ISO 27701 requirements
ISO/IEC 27701 sets two kinds of requirements: requirements for your management system (clauses 4 to 10) and the privacy controls in Annex A. The management requirements follow the High Level Structure, just like ISO 27001. The privacy controls are specific to privacy and depend on your role as processor or controller. Since the 2025 revision, the standard stands on its own: you do not need to obtain ISO 27001 first. You can find the official standard at ISO and, in the Netherlands, via NEN .
This page explains what the standard asks of you in substance. We first go through the seven clauses with requirements, then through the structure of the controls. Want to understand first what a privacy information management system is? Then read the PIMS (privacy information management system) explained.
On this page
The seven clauses that shape your management system.
The management requirements (4-10)78 privacy controls, divided across roles.
The controls (Annex A)Your role determines which set of controls applies.
Which controls apply to you?The management requirements: clauses 4 to 10
The core of ISO 27701 lies in clauses 4 to 10. These follow the Plan-Do-Check-Act cycle: plan, do, check, improve. You will recognise the same structure from ISO 27001 and ISO 9001.
| Clause | What the standard requires |
|---|---|
| 4. Context | Map which personal data you process, for whom and why. Determine your role and your scope. |
| 5. Leadership | Management adopts a privacy policy and assigns responsibilities. |
| 6. Planning | Carry out a privacy risk assessment and set objectives. |
| 7. Support | Arrange people, resources, awareness and documentation. |
| 8. Operation | Carry out the privacy controls and keep records of processing. |
| 9. Performance evaluation | Measure, audit internally and discuss the results in a management review. |
| 10. Improvement | Deal with nonconformities and keep improving the system. |
Clause 4: context and scope
You start by taking stock. Which personal data flows through your organisation? For example: an HR software company processes names, salary data and sometimes health data of its clients’ employees. In clause 4 you record what you process, for whom, and whether you are a processor or a controller in each case.
Clause 6: privacy risk assessment
Here you look at what could go wrong with personal data. Not only from your own interest, but from the interest of the people behind the data. What happens if data leaks? Who is affected? This view of the data subject is what sets a privacy risk assessment apart from an ordinary security analysis.
A privacy risk assessment resembles a data protection impact assessment (DPIA) under the AVG (Algemene Verordening Gegevensbescherming, General Data Protection Regulation). ISO 27701 deliberately connects to this. Read more about that relationship at AVG and ISO 27701.
The controls: Annex A
Alongside the management requirements, ISO 27701 contains a list of concrete controls. In the 2025 version there are 78 controls, made up of three groups.
| Group | Number | For whom |
|---|---|---|
| Controls for controllers | 31 | Whoever determines the purpose and the means |
| Controls for processors | 18 | Whoever processes on behalf of someone else |
| Information security controls | 29 | Both roles |
The controller controls cover matters such as having a valid lawful basis, being transparent to data subjects, handling requests (access, erasure), retention periods, and rules for sharing data. The processor controls mainly cover working according to the controller’s instructions and supporting the controller with its obligations.
In the old version (2019), the controller controls were in Annex A and the processor controls in Annex B. In the 2025 version, they are combined into one structured Annex A. Annex B now contains practical implementation guidance. The differences are set out at ISO 27701 vs. ISO 27001.
Which controls apply to you?
Not all 78 controls always apply. That depends on your role. If you are only a processor, look at the 18 processor controls plus the 29 security controls. If you are a controller, the 31 controller controls apply, plus the same 29.
Many organisations are both at once. A SaaS company is a processor for client data, but a controller for its own employee and prospect data. Then you combine both sets. You can determine how this works for you at processor or controller.
You record which controls you apply, and why, in a statement of applicability. This works the same as with ISO 27001: for each control, you justify whether you apply it and how.
Want to check the requirements item by item? Use the ISO 27701 checklist as a working document.
How do the requirements relate to the AVG?
The controls are deliberately aligned with the AVG. Annex D of the standard contains a mapping: for each control, you can see which AVG article applies. If you meet the control, you are also working on the related AVG requirement. Even so, this is not legal proof of compliance. For the reasons why, read AVG and ISO 27701.
Next steps
Sources
- ISO/IEC 27701 at ISO : International Organization for Standardization
- NEN: information security and privacy : Dutch standards institute