Privacy · Certifiable standard
ISO/IEC 27701, the privacy information management system
A privacy management system on its own, or alongside your ISO/IEC 27001 ISMS so one system handles both.
- Type
- Certifiable standard
- Group
- Privacy
- We help with
- ISO 27001 and GRC
- Issued by
- Accredited body
What it is.
ISO/IEC 27701 specifies a privacy information management system (PIMS). Since the 2025 edition it can be used as a standalone management system as well as alongside an ISO/IEC 27001 information security management system. It sets out privacy-specific requirements and guidance for organisations that handle personal data.
ITCCS is a consultant, not a certification body. Certification is issued by an accredited certification body after an independent audit.
Who usually needs it
- Organisations already running or building ISO/IEC 27001
- Firms processing personal data for clients
- Teams preparing for GDPR or DPDP obligations
What it covers.
- 01
Standalone or with the ISMS
Run it on its own, or integrate it with ISO/IEC 27001 so shared controls are managed once.
- 02
Controllers and processors
Guidance for organisations that decide how personal data is used and those that process it for others.
- 03
Evidence for privacy laws
Helps demonstrate GDPR and DPDP-style privacy controls.
How we help with ISO/IEC 27701
We map your processing of personal data, decide whether you act as a PII controller, processor or both, and design the PIMS controls to match. Where you already hold ISO/IEC 27001, we extend the existing ISMS; where you don't, we help you choose between the standalone and integrated routes the 2025 edition allows, and reuse the work for DPDP and GDPR.
Not since the 2025 edition: ISO/IEC 27701 can be used as a standalone PIMS. Organisations that already run ISO/IEC 27001, or plan to, often implement both in one programme to share controls.
It does not guarantee compliance with any law, but it helps you demonstrate the privacy controls those laws expect.
An accredited certification body. ITCCS prepares you; we do not certify.
Let's build what's next.
Tell us about your infrastructure, security or automation goals. We reply with questions, then a written plan with scope and next steps.
- Response
- Usually within one business day
- Location
- Worldwide
What happens next
- 01
Reply
- 02
Discovery call
- 03
Proposal
This page is general guidance, not legal advice. Last reviewed October 2026.