation bodies (for example, by 31 October 2028 in Canada's SCC rules).
2019 vs 2025 at a glance
| Topic | ISO/IEC 27701:2019 | ISO/IEC 27701:2025 |
|---|---|---|
| Type of standard | Extension to ISO/IEC 27001 and 27002 | Standalone management system standard |
| Prerequisite | An ISO/IEC 27001 ISMS | None (it can still be integrated with an ISMS) |
| Structure | Clauses mapped onto ISO/IEC 27001 | Harmonized structure, clauses 4 to 10 |
| Controls | Annex A (controllers) and Annex B (processors), plus extended ISO/IEC 27002 guidance | Annex A with three tables: A.1 controllers, A.2 processors, A.3 security of PII (78 controls) |
| Guidance | Spread across clauses 6 to 8 | Annex B, with the same numbering as Annex A |
| Mappings | ISO/IEC 29100, GDPR, other standards | Informative annexes with mappings, including GDPR and a 2019-to-2025 correspondence |
What it means for you
- **Not certified to ISO/IEC 27001?** You can now implement and certify a privacy information management system (PIMS) on its own. This is useful for SaaS providers, HR and payroll processors, health and education services and anyone whose customers ask for privacy assurance.
- **Already have an ISMS?** Reuse document control, internal audit, management review, supplier management and competence. The security controls you need for personal data are now in table A.3.
- **Certified to the 2019 edition?** Plan a transition audit. Check the deadline with your certification body: accreditation bodies set the dates (Canada's SCC: clients by 31 October 2028).
- **Using ISO 27701 for GDPR?** It still helps you organize and evidence compliance, but certification does not by itself prove GDPR compliance.
The Annex A tables in 2025
| Table | For | Main topics |
|---|---|---|
| A.1 | PII controllers | Conditions for collection and processing (lawful basis, consent, DPIA, records), obligations to PII principals (notices, rights, automated decisions), privacy by design and by default, sharing, transfers and disclosures |
| A.2 | PII processors | Contracts and instructions, obligations to customers, privacy by design for processing, transfers, subprocessors and disclosures |
| A.3 | Both roles | Security of personal data: policies, roles, access, cryptography, logging, incidents and breaches, backups, suppliers, secure development and more |
Most organizations are both controller and processor (for example, for their own staff and for customer data), so they apply A.1, A.2 and A.3 and justify each inclusion or exclusion in the Statement of Applicability.
Transition steps for 2019-certified organizations
- 1. Read the 2025 edition and its 2019-to-2025 correspondence annex.
- 2. Decide whether your PIMS stays integrated with the ISMS or becomes standalone, and update the scope.
- 3. Rebuild the Statement of Applicability with the A.1, A.2 and A.3 tables.
- 4. Update the privacy risk assessment, policies and procedures that cite the old clause numbers.
- 5. Run an internal audit and a management review on the new requirements.
- 6. Book the transition audit with your certification body before the deadline.
Frequently asked questions
When was ISO/IEC 27701:2025 published?
On 14 October 2025. It replaces the 2019 edition.
Do I need ISO 27001 to get ISO 27701 certified?
Not with the 2025 edition. It is a standalone management system standard, although it integrates easily with ISO/IEC 27001.
How many controls does ISO 27701:2025 have?
Annex A lists 78 reference controls in three tables: A.1 for controllers, A.2 for processors and A.3 for the security of personal data. You justify which ones apply in your Statement of Applicability.
What is the transition deadline?
Accreditation bodies set it. For example, Canada's SCC requires certified clients to transition by 31 October 2028. Ask your certification body for yours.
Does ISO 27701 certification prove GDPR compliance?
No. It is strong evidence of a managed privacy program, but GDPR compliance depends on meeting each legal obligation.
Related guides
- ISO 27001:2022 mandatory documents: list by clause
- ISO 27001 Statement of Applicability (SoA): what it is and how to write it
- What is an ISMS and how do you implement it with ISO 27001?
Updated: 2026-10-20