Privacy managed as a programme, not an afterthought
What PIMS and ISO/IEC 27701 are
A Privacy Information Management System (PIMS) is a structured way to manage how your organisation collects, uses, stores, shares and deletes personal data. ISO/IEC 27701 is the international standard that sets out the requirements for building one. Published in October 2025, the current edition is a standalone standard, so an ISO/IEC 27001 certificate is no longer a prerequisite.
What changed in the 2025 edition
- It is now a full management system standard, not an extension of ISO/IEC 27001 and 27002.
- It follows the ISO 27000 family structure and terminology, which makes integration with existing systems easier.
- It sets clearer requirements for privacy governance, defined privacy roles, measurable objectives and ongoing performance monitoring.
- Organisations certified to the 2019 edition get a transition period; check with your certification body for the exact deadline.
Key terms in plain language
- 01PII / personal data
- Any information that identifies a person directly or indirectly
- 02PII controller
- Decides why and how personal data is processed
- 03PII processor
- Processes personal data on behalf of a controller
- 04Data subject
- The individual the data is about
- 05PIMS
- The policies, processes, roles and controls that manage privacy
Why organisations build a PIMS
A PIMS turns privacy from an ad hoc effort into a managed, auditable programme.
Regulatory readiness
One framework that maps to the privacy laws and regulations that apply to you, so you do not rebuild controls for each.
Customer and partner trust
Independent certification is evidence in vendor due diligence and tenders.
Lower breach and penalty risk
Defined controls, data inventories and incident procedures reduce exposure.
Clear accountability
Named roles and responsibilities for controllers and processors.
Faster vendor and client reviews
Fewer security and privacy questionnaires; a certificate answers many of them.
Competitive advantage
Qualifies you for contracts that require demonstrable privacy governance.
Integrated management
Aligns with ISO/IEC 27001, 9001 and other ISO systems under one audit cycle.
Continual improvement
Internal audits, KPIs and management review keep the programme current.
Certification is voluntary under most privacy laws. ISO/IEC 27701 certification supports and evidences compliance, but does not by itself make an organisation legally compliant.
Any organisation that handles personal data
A PIMS fits organisations acting as a controller, a processor or both.
Privacy assurance is now part of buying decisions
Clients, regulators and partners increasingly ask for proof of privacy controls before onboarding a supplier. A PIMS gives you one documented, independently audited answer.
| Audience | Why it fits |
|---|---|
| PII controllers | Decide the purpose of processing; need lawful basis, notices, consent and data subject rights handling |
| PII processors | Process data for clients; need contract-driven controls, sub-processor management and breach notification |
| IT, SaaS and cloud providers | Clients ask for proof of privacy controls before onboarding |
| BFSI and fintech | High volumes of financial and identity data under sector rules |
| Healthcare and life sciences | Sensitive health data and patient consent |
| E-commerce and retail | Customer profiles, payments and marketing consent |
| BPO, HR and payroll services | Large-scale employee and customer data on behalf of others |
| Education and edtech | Data of students, including minors |
Do these sound familiar?
- 1Do you store customer or employee personal data?
- 2Do clients ask for privacy assurance?
- 3Do you transfer data across borders?
Three “yes” answers mean a PIMS readiness assessment is a sensible next step.
Book a free PIMS readiness assessmentFrom scoping to surveillance in eleven stages
A typical PIMS project takes 4 to 9 months, depending on size, existing security maturity and the volume of personal data.
-
01 Scoping and leadership commitment Define the PIMS scope (business units, locations, processing activities), your role as controller and/or processor, and get top management approval and a named owner.
-
02 Gap assessment Compare current practices against ISO/IEC 27701 requirements and applicable laws. Output: a gap report and a prioritised action plan.
-
03 Data mapping and inventory Record what personal data you hold, where it flows, who receives it, its lawful basis and retention period. This becomes your record of processing activities.
-
04 Privacy risk assessment Identify risks to individuals, not only to the company. Run data protection impact assessments (DPIAs) for high-risk processing and set a risk treatment plan.
-
05 Policy and control design Write the privacy policy and supporting procedures; select and document controls for controllers and processors, and record them in a Statement of Applicability.
-
06 Implementation Roll out controls: consent and notice handling, data subject request workflow, retention and deletion, vendor contracts, cross-border transfer safeguards, breach response.
-
07 Training and awareness Train all staff handling personal data, with deeper training for the privacy team, HR and customer-facing roles.
-
08 Monitoring and internal audit Set privacy KPIs, run an internal audit of the PIMS, and log nonconformities and corrective actions.
-
09 Management review Top management reviews audit results, incidents, KPIs and resources, and records decisions.
-
10 Certification audit Stage 1 (documentation review) and Stage 2 (implementation audit) by an accredited certification body; close any findings.
-
11 Surveillance and recertification Annual surveillance audits and a full recertification audit every three years, with continual improvement in between.
You can reuse your risk method, internal audit, management review and document control, which shortens stages 2, 5, 8 and 9. Under the 2025 edition this reuse is optional, not required.
