QULDEXResources · Glossary
ISO 27701 definition: the privacy management standard
What does ISO 27701 mean?
ISO 27701 gives privacy the same management system treatment that ISO 27001 gives information security: scope, roles, risk, controls, audit and improvement, applied to personal data.
It is a standard, not a law. It helps an organisation organise and evidence its privacy practices, but it does not replace legal obligations under GDPR, the DPDP Act or other privacy laws.
Who does ISO 27701 apply to?
The organisation that determines why and how personal data is processed.
The organisation that processes personal data on a controller's behalf.
A company is usually a controller for its own staff and customers and a processor for its clients.
What does the standard ask an organisation to do?
Typical activities in a privacy information management system.
| Activity | What it involves |
|---|---|
| Know your data | Record what personal data is processed, why, and on what basis |
| Assess risk | Assess privacy risks to individuals as well as to the organisation |
| Apply controls | Controls for controllers, processors or both |
| Respond | Handle requests from individuals and personal data breaches |
| Check | Internal audit and management review |
This is an illustration written for this page, not a customer record.
ISO 27701: key facts
| Topic | Detail | Notes |
|---|---|---|
| Current edition | 2025 | ISO/IEC 27701:2025 replaced the 2019 edition. |
| Change in 2025 | Standalone | The 2019 edition was an extension to ISO 27001; the 2025 edition is a management system standard in its own right. |
| Relationship to law | Supports, does not replace | Helps evidence compliance with privacy laws such as GDPR. |
| Related | ISO/IEC 27001 | Many organisations run the two systems together. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What do people get wrong about ISO 27701?
'It makes us GDPR compliant'
A certificate is not a legal finding of compliance.
Instead: use it to organise and evidence your obligations.
Quoting the 2019 edition
Older material describes it only as an extension of ISO 27001.
Instead: check which edition a document refers to.
Ignoring the processor role
Organisations assess only their controller duties.
Instead: identify where you act as each.
How does QULDEX handle this?
One control and one piece of evidence count towards every framework they apply to.
ISO 27701: common questions
What is a PIMS?
A privacy information management system: the policies, processes, roles and controls an organisation uses to manage how it handles personal data.
Do you need ISO 27001 before ISO 27701?
Under the 2019 edition, yes. The 2025 edition is a standalone standard. Check your certification body's current rules for the edition you are certifying against.
Is ISO 27701 required by GDPR?
No. GDPR does not require any ISO standard, though a management system can help demonstrate accountability under Article 5(2).
Sources
- ISO/IEC 27701:2025, Privacy information management systems: Requirements and guidance
- ISO/IEC 27001:2022, Information security management systems: Requirements
- Regulation (EU) 2016/679 (General Data Protection Regulation)
- ISO/IEC 17021-1:2015, Requirements for bodies providing audit and certification of management systems
Privacy and security audits from one control set
Controls, evidence, findings and corrective actions in one audit workspace.