ISO 27701 vs. ISO 27001
ISO 27701 and ISO 27001 belong to the same family, but they cover different things. ISO 27001 is about information security: protecting all information against loss, theft and outages. ISO 27701 focuses specifically on privacy: protecting personal data and the rights of the people behind that data. Since the October 2025 revision , ISO 27701 is a standalone standard. Before that, it was an extension of ISO 27001. In the Netherlands, both standards are available from NEN .
This page explains where the standards overlap, where they differ, and which one you need. Want to start with the basics of ISO 27701 first? Begin at the hub or at the requirements.
ISO 27701 vs. ISO 27001 in one table
| Feature | ISO 27001 | ISO 27701 |
|---|---|---|
| Topic | Information security (all information) | Privacy (personal data) |
| System | ISMS (information security management system) | PIMS (privacy information management system) |
| Controls | 93 in Annex A | 78 in Annex A (31 + 18 + 29) |
| Standalone? | Yes | Yes, since the 2025 version |
| Relation to the AVG (General Data Protection Regulation) | Indirect (security) | Direct (privacy and the GDPR) |
| Validity | 3 years | 3 years |
What is the core difference?
The core difference lies in the question each standard answers. ISO 27001 asks: is your information secure? ISO 27701 asks: do you handle personal data properly and lawfully?
An example makes this concrete. Imagine you have a well-secured database with customer data. Encrypted, access restricted, backups in order. That is information security: ISO 27001 territory. But did you collect that data for a valid reason? Can the customer have it deleted? Do you keep it for too long? Those are privacy questions: ISO 27701 territory.
Security and privacy overlap, but they are not the same. You can secure personal data perfectly and still breach privacy law, for example by collecting data without a lawful basis. Conversely, you can have a sound lawful basis and secure the data poorly.
Same structure, easy to combine
Both standards follow the High Level Structure: the same clause structure, clauses 4 to 10. That makes it easy to combine them into one integrated management system. If you already have ISO 27001, you can reuse a lot:
- The management review and internal audit
- Document control and the risk process
- The statement of applicability (you extend it with privacy controls)
- The ISMS itself as the foundation for your PIMS
You then add the privacy-specific parts: the register of processing activities, the privacy risk assessment, and the controls for your role as a processor or controller.
What changed in 2025?
Anyone still holding the 2019 certificate will find the deadline and approach on moving to the 2025 version.
The biggest change in the 2025 version: ISO 27701 is now standalone. In the 2019 version it was an extension. You could only obtain ISO 27701 if you also held an ISO 27001 certificate. That no longer applies.
| Aspect | ISO 27701:2019 | ISO 27701:2025 |
|---|---|---|
| Status | Extension of ISO 27001/27002 | Standalone, certifiable standard |
| ISO 27001 required? | Yes | No |
| Structure | Additional requirements on 27001 | Own complete clauses 4-10 |
| Controls | Annex A (controller) + Annex B (processor) | Annex A combined, Annex B = implementation guide |
| Scope | Privacy for personal data | Plus biometrics, health, IoT and AI privacy |
Do you already hold a 27701:2019 certificate? Then there is a transition period of three years, until October 2028. Plan your transition audit well in advance.
Which one do you need?
It depends on what you want to demonstrate.
- Only demonstrate security? ISO 27001 is enough. Many clients and tenders specifically ask for it.
- Mainly demonstrate privacy, with few security requirements? Since 2025 you can obtain ISO 27701 standalone. Useful for organisations that get questioned about their privacy position.
- Both? The combination is the strongest proof. You cover security and privacy, and share many processes. For most SaaS companies and processors this is the logical route.
Even with ISO 27701 you are not automatically GDPR compliant. The standard is not a legal GDPR certification. Read why on GDPR and ISO 27701.
And ISO 42001 for AI?
Do you work with AI that processes personal data? Then ISO 42001 becomes relevant, the standard for AI management systems. ISO 42001, ISO 27001 and ISO 27701 complement each other: security, privacy and responsible AI. All three follow the same structure, so combining them is manageable.
Next steps
Sources
- ISO/IEC 27701 at ISO : International Organization for Standardization
- ISO/IEC 27001 at ISO : International Organization for Standardization
- NEN, information security and privacy : Netherlands Standardisation Institute (NEN)