What is ISO 27701?
ISO/IEC 27701 is the international standard for a privacy information management system (PIMS): a management system that helps you demonstrably control how you process personal data. The standard was developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Since the October 2025 revision, ISO 27701 is a standalone standard. You can now certify without first obtaining ISO 27001, although it still aligns closely with it. In the Netherlands, the standard is available from NEN .
Where ISO 27001 focuses on information security, ISO 27701 focuses specifically on privacy: how you handle personal data, and how you respect the rights of the people behind that data. The standard helps you demonstrate that you work towards compliance with the Algemene Verordening Gegevensbescherming (AVG, General Data Protection Regulation) . Note: it is not an official GDPR certificate. Read how this works exactly on GDPR and ISO 27701.
ISO 27701 is not a legal GDPR certification within the meaning of Article 42 GDPR. Such a certification mechanism must be approved by the European Data Protection Board and does not exist yet. ISO 27701 shows that you approach privacy seriously and in a structured way, but it is not legal proof of full GDPR compliance.
ISO/IEC 27701 at a glance
| Topic | What you need to know |
|---|---|
| Full name | ISO/IEC 27701:2025, the privacy information management system (PIMS) |
| Published | 14 October 2025, a major revision of the 2019 version |
| Standalone? | Yes. Since 2025 it can be certified on its own, ISO 27001 is no longer required |
| Structure | High Level Structure, requirements in clauses 4 to 10 |
| Annex A | 78 controls: 31 for controllers, 18 for processors, 29 for both |
| GDPR relationship | Solid basis, but not a legal GDPR certificate |
| Certificate validity | 3 years, with an annual surveillance audit |
What is a PIMS?
PIMS stands for privacy information management system. That sounds abstract, but it is simple: a fixed way of working that keeps you in control of all the personal data that passes through your organisation. Which data do you process, why, for whom, and how do you protect it?
A PIMS is not a software package. It is a set of processes, roles and agreements. Think of: a register of processing activities, a procedure for requests from data subjects, agreements with your suppliers, and a fixed cycle to check and improve everything. Read the full explanation on the PIMS explained.
What has changed in the 2025 version?
The October 2025 revision is not a minor update. The most important change: ISO 27701 is now a standalone standard. In the 2019 version, it was an extension of ISO 27001. You could only obtain ISO 27701 if you also held ISO 27001. That no longer applies.
The standard now has its own complete structure with clauses 4 to 10. The controls have been reorganised. The scope is also broader: biometric data, health data, IoT and privacy in AI are now explicitly covered. A new Annex B provides practical implementation guidance.
Do you already hold an ISO 27701:2019 certificate? Then there is a transition period of three years, until October 2028. The full comparison is on ISO 27701 vs. ISO 27001.
Processor or controller?
ISO 27701 makes a clear distinction between two roles. A controller decides why and how personal data is processed. A processor does this on behalf of someone else. A webshop is the controller for customer data. The hosting provider that runs the webshop is the processor.
Which controls apply to you depends on your role. Sometimes you are both at once. The standard sets out 31 controls for controllers and 18 for processors, plus 29 that apply to both. Read how to determine your role on processor or controller.
Who is ISO 27701 relevant for?
ISO 27701 is mainly relevant for organisations that process large amounts of personal data and need to demonstrate this to customers or supervisory authorities.
- SaaS and software companies that process customer data in the cloud
- Processors and hosting providers that manage personal data on behalf of others
- Healthcare IT and care providers that work with health data (often alongside NEN 7510)
- Marketing and HR service providers that process large volumes of personal data
A detailed overview per type of organisation is on who is ISO 27701 for.
How much does ISO 27701 certification cost?
The costs depend on your organisation’s size, your role and how much you have already arranged. If you already have ISO 27001, the step to ISO 27701 is smaller. The largest items are the preparation and the certification audit by an accredited body such as BSI , DNV or TÜV .
| Situation | Indicative total cost in year one |
|---|---|
| Small, already ISO 27001 certified (extension) | €5,000 - €15,000 |
| Small, without ISO 27001 (standalone) | €12,000 - €30,000 |
| Medium to large | €25,000 - €75,000+ |
These are indications based on public information from certification bodies. Always ask for a quote. The full breakdown is on costs and timeline.
How do you start with ISO 27701?
A realistic process takes three to nine months, depending on your starting point. You begin with a baseline measurement, build your PIMS, and run the system for a while before the auditor arrives. The full process is in the step-by-step plan, and you can read how the audit works on the audit process.
Important links
Sources
- ISO/IEC 27701 at ISO : International Organization for Standardization
- NEN, information security and privacy : Netherlands Standardisation Institute (NEN)
- Autoriteit Persoonsgegevens, the GDPR in brief : Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
- European Data Protection Board : European oversight and certification