ISO/IEC 27701

1. Introduction

ISO/IEC 27701 is the international standard that extends an information security management system (ISMS) into a privacy information management system (PIMS). Published first in August 2019 as an amendment to ISO/IEC 27001 and ISO/IEC 27002, it provides a certifiable framework for organisations to demonstrate that they systematically manage the processing of personally identifiable information (PII). Rather than reinventing governance, ISO 27701 layers privacy-specific requirements and controls on top of an existing ISO 27001 ISMS, so that security and privacy are governed under a single, integrated management system.

For any organisation subject to the GDPR, the UK Data Protection Act, India's Digital Personal Data Protection Act (DPDP Act, 2023), the UAE PDPL, Brazil's LGPD, California's CCPA/CPRA or sector-specific privacy law, ISO 27701 offers a defensible, auditable way to operationalise those legal obligations. It is one of the very few privacy standards against which an accredited certification body can issue a certificate, making it a powerful trust signal for customers, regulators and partners. This guide provides an auditor-grade walkthrough of the standard's structure, an exhaustive master assessment checklist covering every clause and Annex control, and a practical implementation and audit approach.

2. What is ISO 27701

ISO/IEC 27701:2019, titled 'Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines', specifies the requirements for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS). It is intended to be used by all types and sizes of organisation, including public and private companies, government entities and not-for-profit organisations, that are PII controllers and/or PII processors processing PII within an ISMS.

The standard is deliberately built as an extension, not a stand-alone system. To be certified against ISO 27701, an organisation must have (or simultaneously achieve) an ISO 27001-conformant ISMS whose scope covers the processing of PII. ISO 27701 then:

• Modifies and augments the ISO 27001 clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation, improvement) with PII-specific requirements — for example requiring the scope to consider privacy obligations and the risk assessment to consider risks to PII principals.
• Provides privacy-specific implementation guidance that refines the 93 (2022 revision) / 114 (2013 revision) security controls of ISO 27002 as they apply to PII.
• Introduces two brand-new sets of privacy controls in its annexes: Annex A for organisations acting as PII controllers, and Annex B for organisations acting as PII processors.
• Maps its controls to the GDPR articles (Annex D), to ISO/IEC 29100 privacy principles (Annex C) and to ISO/IEC 27018 and ISO/IEC 29151 (Annex F).

A crucial concept is the distinction between a PII controller (the entity that determines the purposes and means of processing) and a PII processor (the entity that processes PII on behalf of a controller). ISO 27701 requires an organisation to determine its role — it may be a controller, a processor, or both for different processing activities — and to apply the corresponding Annex A and/or Annex B controls. The standard adopts the privacy terminology of ISO/IEC 29100, using 'PII principal' for the individual (the data subject) and 'PII' for personal data.

3. Who must comply

ISO 27701 certification is voluntary; no law mandates the certificate itself. However, it is adopted by organisations that need to demonstrate accountable, defensible privacy management. The following categories most commonly pursue it:

• Prerequisite: the organisation must already operate, or be building, an ISO 27001 ISMS — ISO 27701 cannot be certified in isolation.
• Scope trigger: any organisation that acts as a PII controller or PII processor and wants third-party assurance of its privacy programme is a candidate.
• Commercial driver: increasingly appearing as a contractual or tender requirement, and used to reduce the burden of bespoke customer privacy audits.

4. Structure of ISO 27701

ISO 27701 is organised into normative management-system clauses (which mirror and extend the ISO 27001 Annex SL structure), a refinement of the ISO 27002 controls, and two annexes of new privacy controls plus several informative mapping annexes. The table below summarises the full structure.

Annex A (controllers) groups its controls into four privacy control areas: A.7.2 Conditions for collection and processing; A.7.3 Obligations to PII principals; A.7.4 Privacy by design and privacy by default; and A.7.5 PII sharing, transfer and disclosure. Annex B (processors) groups its controls into: B.8.2 Conditions for collection and processing; B.8.3 Obligations to PII principals; B.8.4 Privacy by design and privacy by default; and B.8.5 PII sharing, transfer and disclosure.

5. Master assessment checklist

This is the core of the guide. It enumerates every management-system clause requirement and every Annex A (controller) and Annex B (processor) control. For each group we give what an auditor must verify and the typical evidence expected. No control area is skipped. Organisations should apply the management clauses and ISO 27002 refinements universally, Annex A if they are a controller, and Annex B if they are a processor.

