Demonstrable accountability
Evidence of how personal data is governed, for regulators and customers.
Certification support
ISO/IEC 27701 Privacy Information Management
Current edition: ISO/IEC 27701:2025 (standalone)
The privacy information management standard for organisations that act as controllers or processors of personal data. It gives privacy its own management system, with controls that map to GDPR and other data protection laws.
2025Standalone edition
ISO/IEC 27701 is now a standalone standard
The 2025 edition, published on 14 October 2025, turns ISO/IEC 27701 from an extension of ISO/IEC 27001 into its own certifiable management system. Organisations certified to the 2019 edition are expected to transition by October 2028. We run transition gap reviews and help you decide whether to run privacy standalone or integrated with your ISMS.
What the standard covers
Requirements, clause by clause
The 2025 edition has its own management system clauses and control tables for organisations acting as PII controllers, PII processors, or both.
4
Context
Role as controller and/or processor, interested parties, applicable law, PIMS scope.
5
Leadership
Commitment, privacy policy, roles and accountability.
6
Planning
Privacy risk assessment and treatment, Statement of Applicability, objectives.
7
Support
Resources, competence, awareness, communication, documented information.
8
Operation
Privacy risk assessment and treatment carried out.
9
Performance evaluation
Monitoring, internal audit, management review.
10
Improvement
Nonconformity, corrective action and continual improvement.
Control tables cover PII controllers, PII processors, and security controls drawn from ISO/IEC 27002.
Why organisations implement it
What a working PIMS delivers
Regulatory mapping
Controls mapped to GDPR and other data protection laws you operate under.
Processor assurance
A recognised answer to customers' data processing due diligence.
Privacy by design
Privacy risk assessed in new products, systems and suppliers.
Clear roles
Controller and processor responsibilities defined and evidenced.
Flexible setup
Run standalone, or integrated with ISO/IEC 27001 and ISO/IEC 42001.
How we work
Path to certification
One AEC methodology from first assessment to certificate, delivered by registered lead auditors.
- AssessGap assessment against ISO/IEC 27701:2025, scope and roadmap
- DesignProcesses, risk register, policy and documented information
- ImplementProcesses embedded with coaching for process owners
- TrainAwareness for all staff and internal auditor development
- VerifyInternal audit, management review and mock certification audit
- Certify & sustainStage 1 and Stage 2 support, then surveillance readiness
Full implementation
No existing system. We design and implement from the ground up.
Typically 6 to 9 monthsGap remediation
Some documentation in place. We close the gaps and prove effectiveness.
Typically 4 to 6 monthsUpgrade & integration
Transition from the 2019 edition, or adding privacy to your ISO/IEC 27001 system.
Typically 2 to 4 months
Who certifies
Independent certification, chosen to fit your market
Your ISO/IEC 27701 certificate is issued by an independent certification body accredited by UKAS, DAkkS or an equivalent national accreditation body. AEC prepares you for that audit; the certification decision is theirs.
CB-neutral
We are not tied to one certification body and help you select one to suit your customers and markets.
Audit-ready
Mock certification audit and closed corrective actions before Stage 1 and Stage 2.
No guarantees
We prepare you thoroughly and never promise an outcome only an independent auditor can decide.
Where it applies
ISO/IEC 27701 by industry
IT services · SaaS and cloud processors
Healthcare · patient and health data
Finance · customer and payment data
Education · student and staff records
Government · citizen data
Related standards
Training Academy
View ISO/IEC 27701 courses
ISO/IEC 27701 training
Delivered by practising, registered lead auditors. In-house, public, virtual or hybrid.
- Awareness (half day) for all staff
- Implementer (2 to 3 days) for system owners
- Internal Auditor (2 to 3 days) in line with ISO 19011
Questions
ISO/IEC 27701 FAQ
Does AEC issue the ISO/IEC 27701 certificate?
No. Certificates are issued by independent certification bodies accredited by UKAS, DAkkS or an equivalent national accreditation body. AEC prepares your organisation for that audit.
Do we still need ISO/IEC 27001?
Not for the 2025 edition. ISO/IEC 27701:2025 is a standalone management system. Organisations that already hold ISO/IEC 27001 often integrate the two to share risk management, audits and management review.
Does ISO/IEC 27701 make us GDPR compliant?
No standard does that on its own. ISO/IEC 27701 gives you a management system and controls that support compliance and provide evidence of accountability. We map your controls to the laws that apply to you.
We hold the 2019 edition. What now?
Plan the transition to ISO/IEC 27701:2025 before October 2028. We start with a gap review, then decide with you whether to run privacy as its own system or integrated with your ISMS.
Start your ISO/IEC 27701 programme
Tell us your data processing roles, systems and locations. We reply with a proposal covering PIMS design, implementation, training and certification support.
Certification decisions are made by independent, accredited certification bodies. AEC prepares organisations for certification and does not guarantee certification outcomes.