ISO/IEC 27701:2025 turned the privacy information management system (PIMS) from an extension of ISO/IEC 27001 into a standalone management system standard, and every organisation certified to the 2019 edition now has a fixed window to transition. ISO published the second edition on 14 October 2025 and lists the 2019 edition as withdrawn. Accreditation bodies have set 31 October 2028 as the date by which certification bodies must move all certified clients to the 2025 edition. This guide explains what changed, what the transition deadlines are, how to run a gap analysis and transition audit, where identity and non-human identity controls fit, and how to map the new PIMS to ISO/IEC 27001, GDPR and NIST. It is for privacy managers, ISMS owners and auditors. The standard itself is introduced in the ISO/IEC 27701 Privacy Information Management Guide; this page covers the move to 2025.
Status checked 27 October 2026 on iso.org and accreditation body notices (SAC Singapore and SCC Canada). Check your own certification body's transition rules, which may set earlier internal dates.
Key takeaways
- Standalone, not an extension: ISO describes the 2025 edition as an independent management system standard that can be used alone, while still aligning with an ISO/IEC 27001 ISMS.
- Fixed deadlines: certification bodies must complete their own transition by 31 October 2027 and transition all certified clients by 31 October 2028, according to the SAC and SCC notices.
- A new certification body standard: ISO/IEC 27706:2025 replaces ISO/IEC TS 27006-2:2021 for bodies that audit and certify PIMS.
- No ISMS certificate needed first: SCC notes that clients no longer need a certified ISMS before applying for PIMS certification.
- The work is mostly management system work: SCC lists the harmonised structure, stronger leadership, governance, performance evaluation, privacy risk management and climate change considerations, and clarified controller and processor controls.
What it is and who it applies to
| Item | ISO/IEC 27701:2019 | ISO/IEC 27701:2025 |
|---|---|---|
| Status (iso.org) | Withdrawn | Published, edition 2, October 2025 (64 pages) |
| Full title | Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management | Information security, cybersecurity and privacy protection: Privacy information management systems, Requirements and guidance |
| Relationship to ISO/IEC 27001 | Extension: PIMS built on an ISMS | Standalone management system standard that aligns with an existing ISMS |
| Structure | Clauses extending 27001 and 27002 text | ISO harmonised structure (per SCC) |
| Audience | PII controllers and processors | PII controllers and processors |
| Certification body standard | ISO/IEC TS 27006-2:2021 | ISO/IEC 27706:2025, following the structure of ISO/IEC 17021-1 |
| Committee | ISO/IEC JTC 1/SC 27 | |
Who must act: any organisation holding a 2019 PIMS certificate, any organisation planning PIMS certification (new certificates should be to 2025 once the certification body has transitioned), and processors whose customers ask for 27701 evidence in contracts.
Who does not have to act: organisations using 27701 informally as a reference framework have no deadline, although the 2019 text is withdrawn and should be replaced in internal policies.
Transition timeline
| Date | Milestone | Source |
|---|---|---|
| 14 October 2025 | ISO/IEC 27701:2025 and ISO/IEC 27706:2025 published | iso.org; SAC |
| December 2026 | Accredited PIMS certification bodies submit transition plans, gap analyses and evidence to SCC (Canada), unless SCC directs otherwise | SCC |
| 31 October 2027 | Accredited certification bodies complete their own transition (to 27706:2025) | SAC; SCC |
| 31 October 2028 | Certification bodies must have transitioned all certified clients to 27701:2025 | SAC; SCC |
SCC states that certifications to the 2025 edition can begin once the certification body's ISO/IEC 27706 transition is complete. In practice, ask your certification body now when it expects accreditation to 27706 and whether it will transition you at a surveillance audit, a recertification audit or a special visit. Plan to transition well before October 2028: audit slots near the deadline will be scarce, and a lapsed 2019 certificate cannot simply be renewed.
SAC also notes that certification bodies receive separate standalone accreditation for PIMS and ISMS after transition, which reflects the decoupling of the two schemes.
Structure and key requirements
Because the 2025 edition follows the harmonised structure, its requirements clauses read like any other ISO management system standard: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement (clauses 4 to 10 in the harmonised structure). The practical differences for a 2019 holder:
- Own scope and context: the PIMS needs its own scope statement, interested parties (data subjects, supervisory authorities, customers acting as controllers) and internal and external issues, rather than borrowing the ISMS scope.
- Leadership and policy: a privacy policy and roles approved by top management, including whoever acts as the privacy lead or DPO.