5.1 Clause 4 — Context of the organisation (PIMS)

5.2 Clause 5 — Leadership (PIMS)

5.3 Clause 6 — Planning (PIMS)

5.4 Clause 7 — Support (PIMS)

5.5 Clause 8 — Operation (PIMS)

5.6 Clause 9 — Performance evaluation (PIMS)

5.7 Clause 10 — Improvement (PIMS)

5.8 ISO 27002 privacy refinement (Clause 6.2 guidance)

5.9 Annex A.7.2 — Conditions for collection and processing (Controllers)

5.10 Annex A.7.3 — Obligations to PII principals (Controllers)

5.11 Annex A.7.4 — Privacy by design and privacy by default (Controllers)

5.12 Annex A.7.5 — PII sharing, transfer and disclosure (Controllers)

5.13 Annex B.8.2 — Conditions for collection and processing (Processors)

5.14 Annex B.8.3 — Obligations to PII principals (Processors)

5.15 Annex B.8.4 — Privacy by design and privacy by default (Processors)

5.16 Annex B.8.5 — PII sharing, transfer and disclosure (Processors)

6. Scoping

Scoping the PIMS correctly is decisive: too narrow and the certificate misleads stakeholders; too broad and the programme becomes unmanageable. Because ISO 27701 extends ISO 27001, the PIMS scope must be a subset of, or aligned to, the ISMS scope, and it must be expressed in terms of PII processing.

• Determine the role(s): identify for each processing activity whether the organisation is a PII controller, a PII processor, or both. This dictates whether Annex A, Annex B, or both apply.
• Inventory PII processing activities: catalogue what PII is processed, for what purposes, by which systems, in which locations, and for which categories of PII principals.
• Map data flows and boundaries: include internal systems, sub-processors, cloud services and cross-border transfers within scope.
• Align to the ISMS: the PIMS scope statement should reference the underlying ISO 27001 scope; PII processing outside the ISMS boundary must be brought in or explicitly excluded with justification.
• Document interfaces and dependencies: outsourced processing, shared services and joint-controller arrangements must be identified.
• Produce a Statement of Applicability that spans ISO 27001 Annex A plus ISO 27701 Annex A and/or Annex B, with rationale for inclusion or exclusion of each control.

7. Implementation approach

A phased implementation keeps the programme controlled and evidences maturity to the certification body. The following five phases assume an ISO 27001 ISMS either exists or is being built in parallel.

Phase 1 — Initiation and gap assessment

• Activities: obtain leadership sponsorship; confirm ISO 27001 status; determine controller/processor roles; run a gap assessment against Clauses 4-10 and Annex A/B; identify applicable laws (GDPR, DPDP, PDPL, LGPD).
• Deliverables: gap-assessment report, role-determination record, applicable-law register, project charter and plan.

Phase 2 — Design and documentation

• Activities: define PIMS scope; write the privacy policy and supporting procedures; establish the PII risk methodology; build the record of processing activities (ROPA); draft the Statement of Applicability.
• Deliverables: PIMS scope statement, privacy policy suite, ROPA, risk methodology, draft SoA.

Phase 3 — Risk assessment and treatment

• Activities: perform PII risk assessment (impact to individuals and organisation); conduct DPIAs for high-risk processing; select and plan Annex A/B controls; produce the risk treatment plan.
• Deliverables: PII risk register, DPIA reports, risk treatment plan, finalised SoA.

Phase 4 — Control implementation and operation

• Activities: implement lawful-basis and consent management, privacy notices, DSAR handling, retention and deletion, transfer mechanisms, sub-processor management, privacy-by-design gates and training/awareness.
• Deliverables: operational privacy controls, consent/DSAR tooling, retention schedule, transfer register, awareness records.

Phase 5 — Internal audit, review and certification

• Activities: run internal audits across all clauses and applicable controls; hold management review; remediate findings; select an accredited certification body; undergo Stage 1 (documentation) and Stage 2 (implementation) audits.
• Deliverables: internal audit report, management review minutes, corrective-action closure, certification-readiness pack, ISO 27701 certificate.

8. Maturity / capability model

ISO 27701 does not itself define a maturity scale, but auditors and consultants routinely assess PIMS control implementation against a five-level capability model to prioritise remediation. The scale below is a practical assessment aid.

For certification, controls should be at Level 3 (Defined) as a minimum and demonstrably operating; Levels 4 and 5 evidence the continual-improvement expectations of Clauses 9 and 10.

9. Assessment and audit approach

1. Confirm prerequisites: verify a conformant ISO 27001 ISMS exists (or is audited concurrently) and that its scope covers the PII processing to be certified.
2. Stage 1 audit (readiness / documentation review): the certification body reviews the PIMS scope, policy, ROPA, SoA, risk assessment and internal-audit and management-review evidence to confirm readiness.
3. Address Stage 1 findings: remediate documentation gaps and confirm the SoA correctly reflects controller/processor roles.
4. Stage 2 audit (implementation / effectiveness): auditors sample evidence to confirm controls are implemented and operating — tracing lawful basis, consent, DSAR handling, retention, transfers and sub-processor oversight.
5. Raise and classify findings: nonconformities are recorded as major or minor; observations note improvement opportunities.
6. Corrective action: the organisation performs root-cause analysis and implements corrections within agreed timeframes; major nonconformities must be cleared before certification.
7. Certification decision: an independent reviewer at the certification body grants the ISO 27701 certificate, typically valid for three years.
8. Surveillance audits: conducted (usually annually) to confirm continued conformance and improvement.
9. Recertification: a full audit before the three-year certificate expires.

