ISO/IEC 27701 is the standard for a privacy information management system (PIMS), which is a way of managing personal data so that privacy is controlled, not left to chance. The 2019 edition was an extension to ISO 27001. The 2025 edition, according to the sources we read, can stand alone. That change matters for how you plan an audit.
Last reviewed: 17 October 2026. Facts checked. We searched for the 2019 and 2025 editions and opened the Scrut page on ISO/IEC 27701:2025 and the Wikipedia page on ISO/IEC 27001. The PECB page returned an error and the Kiwa pages returned errors, so we did not open them. We could not open the standard or any IAF or accreditation transition rule. Publication dates and transition terms come from secondary sources and differ between them. Check with your certification body.
What a PIMS is, in plain words
A PIMS is a management system for personal data. The company decides what personal data it holds, why, who handles it, and what controls apply. It then checks that the controls work and improves them.
It is a close cousin of an information security management system. Security protects information from harm. Privacy decides what may be done with personal information and for whom. Our ISMS explainer covers the security side.
The 2019 and 2025 editions
The 2019 edition worked as an add-on. It extended ISO/IEC 27001 and ISO/IEC 27002 with privacy requirements, and it assumed you ran an ISMS first.
The 2025 edition changed that. Scrut reports it was released on 14 October 2025 and replaces the 2019 edition. Other sources we saw gave 10 October 2025, so treat the exact day as unconfirmed. The sources agree on the year and on the main change: the new edition is capable of being implemented independently of an ISMS, so a company can pursue PIMS certification without holding an ISO 27001 certificate.
Scrut also reports that the 2025 edition stays aligned with the 2022 editions of ISO/IEC 27001 and 27002, follows the common management system structure, and refines clauses 4 to 10. We have not checked these against the standard.
What is still shared with ISO 27001
Both are management systems. They follow the same pattern: context, leadership, planning, support, operation, performance evaluation and improvement. If you already have an ISMS, you already have much of the machinery: scope, risk method, internal audit, management review and corrective action.
Transition for 2019 certificates
Scrut says companies certified to the 2019 edition get a transition period "typically between 24 and 36 months" and notes that formal rules were still to come. Another search result put the end of the window in October 2028. We found no accreditation body document, so the real deadline is unconfirmed. Ask your certification body.
How a PIMS is audited
The routes mirror other ISO management systems.
- Internal audit. The company checks its own PIMS at planned intervals.
- Certification audit. An accredited certification body audits it. For the general stages, see Stage 1, Stage 2, surveillance and recertification.
- Surveillance and renewal. Ask your certification body for the cycle that applies.
What auditors look for
These are typical areas, written from the nature of a privacy system. They are not quoted from the standard.
- Scope and role. Is the company a controller of personal data, a processor, or both? The scope should say so.
- A record of personal data processing. What is held, why, where it goes.
- Legal basis and consent. Is there a reason for each use, and can it be shown?
- Rights requests. Can the company handle access, correction and deletion requests?
- Suppliers and transfers. Are processors and cross-border flows controlled?
- Incidents. Is there a way to detect and respond to a data breach?
- Leadership and review. Are privacy roles assigned and reviewed by management?
Planning the audit
Decide the scope first. Say which products, processes and entities are in, and whether the company acts as a controller, a processor or both. Then map the personal data: where it comes in, where it is stored and who receives it. An auditor will usually start from that map, so building it early saves time. If you already hold an ISO 27001 certificate, check which of your existing records can be reused and which need a privacy-specific version.
India context
Many Indian companies now look at privacy because of the Digital Personal Data Protection Act. ISO/IEC 27701 is not a substitute for the law, and certification does not prove legal compliance. See our DPDP Act audit readiness checklist and our guide to privacy impact assessments for Indian companies. For a first look at where your management system stands, try the ISO management system readiness scorecard.
Frequently Asked Questions
What is ISO/IEC 27701?
The standard for a privacy information management system.
Is ISO 27701 still an extension to ISO 27001?
The 2019 edition was. The 2025 edition, per Scrut, can be implemented without an ISMS.
Do I need ISO 27001 first?
Not under the 2025 edition, according to Scrut. Confirm with your certification body.
Does ISO 27701 make me DPDP compliant?
No. A standard is not the law. It can support your compliance work.
When must 2019 certificates move?
We could not confirm the deadline. Sources suggest about three years from publication. Ask your certification body.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error