- Privacy risk management: SCC highlights strengthened privacy risk management. Expect to show a privacy risk assessment and treatment process that considers risks to individuals, not only information security risk to the organisation.
- Climate change consideration: as with other harmonised structure standards that adopted the climate action amendment, determine whether climate change is a relevant issue (often documented as not significant for privacy, with reasoning).
- Performance evaluation: privacy objectives with measurable results, internal audit and management review of the PIMS in its own right.
- Controller and processor controls: SCC states that controller and processor controls were clarified. Re-map your Statement of Applicability against the control set in the published text rather than assuming the 2019 numbering carries over.
Integrated or separate? If you already run an ISO/IEC 27001:2022 ISMS, an integrated management system (shared document control, internal audit and management review) is usually cheaper to run. A separate PIMS suits organisations whose privacy scope is wider or narrower than the ISMS scope, or processors who want PIMS certification without an ISMS certificate.
Identity and NHI requirements
27701 does not name identity products, but most PII controls are enforced through identity and access management. These are the areas auditors test, and where non-human identities are usually the gap:
| PIMS concern | Human identity evidence | Non-human identity evidence |
|---|---|---|
| Access to PII limited to purpose | Role-based access to PII stores; quarterly access reviews | Service accounts and API keys reading PII listed with owner and purpose; scopes limited to required tables or fields |
| Processor obligations to customers | Support staff access to customer data logged and approved | Integration tokens into customer tenants scoped and revocable; inventory per customer |
| Disclosure to third parties and subprocessors | Approval workflow for data sharing | OAuth apps and SaaS connectors with PII access reviewed; unused grants removed |
| Retention and deletion | Administrators who can bypass retention controlled through PAM | Deletion and archive jobs run under dedicated identities with logged actions |
| Logging of PII access | User access logs retained and reviewed | Application and agent access to PII attributed to a specific workload identity, not a shared account |
AI agents and copilots that query PII are processing operations in their own right: record their purpose, the identity they run under and the data they can reach. See the Data Access Governance Guide and the DSAR Guide: Handling Data Subject Requests for the operational processes auditors sample.
Implementation steps
- Buy and read the 2025 text (ISO, or your national standards body) and confirm with your certification body its 27706 accreditation date and transition method.
- Gap analysis: compare the current PIMS against each 2025 clause and control. Mark items as unchanged, re-worded, new, or moved. Typical new work: standalone scope, context, privacy objectives, privacy risk process, and climate consideration.
- Decide integrated or separate and update the management system manual accordingly.
- Update the privacy risk assessment to cover risks to PII principals, using your existing DPIA method where it fits.
- Rebuild the Statement of Applicability against the 2025 control set, with justification for exclusions and links to evidence.
- Update policies and procedures that cite 2019 clause numbers; update contracts and customer assurance packs that reference "ISO/IEC 27701:2019".
- Run an internal audit against the 2025 edition and a management review that records the transition decision and resources.
- Transition audit with the certification body, then close any nonconformities within its stated timescales.
Gap analysis worksheet. Record each requirement in a register like the one below so the transition audit can trace every change:
| 2025 requirement area | Current 2019 evidence | Gap rating | Action and owner |
|---|---|---|---|
| PIMS scope and context | Shared ISMS scope statement | New | Draft standalone scope with controller and processor roles; privacy lead |
| Privacy objectives | ISMS objectives with one privacy KPI | Changed | Set measurable PIMS objectives; management review to approve |
| Privacy risk process | ISMS risk register, DPIAs held separately | Changed | Link DPIA outputs to a PIMS risk treatment plan; risk owner |
| Climate change consideration | None | New | Document relevance assessment in context analysis |
| Controller and processor controls | 2019 SoA | Changed | Re-map SoA to 2025 control set; compliance team |
| Internal audit | Combined ISMS audit programme | Changed | Add PIMS audit criteria to programme; internal audit lead |
Controllers and processors decide differently. A processor certifying mainly to satisfy customer due diligence should prioritise the processor controls, subprocessor management and customer-facing evidence, and can now certify the PIMS without an ISMS certificate. A controller should prioritise lawful basis records, data subject rights handling and DPIA integration, because regulators and data subjects test those first. Organisations that act as both, which is common for SaaS providers, must record the role for each processing activity in scope, since auditors check that the right control set is applied to each.
Rollback and continuity: keep the 2019 certificate and documentation set under version control until the certification body issues the 2025 certificate. If the transition audit raises major nonconformities, the existing certificate remains the reference for customers until they are closed, provided it has not expired.