How a PIMS lines up with the rules you answer to
ISO/IEC 27701 supports legal compliance but does not replace it. The mapping below is indicative.
| Law or standard | Relevance | How a PIMS helps |
|---|---|---|
| National privacy and data protection laws | The laws of each country where you operate or whose residents’ data you process | Covers records of processing, lawful basis and consent, data subject rights, impact assessments, breach handling, processor contracts and cross-border transfers |
| Sector regulator rules | Regulated industries such as finance, health, telecom and government | Add sector controls on top of the PIMS; check each regulator’s own data rules |
| Customer contracts and data processing agreements | Clients who require privacy assurance from their suppliers | Gives documented evidence for due diligence and contract audits |
| ISO/IEC 27001 and 27002 | Information security management | Complements the PIMS; recommended but no longer required for 27701 certification |
| ISO/IEC 29100, 29134, 27018 | Privacy framework, privacy impact assessment guidance, PII in public cloud | Useful reference material when designing controls and DPIAs |
| ISO/IEC 27706:2025 | Requirements for bodies that certify a PIMS | Use it to check your certification body is competent and accredited |
Always have legal counsel confirm how these requirements apply to your organisation.
The documented information a PIMS needs
The exact list follows the clauses of ISO/IEC 27701:2025 and your auditor’s reading of them.
| Document or record | Purpose | Applies to |
|---|---|---|
| PIMS scope statement | Defines boundaries, locations and processing covered | All |
| Privacy policy (internal) and top-management commitment | Sets direction and objectives | All |
| Privacy objectives and KPIs | Measurable targets, monitored and reviewed | All |
| Roles, responsibilities and authorities | Names the privacy lead, DPO or equivalent | All |
| Privacy risk assessment method and results | Records risks to individuals and treatment decisions | All |
| Risk treatment plan and Statement of Applicability | Lists selected controls and reasons for exclusions | All |
| Record of processing activities (data inventory) | What data, why, where, who receives it, how long kept | All |
| Data protection impact assessments | High-risk processing reviews | Mainly controllers |
| Lawful basis and consent records | Proof of valid basis and consent | Controllers |
| External privacy notices | What individuals are told at collection | Controllers |
| Data subject request procedure and log | Access, correction, erasure, objection handling with timelines | Controllers; support role for processors |
| Retention and deletion schedule | When data is erased or anonymised | All |
| Data processing agreements and sub-processor list | Contract terms with vendors and clients | All; central for processors |
| Cross-border transfer register and safeguards | Records where data goes and the legal mechanism | All |
| Personal data breach and incident procedure and log | Detection, assessment, notification, lessons learned | All |
| Competence and training records | Evidence staff are trained | All |
| Internal audit programme and reports | Checks the PIMS works as designed | All |
| Management review minutes | Top management decisions on performance and resources | All |
| Nonconformity and corrective action log | Tracks findings to closure | All |
How certification and audit work
Certification is granted by an independent certification body, not by your consultant. The certificate runs for three years with yearly checks in between.
What to know about the 2025 edition
Certification bodies and transition rules are changing with the new edition. Choose your certification body with care.
- Certification bodies need to be accredited against the new ISO/IEC 27706:2025 before they can certify to ISO/IEC 27701:2025.
- Holders of 2019 certificates will be moved to the 2025 edition within a transition window set by accreditation bodies. Deadlines vary, so ask your chosen certification body for its dates.
- Choose a certification body accredited by a member of the International Accreditation Forum for this scope.
| Phase | What happens | Typical outcome |
|---|---|---|
| Pre-audit readiness (optional) | Mock audit or internal audit by your team or consultant | Fixes before the real audit |
| Stage 1 audit | Auditor reviews scope, documents, risk assessment and readiness | Readiness confirmed, or concerns to fix |
| Stage 2 audit | On-site or remote check that controls work in practice, with staff interviews and record sampling | Findings raised: major, minor, observations |
| Corrective actions | You fix findings and submit evidence within the body’s deadline | Findings closed |
| Certification decision | Independent review and issue of the certificate | Certificate valid 3 years |
| Surveillance audits | Yearly partial audits | Certificate maintained |
| Recertification | Full audit before the third year ends | New 3-year cycle |
Timeline and cost
- Total project timeline: 4–9 months from scoping to the certification audit.
- Audit duration depends on headcount, number of sites and processing complexity; the certification body quotes it.
- Our consulting fees are scoped to your organisation; request a quote after the free readiness assessment.
Questions we hear most about ISO 27701
Talk to a QMet consultant and we will answer it directly, with no obligation.
Ask your question01 What does PIMS stand for?
Privacy Information Management System: the policies, processes, roles and controls that manage personal data across its life.
02 Is ISO 27701 mandatory?
No. It is voluntary under most privacy laws, but it gives a recognised way to organise and prove your privacy controls.
03 Do we need ISO 27001 first?
Not under the 2025 edition, which is standalone. Having ISO 27001 still makes implementation faster because many processes can be reused.
04 Does ISO 27701 make us legally compliant with privacy laws?
It supports compliance and provides evidence, but legal compliance depends on how you actually process data and on the law that applies to you.
05 How long does it take?
Usually 4 to 9 months from scoping to certification audit, depending on size and maturity.
06 Does it apply to processors as well as controllers?
Yes. The standard has requirements for both roles.
07 How long is the certificate valid?
Three years, with annual surveillance audits.
08 What is the difference between the 2019 and 2025 editions?
The 2025 edition is a full standalone standard with a new structure aligned to the ISO 27000 family, and certification no longer depends on holding ISO 27001.
Ready to build your PIMS?
Book a free 30-minute readiness assessment. We will map your current privacy practices against ISO/IEC 27701 and the laws that apply to you, and outline the next steps.
By submitting a request you agree to our Privacy Policy. Name, work email, company, headcount and country are all we need to start.
Disclaimer: This page is for general information and does not constitute legal advice. ISO is a registered trademark of the International Organization for Standardization. QMet is not affiliated with ISO, IEC or any certification body unless stated.