Moving from ISO 27701:2019 to the 2025 version
Certificates based on ISO/IEC 27701:2019 remain valid until the transition deadline in October 2028, provided you continue to meet the regular certification requirements. After that, you must have switched to the 2025 version. The 2025 version was published on 14 October 2025 and is a major revision. It is now a standalone standard, so you no longer need an ISO 27001 certificate to obtain it. The overview of the standard is on what is ISO 27701, and the difference with ISO 27001 is on ISO 27701 vs. ISO 27001.
Do not have a certificate yet? Then certify directly against the 2025 version. The transition only applies to those already on the 2019 version.
What has changed?
The biggest change is the structure. In the 2019 version, ISO 27701 was an extension of ISO 27001 and ISO 27002. You could only obtain it with an ISO 27001 certificate. In 2025 the standard is standalone, with its own requirements in clauses 4 to 10. The controls have been reorganised, and the practical guidance is in its own annex.
In addition, sensitive data receives more attention, such as biometrics and health data, along with privacy risks from automated decision-making and AI. Some sources also mention IoT, but this is not confirmed everywhere. When switching, check whether your scope touches those topics. For example, a care app with health data and a scoring model falls more clearly under the points of attention in 2025 than in 2019.
| Element | 2019 version | 2025 version |
|---|---|---|
| Position | Extension of ISO 27001 | Standalone standard |
| Requirement | ISO 27001 certificate needed | Not needed |
| Controls | Split across annexes for controller and processor | 78 controls: 31 for controllers, 18 for processors, 29 shared |
| Practical guidance | Limited | Annex B with implementation guidance |
| Scope | General privacy | More attention to biometrics, health and AI |
You will find the overview of controls per role on requirements of ISO 27701. It also shows which controls apply to you.
When do you need to switch?
The deadline is October 2028. Sources differ on the exact day: one gives 1 October, another 31 October 2028 (the UKAS bulletin gives 31 October 2028 for certification bodies). Ask your certification body which date applies to your certificate. Their own timetable may be earlier, because certification bodies also have to switch.
Plan backwards from the deadline. A transition audit takes time, and most certification bodies expect you to complete the process well before the deadline. If you only start in the final year, the audit may not fit in time.
How do you plan the switch?
Read the 2025 version alongside your current system
Start with the text of the new standard. Put your current controls next to it. Annex F of the standard contains tables that map the 2019 numbers to the 2025 numbers. That shows you what moved, what disappeared and what was added.
Carry out a gap analysis
For each control, establish whether it is included in the 2025 version, and whether your current implementation meets it. Unlike the baseline measurement, you do not start from zero. You start from your existing system.
Update your documentation
Update the processing register, privacy policy and risk analysis where the new standard requires it. Keep the old versions. An auditor needs to be able to follow the changes.
Carry out an internal audit against the new version
Have your system checked once against the 2025 requirements before the external auditor arrives. This is the same step as the internal audit in the normal cycle, but now against the new text.
Plan the transition audit with your certification body
Ask your certification body for a transition audit against the 2025 version. That body decides how it is set up, so request this in writing in advance. Read how the auditor works on the audit process.
Common mistakes
Thinking nothing changes. The numbering and structure of the controls have changed. If you keep using the old numbers, you will run into problems during the audit.
Waiting until the deadline approaches. Certification bodies also have busy periods. A transition audit needs a slot in their diary.
Not reviewing the scope again. If your scope now covers biometrics, health data or AI applications, you need to include that in the switch.
Assuming it is only a paperwork exercise. The switch requires demonstrable operation of the new controls, not just new text in your manual.
Example: working back from the deadline
An organisation with a 2019 certificate wants to be on time. It works backwards from the October 2028 deadline and uses the order of steps as a fixed plan.
| Phase | What you do | When roughly |
|---|---|---|
| Start | Read the 2025 text and place it alongside the current system | As early as possible |
| Gap analysis | Record per control what is missing | Immediately after |
| Adjustment | Update the processing register, policy and risk analysis | Most of the process |
| Internal audit | Check the system against the new requirements | Well before the transition audit |
| Transition audit | The external auditor checks the 2025 version | With enough margin to fix findings |
The most important rule: do not schedule the transition audit for the last month. If a finding from the audit requires a new process, there will be no time left. Build the margin in deliberately, and ask your certification body for the exact timelines.
Frequently asked questions about the transition
Do I need to switch if my 2019 certificate is still valid for two more years? The deadline in October 2028 is the date on which the 2019 version stops. As long as your certificate on the 2019 version is valid, you do not need to change straight away. Still, plan the switch ahead, because the transition audit takes time.
Can I combine the switch with recertification? That depends on your certification body. Ask in writing in advance and record the conditions. Combining them can simplify the planning, but only if the auditor then also reviews the new version in full.
What if my client still asks for the 2019 version? Ask the client which version the requirement refers to. If it only says “ISO 27701” without a version, ask which version the client expects. Confirm the answer in writing.
Next steps
Ask your certification body for the exact deadline and the requirements for the transition. If you no longer hold a valid certificate, start with the step-by-step plan. Questions about the validity of your certificate are answered on the page ISO 27701 certificate: validity. Many of the doubts about the switch also come up in frequently asked questions.
Sources
- ISO/IEC 27701 at ISO : the standard and the official version
- UKAS: transition arrangements for PIMS : publication date and transition dates
- NEN : the Dutch edition
- Raad voor Accreditatie (RvA, Dutch Accreditation Council) : the register of accredited bodies