Choosing PIMS software for ISO/IEC 27701:2025
People sometimes use “PIMS software” to mean a privacy information management system: software that supports records and evidence. A PIMS itself is broader: ISO/IEC 27701:2025 describes a privacy information management system with roles, processes and continual improvement. Read the PIMS explained and the requirements of ISO 27701 first. The text of the Algemene Verordening Gegevensbescherming (AVG, General Data Protection Regulation) on EUR-Lex then determines which legal obligations apply to your processing.
The 2025 edition is a standalone management system and can be certified on its own. So you do not first need an ISO 27001 certificate, although integration with an information security management system (ISMS) can be efficient. Software helps with recording and demonstrating compliance. It does not make privacy decisions, risk trade-offs or take over responsibility.
Start with processes, not features
Make a list of processing activities and decide per activity what you need to be able to demonstrate. A good package supports, for example, the register of processing activities, data flows, lawful bases, data subject requests, DPIAs (data protection impact assessments), processors, incidents and retention periods. Choose features only after you have described who decides, who checks, and which evidence an auditor must be able to find.
| PIMS activity | Useful software feature | Audit evidence | Work that stays human |
|---|---|---|---|
| Managing processing activities | Register with owner, purpose and lawful basis | Change history and export | Assessing accuracy |
| Handling a data subject request | Workflow with deadlines and tasks | Request, decision and communication | Verifying identity and exceptions |
| DPIA or risk analysis | Template, risk owner and links | Approved assessment | Accepting a risk or choosing a control |
| Managing processors | Contract and review registration | Agreement, review, actions | Assessing the supplier |
| Tracking incidents | Notification, escalation and timeline | Log and evaluation | Determining severity and notification duty |
| Retention periods | Trigger, task and reporting | Deletion log or exception | Reassessing purpose and necessity |
A dashboard is only useful if the data is up to date. So ask during a demo to follow one processing activity from intake to deletion. Can you see who changed the lawful basis, why a DPIA was approved, and which task is still open?
Selection criteria for a fair comparison
Ask every supplier to do the same practical test. Pay attention to exportability: you must be able to take your register and audit evidence with you when the contract ends. Check roles and permissions, multi-factor authentication, access logs, change history and electronic approvals.
Also discuss hosting and where personal data (PII) is located, sub-processors, back-ups, retention, deletion, APIs and incident notification. Have the supplier explain how updates are tested and how you can find a change. A supplier’s certificate does not automatically mean that your configuration, processes and contracts are appropriate.
Assess usability with real users. A privacy officer must be able to update a processing record, while a process owner sees only their own tasks. Permissions that are too broad create a privacy risk themselves. Permissions that are too tight make the register unusable.
Fictional case: SaaS with HR and customer data
A SaaS company manages personnel data for clients and processes its own support data. It does not choose a package based on a supplier list. Instead, it tests three scenarios: a new client processing activity, an access request and a sub-processor that changes.
During the test it turns out that the register contains purposes but is not linked to retention periods. The company makes that link mandatory, assigns an owner to each processing activity and schedules a quarterly review. The functionaris gegevensbescherming (FG, data protection officer) approves a DPIA, and the product manager carries out the measure. The software records decisions and timestamps, but the organisation remains responsible for the content.
Software does not automatically make anyone compliant with ISO 27701 or the GDPR. The certification body assesses your management system, the chosen scope, how it works and the evidence in practice.
Combining ISO 27701:2025 and ISO 27001
ISO 27701:2019 is listed by ISO as a withdrawn edition. Check with your certification body which transition arrangements apply if your organisation still holds a 2019 certificate. For a new choice, you can set up 27701:2025 on its own or combine it with ISO 27001. Privacy and information security overlap, but a well-secured process can still have an incorrect lawful basis or retention period.
Frequently asked questions
Is a spreadsheet also PIMS software?
A spreadsheet can be part of your PIMS. It is about control, ownership, version management and evidence. A tool is not automatically better than a well-managed simple solution.
Must PIMS software be certified?
Not automatically. Investigate what assurance, security and contractual guarantees the supplier offers. Then test your own configuration and use.
Do I need ISO 27001?
Not for ISO/IEC 27701:2025. The 2025 edition is standalone. Integration with an ISMS can, however, reduce overlap in risks, audits and document control.