Glossary · ISO and management systems
ISO/IEC 27701 gives privacy work the same audit trail security already has.
The ISO/IEC standard for a privacy information management system (PIMS), covering how controllers and processors of personal data govern and protect it, and auditable by a certification body.
Back to the glossary01 · In plain words
In plain words
The ISO/IEC standard for a privacy information management system (PIMS), covering how controllers and processors of personal data govern and protect it, and auditable by a certification body.
Security standards protect information in general. ISO/IEC 27701 focuses on personal data: why you collect it, who you share it with, how people exercise their rights and how processors are controlled. It describes a privacy information management system (PIMS) that an independent auditor can check.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Privacy laws such as the GDPR and India's Digital Personal Data Protection Act, 2023 set duties, but neither offers a widely used certificate a buyer can check. ISO/IEC 27701 fills part of that gap. It gives a structured way to show that privacy roles, records, notices and processor contracts are managed and reviewed. The first edition was built on top of an ISO/IEC 27001 ISMS, which is why many companies add it after their security certificate. It does not by itself prove compliance with any law.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Controller and processor control sets
- Separate groups of controls depending on whether you decide on the processing or carry it out for a client.
- Data processing agreements
- Enterprise clients may ask for a 27701 certificate as evidence behind the contract's privacy promises.
- The record of processing
- The PIMS relies on an up-to-date record of what personal data is processed and why.
- Certificate scope wording
- States which services and which role, controller or processor, the certificate covers.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a payroll processor serving European employers
A Kochi payroll company processes salary data for employers in Germany and India. It already holds ISO/IEC 27001. Its European clients keep sending long privacy questionnaires. The company extends its management system into a PIMS: it maps each client's data, assigns the processor role, tightens its sub-processor list, and adds a procedure for passing on access requests to the employer. The auditor checks those processor controls. Questionnaires now get a certificate plus a short addendum instead of fresh answers each time.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- ISO/IEC 27001
- Covers the security of all information. ISO/IEC 27701 adds privacy duties for personal data, such as purpose, rights and processor terms.
- GDPR or DPDP compliance
- Laws whose duties you must meet regardless. A 27701 certificate is evidence of a managed system, not a legal finding.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Decide whether you act as a controller, a processor or both for each service.
- Bring your record of processing up to date before starting control work.
- Map the PIMS controls to the privacy laws you must meet, so one record serves both.
- Confirm with your certification body which edition it audits and what it requires as a base.
- GuideGDPR vs ISO 27001 & 27701A law vs a certifiable standard, and how they work together.
- GuideWhat is an ISMS?The management system ISO 27001 certifies: policies, risk, controls, review.
Sources: public ISO summaries of ISO/IEC 27701 and ISO/IEC 27001:2022; Regulation (EU) 2016/679; the Digital Personal Data Protection Act, 2023.
Questions about ISO/IEC 27701
Do we need ISO/IEC 27001 first?
Under the 2019 edition, yes; check the current edition.
The 2019 edition was written as an extension to an ISO/IEC 27001 ISMS. A newer edition is understood to allow a standalone PIMS. Ask your certification body which edition it certifies against and what base it requires.
Does a 27701 certificate mean we comply with the DPDP Act?
No.
It shows a managed privacy system was audited against a standard. Compliance with the Act depends on meeting its specific duties. Counsel should confirm how the law applies to your processing and contracts.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.