ISO 27701:2025 mandatory documents
ISO/IEC 27701:2025 follows the harmonized management system structure and requires documented information including: the scope of the privacy information management system (4.3), the privacy policy (5.2), the privacy risk assessment and treatment processes and results (6.1 and clause 8), the Statement of Applicability for the Annex A controls, privacy objectives (6.2), and records of competence, monitoring, internal audit, management review and corrective actions. The Annex A controls add privacy-specific records such as records of processing.
Documents required by clause
| Document | Clause | What it is for |
|---|---|---|
| Scope of the privacy information management system | 4.3 | Which processing, processes and roles (controller, processor) are covered |
| Privacy policy | 5.2 | Management commitments and framework for objectives |
| Privacy risk assessment process | 6.1 | Criteria to identify and evaluate risks to the organization and to individuals |
| Risk treatment process and Statement of Applicability | 6.1 | Controls selected from tables A.1, A.2 and A.3, justification of inclusions and exclusions, status |
| Privacy objectives | 6.2 | Measurable targets and plans to achieve them |
| Evidence of competence | 7.2 | Training and experience of people who process personal data |
| Information for operation | 8.1 | What is needed to be confident processes run as planned |
| Risk assessment and treatment results | 8 | Up-to-date risk register and treatment plan |
| Monitoring and measurement results | 9.1 | Indicators and their analysis |
| Internal audit programme and results | 9.2 | Plan, reports and findings |
| Management review results | 9.3 | Management decisions and actions |
| Nonconformities and corrective actions | 10.2 | What went wrong, cause, action and result |
Clause 7.5 adds whatever documented information the organization itself considers necessary. Use this list as a guide and check each requirement in the official text of the standard, sold by ISO or your national standards body.
Privacy records driven by Annex A controls
- **Records of processing** as controller and as processor: purpose, lawful basis, categories of data and individuals, recipients, transfers and retention periods.
- **Privacy impact assessments (DPIAs)** for high-risk processing.
- **Log of data subject requests** (access, correction, deletion, objection) with dates and responses.
- **Breach and incident log** with assessment and notifications.
- **Log of transfers and disclosures** to third parties and other countries.
- **Contracts with processors and subprocessors** and evidence of their review.
- **Current privacy notices** and evidence of consent where that is the basis.
Common mistakes
- Copying the 2019 Statement of Applicability: in 2025 the controls were reorganized into tables A.1, A.2 and A.3.
- Defining the scope without saying where the organization is a controller and where it is a processor.
- Assessing risk only for the company and not for the people whose data is processed.
- Having approved policies but no records showing they are applied (requests, breaches, training).
- Assuming certification proves compliance with a specific law such as the GDPR or the CCPA.
How to organize the documentation
Organize documents by clauses 4 to 10, with a master index showing the owner, version and review date of each. If you already run an ISO/IEC 27001 ISMS, share document control, internal audit and management review, and add the privacy-specific parts: controller and processor roles, records of processing, DPIAs, data subject rights and the ISO/IEC 27701 Statement of Applicability.
Frequently asked questions
How many mandatory documents does ISO 27701 have?
It depends on how you group them, but clauses 4 to 10 call for about a dozen documents and records, and the Annex A controls you apply add privacy records such as records of processing.
Are records of processing mandatory?
Annex A controls for controllers and processors call for them, and many laws (such as GDPR article 30) require them or make them the practical way to show lawful processing.
Can I reuse my ISO 27001 ISMS documents?
Yes. Since 2025 ISO/IEC 27701 is standalone, but it integrates with an ISMS: you can share document control, audits and management review.
Do the documents guarantee certification?
No. Certification depends on the system working and being verified by a certification body.
Related guides
- ISO 27001:2022 mandatory documents: list by clause
- ISO 27001 Statement of Applicability (SoA): what it is and how to write it
- ISO 27701:2025: what changed and what to do now
Updated: 2026-10-20