ISO 27701 is an international standard that extends information privacy requirements. It provides guidelines for establishing, implementing, and improving a Privacy Information Management System (PIMS). It applies to any organization—public or private, of any size—that processes Personally Identifiable Information (PII).

ISO 27701 does not operate in isolation; it is a direct extension of ISO 27001 and the ISO 27002 code of practice. Its goal is to naturally integrate compliance and the management of personal data privacy (PIMS) under the umbrella of the organization’s existing Information Security Management System (ISMS).

Yes, it is a certifiable standard. Companies that already hold ISO 27001 certification can extend their scope to also certify their Privacy Information Management System, demonstrating to customers and auditors a higher level of commitment and transparency in data protection.

The standard provides a robust, methodological framework that is ideal for evidencing and facilitating ongoing compliance with the General Data Protection Regulation (GDPR) in Europe, as well as other applicable privacy legislation. It acts as an auditable foundation that builds trust with regulatory authorities.

The standard divides responsibilities. Clause 7 sets out the controls and specific implementation guidance for “controllers” or those responsible for Personally Identifiable Information. Clause 8, on the other hand, establishes the recommended controls for “processors” who handle third-party data or manage subcontractors.