Overview
ISO/IEC 27701:2025 defines requirements and guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS). The 2025 edition is an independent management-system standard that can be integrated with an ISMS. Organizations should determine responsibilities for each processing activity rather than assuming a single role across all personal-information use.
This guide reflects ISO/IEC 27701:2025. ISO/IEC 27701:2019 has been withdrawn; older practice items may use the previous edition’s terminology and structure.
Study map
- ScopePIMS boundaries, activities and organizational context
- RolesPII controller and processor responsibilities by processing activity
- LifecycleEstablishing, operating, evaluating and improving privacy management
- ControlsPrivacy measures and evidence linked to applicable requirements and risks
- SourcesUse the official 2025 standard for normative requirements and control details
PIMS processing lifecycle field guide
Start with what the organization actually does with personal information, then assign privacy responsibilities and safeguards to each activity.
- 1
Map purposes and data flows
Record why information is processed, whose information it is, what systems and suppliers touch it, where it moves and how long it remains.
- 2
Determine roles by activity
Use decision rights and actual arrangements to identify controller and processor responsibilities for each purpose.
- 3
Assess impacts and obligations
Identify applicable requirements, interested-party commitments and privacy risks; document owners and review triggers.
- 4
Design lifecycle safeguards
Connect transparency, access, minimization, retention, deletion, rights handling, security and supplier controls to processing flows.
- 5
Measure and improve
Review incidents, requests, complaints, supplier changes and measures; retain evidence of decisions and corrective actions.
Evidence checklist
- Processing inventory linked to systems and suppliers
- Role decisions and contracts for sampled activities
- Retention and deletion evidence across derived data
- Rights and incident records with approval trails
- Supplier review, subprocessor changes and exit records
Common failure modes
- Assuming cloud hosting makes the organization a processor for every purpose
- Treating a security review as a full privacy assessment
- Allowing derived data to outlive source records without a decision
- Using the withdrawn 2019 edition as the current study baseline
Key concepts examiners test
PII principal
The natural person to whom PII relates (the 'data subject' in GDPR).
PII controller
Determines purposes and means for a particular processing activity.
PII processor
Processes personally identifiable information for a controller under the applicable instructions and responsibilities.
Privacy by default
Limiting collection, processing, retention and disclosure to what is necessary.
Processing inventory
A maintained view of purposes, data, roles, recipients, systems, locations and retention across processing activities.
Preparing for the Lead Auditor exam
- Use the 2025 edition when testing current PIMS claims; identify legacy material based on the withdrawn 2019 edition.
- Sample processing activities and trace purpose, role, data flow, supplier and retention evidence end to end.
- Test whether requests and incidents reach accountable owners in time and leave a supported decision trail.
- Use legal requirements as audit criteria only when their applicability and interpretation have been established by the organization.
Preparing for the Lead Implementer exam
- The 2025 edition can be implemented as an independent PIMS or integrated with an ISMS.
- Map purposes and role decisions per processing activity; one organization may act in different roles in different contexts.
- Embed privacy assessment, minimization, rights handling and retention into project and change approval.
- Connect supplier and subprocessor records to data flows, contracts, monitoring and exit arrangements.