10. Evidence request list

Auditors will request evidence across the following categories. Prepare these in an indexed evidence repository mapped to clauses and controls.

• Governance: PIMS scope statement, privacy policy, DPO/role appointments, RACI, management review minutes.
• Records and inventory: record of processing activities (ROPA), PII inventory, data-flow maps, role-determination records.
• Risk and impact: PII risk methodology and register, risk treatment plan, DPIA reports, Statement of Applicability.
• Lawful basis and consent: lawful-basis register, legitimate-interests assessments, consent capture and withdrawal logs.
• Transparency: privacy notices at all collection points, layered notice evidence.
• Individual rights: DSAR log and workflow, objection/erasure/portability handling records, response-time SLAs.
• Data lifecycle: retention schedule, deletion/de-identification logs, secure-disposal certificates.
• Transfers and sharing: cross-border transfer register (SCCs/adequacy/BCRs), disclosure log, lawful-disclosure records.
• Third parties: data processing agreements, sub-processor register and authorisations, supplier assessments.
• Security refinements: access reviews, encryption/key-management, log-masking, incident and breach-notification records.
• Assurance: internal audit reports, competence/training records, awareness campaign evidence, corrective-action register.

11. Roles and responsibilities

12. KPIs to track

• Percentage of processing activities with a documented lawful basis and complete ROPA entry.
• Data-subject rights requests (DSARs) closed within the statutory/target timeframe.
• Mean and maximum DSAR response time.
• Number of DPIAs completed for high-risk processing versus triggers identified.
• Percentage of PII assets covered by the retention schedule and subject to automated deletion.
• Consent capture and withdrawal success rates; percentage of records with valid, demonstrable consent where consent is the basis.
• Number and severity of privacy incidents and personal-data breaches; time to detect and to notify.
• Percentage of processors/sub-processors under a signed data processing agreement.
• Privacy training completion rate and awareness assessment scores.
• Open versus closed corrective actions from internal and external audits, and their ageing.
• Cross-border transfers covered by a valid transfer mechanism.

13. Readiness checklist

• ISO 27001 ISMS is in place and its scope covers the PII processing to be certified.
• Controller/processor role determined and documented for every processing activity.
• PIMS scope statement and privacy policy approved and communicated.
• Record of processing activities (ROPA) complete and current.
• PII risk assessment (including impact to individuals) and treatment plan completed.
• Statement of Applicability covers ISO 27001 Annex A plus ISO 27701 Annex A and/or B with justifications.
• Lawful basis identified and consent management operational where required.
• Privacy notices published at all collection points.
• DSAR / individual-rights process implemented and tested with SLAs.
• Retention schedule, deletion and secure-disposal processes operating.
• Cross-border transfer mechanisms and transfer register in place.
• Data processing agreements signed with all processors and sub-processors.
• DPIA process defined with clear trigger criteria.
• Privacy-by-design gates integrated into project and change processes.
• Staff trained; awareness evidence retained.
• Internal audit and management review of the PIMS completed with actions closed.
• Accredited certification body engaged for Stage 1 and Stage 2 audits.

14. Common gaps

• Treating ISO 27701 as a stand-alone standard and attempting certification without a valid ISO 27001 ISMS.
• Incomplete or outdated ROPA that does not reflect actual processing or new systems.
• Risk assessment considering only organisational risk and ignoring impact on PII principals.
• SoA that omits or fails to justify Annex A/B controls, or applies the wrong annex for the organisation's role.
• Privacy notices that are generic, out of date, or missing at some collection points.
• DSAR handling that lacks defined SLAs, evidence trail, or portability/erasure capability.
• No retention schedule, so PII is kept indefinitely; deletion not evidenced.
• Cross-border transfers occurring without a documented, valid transfer mechanism.
• Sub-processors engaged without controller authorisation or without flow-down obligations.
• Consent that cannot be demonstrated (no timestamps, wording or withdrawal mechanism).
• Privacy-by-design not embedded — controls bolted on after systems go live.
• DPIAs not triggered or not performed for genuinely high-risk processing.
• Weak sub-processor change notification, denying customers a chance to object.

15. ISO 27701 mapped to other frameworks

16. How CyberSigma helps

Frequently asked questions

Need help with ISO 27701?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.