ISO/IEC 27701

What it is

ISO/IEC 27701 is an extension of ISO/IEC 27001 for managing personal data. It adds a Privacy Information Management System (PIMS) on top of the ISMS, with controls that map to the responsibilities of data controllers and data processors.

Why it matters in practice

ISO 27701 is the closest thing the industry has to a certifiable bridge between security management (27001) and EU privacy law (GDPR). Certification gives a structured, auditable demonstration that the organisation operates the privacy controls a regulator would expect — without supplanting the legal obligation itself.

What it adds over 27001

• Controls specific to controllers (e.g. lawful basis, transparency obligations, data-subject rights handling).
• Controls specific to processors (e.g. processing only on documented instructions, sub-processor management).
• Mapping tables to GDPR articles, ISO 29100 privacy principles and other privacy frameworks.