Small versus large organisations: a small processor with a single product can usually complete the gap analysis in a few weeks and transition at its next surveillance audit. A multinational controller with country-specific privacy teams should run a pilot entity first, then roll the updated manual and SoA out by region, and keep the 2019 certificate valid until the transition audit is passed.
Evidence and assessment
| Evidence item | What auditors look for |
|---|---|
| PIMS scope and context | Standalone scope, interested parties, controller or processor role per processing activity |
| Privacy policy and roles | Top management approval, named privacy lead, communication to staff |
| Privacy risk assessment and treatment | Risks to individuals, treatment decisions, owners, links to DPIAs |
| Statement of Applicability | All 2025 controls addressed, justified exclusions, evidence references |
| Records of processing | Current, complete and consistent with the SoA; see the Data Mapping and ROPA Guide |
| Data subject request records | Timeliness, verification, outcomes |
| Supplier and subprocessor records | Contracts, assessments, transfer mechanisms |
| Internal audit and management review | Against the 2025 edition, with actions tracked |
Metrics that show the PIMS is working: percentage of processing activities with a current risk assessment; DSAR completion within the statutory deadline; number of non-human identities with PII access and no owner (target zero); supplier assessments overdue; internal audit findings closed on time.
Mapping to other frameworks
| PIMS area | ISO/IEC 27001:2022 | GDPR | NIST |
|---|---|---|---|
| Privacy policy and roles | Clause 5; A.5.1, A.5.2 | Art. 24, Arts. 37-39 (DPO) | CSF 2.0 GV.PO-01, GV.RR-02 |
| Privacy risk assessment | Clause 6.1 | Art. 35 (DPIA) | SP 800-53 RA-8 Privacy Impact Assessments |
| Records of processing | A.5.9 Inventory of information | Art. 30 | CSF 2.0 ID.AM-07 |
| Access to PII | A.5.15, A.5.18, A.8.3 | Art. 32 | SP 800-53 AC-6; CSF 2.0 PR.AA-05 |
| Privacy and protection of PII | A.5.34 | Art. 5, Art. 25 | SP 800-53 PT-2, PT-3 |
| Processors and suppliers | A.5.19 to A.5.22 | Art. 28 | CSF 2.0 GV.SC-05 |
See the GDPR Compliance Guide for Security Teams. A 27701 certificate supports, but does not by itself prove, GDPR compliance.
Common pitfalls
- Waiting for the deadline: transition audits cluster in 2028 and certification bodies run out of auditor time.
- Copying the ISMS scope: the PIMS scope must reflect where PII is processed and in which role, which often differs from the ISMS boundary.
- Carrying 2019 control numbers forward: SoAs and contracts that cite old clause references confuse auditors and customers.
- Information security risk only: a risk register that lists threats to the company but not harms to individuals will not satisfy strengthened privacy risk requirements.
- Ignoring non-human access to PII: service accounts, integrations and AI agents with broad PII read access and no owner are a frequent audit finding.
- Assuming certificate equals compliance: regulators assess GDPR obligations directly.
Practitioner checklist
- Confirm your certification body's 27706 accreditation date and transition approach in writing.
- Obtain the 2025 text and complete a clause-by-clause gap analysis.
- Decide integrated or separate management system and document the decision.
- Write a standalone PIMS scope, context and interested parties analysis.
- Update the privacy risk assessment to cover risks to individuals.
- Rebuild the Statement of Applicability against the 2025 controls.
- Inventory human and non-human identities with PII access, with owner and purpose.
- Update policies, contracts and assurance packs that cite the 2019 edition.
- Run an internal audit and management review against 2025 before the transition audit.
- Book the transition audit well before 31 October 2028.
Standards and references
- ISO: ISO/IEC 27701:2025 Privacy information management systems, Requirements and guidance
- ISO: ISO/IEC 27706:2025 Requirements for bodies providing audit and certification of PIMS
- Standards Council of Canada: Update to Privacy Information Management System Standard
- Singapore Accreditation Council: Transition to new PIMS standard
- BSI: ISO/IEC 27701 Privacy Information Management
- EUR-Lex: Regulation (EU) 2016/679 (GDPR)
Related NHI Mgmt Group resources: ISO/IEC 27701 Privacy Information Management Guide · GDPR Compliance Guide for Security Teams · Data Mapping and ROPA Guide · Security Standards Tracker. This guide summarises the ISO/IEC 27701:2025 transition and is not legal advice.