PrivacyGlobal

ISO 27701:2019

Keep your privacy programme traceable through change

Connect privacy responsibilities, risk decisions and supporting evidence within your existing PIMS programme.

Version note. ISO/IEC 27701:2019 has been replaced by ISO/IEC 27701:2025. This page describes the 2019 edition listed in Netra.

Full title
ISO/IEC 27701:2019 Security techniques: Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management: Requirements and guidelines
Issued by
ISO and IEC, through their joint technical committee on information security
Published
August 2019. Replaced by ISO/IEC 27701:2025, published October 2025 as a standalone standard.
Nature
Voluntary international standard. Under the 2019 edition, certification is an extension of an ISO/IEC 27001 certificate.
Applies to
Organisations that process personally identifiable information (PII), as a controller, a processor, or both
Structure
Clauses 5 to 8 extend ISO 27001 and ISO 27002. Annex A has controls for PII controllers, Annex B for PII processors, and Annexes C to F give mappings and guidance.

Overview

What ISO 27701:2019 is

ISO/IEC 27701:2019 sets out how to run a privacy information management system, or PIMS. It was written as an extension rather than a standalone standard: an organisation takes its existing information security management system under ISO/IEC 27001, and the related controls in ISO/IEC 27002, and extends them so that they also protect privacy when PII is processed.

The standard distinguishes between two roles. A PII controller decides why and how personal information is processed. A PII processor processes it on behalf of a controller. Many organisations are both. Clause 7 and Annex A apply to controllers, Clause 8 and Annex B to processors. The standard also maps its provisions to the privacy principles of ISO/IEC 29100, to the EU General Data Protection Regulation, and to ISO/IEC 27018 and ISO/IEC 29151.

The 2019 edition was written against the 2013 editions of ISO 27001 and ISO 27002, so its references to control numbers follow the older numbering. Organisations that have moved their ISMS to ISO 27001:2022 have had to map those references to the new Annex A controls.

ISO has since replaced the 2019 edition with ISO/IEC 27701:2025, published in October 2025. The new edition is a standalone management system standard that can be certified without an ISO 27001 certificate. Accreditation bodies have set transition arrangements for certification bodies and certified organisations. This page describes the 2019 edition listed in Netra.

Who it applies to

ISO 27701:2019 is relevant to any organisation that processes PII and already runs, or is building, an ISO 27001 ISMS. It is often used by:

  • SaaS, cloud and IT services providers acting as PII processors for their customers
  • Organisations acting as PII controllers that want a structured way to show privacy accountability
  • Banks, insurers, healthcare and fintech organisations handling large volumes of customer data
  • Indian technology firms serving customers subject to the GDPR and other privacy laws
  • Organisations preparing for obligations under the Digital Personal Data Protection Act, 2023, that want a management system approach

A PIMS supports accountability but does not by itself establish compliance with any privacy law. Legal obligations need their own assessment. See GDPR and CCPA.

Structure

How the 2019 edition is organised

Clauses 1 to 4 introduce the standard. Clauses 5 and 6 extend ISO 27001 and ISO 27002. Clauses 7 and 8 add guidance for controllers and processors, with matching controls in Annexes A and B.

Clauses 1–4

Scope, references, terms and general

What the standard covers, the terms it uses, and how its requirements and guidance relate to ISO 27001, ISO 27002 and to organisations acting as controllers or processors.

Clause 5

PIMS-specific requirements related to ISO/IEC 27001

Extends each management system clause of ISO 27001, so that requirements about information security also cover the protection of privacy affected by the processing of PII.

Context of the organisation
Determine the organisation’s role as a PII controller, processor or both, consider privacy-related issues and interested parties, and include the processing of PII in the scope.
Leadership
Top management commitment and policy extended to privacy.
Planning
Risk assessment and treatment extended to privacy risks. The Statement of Applicability considers the controls in Annex A or B as well as ISO 27001 Annex A.
Support, operation, evaluation and improvement
The ISO 27001 requirements apply, read as covering both information security and privacy.
Clause 6

PIMS-specific guidance related to ISO/IEC 27002

Adds privacy guidance to the ISO 27002:2013 control areas, from information security policies and organisation of security, through human resources, asset management, access control, cryptography, physical security, operations and communications, development, suppliers and incidents, to continuity and compliance.

Clause 7 / Annex A

Additional guidance and controls for PII controllers

Annex A contains 31 controls for controllers, with implementation guidance in Clause 7.

Conditions for collection and processing
Identify and document purposes and lawful basis, obtain and record consent where needed, carry out privacy impact assessments, set contracts with processors, and keep records of processing.
Obligations to PII principals
Determine and meet obligations to individuals: providing information, handling requests for access, correction and erasure, and allowing consent to be withdrawn.
Privacy by design and privacy by default
Limit collection and processing to what is needed, keep PII accurate, minimise and de-identify, and retain and dispose of PII in line with defined periods.
PII sharing, transfer and disclosure
Identify the basis for transfers between jurisdictions, the countries and organisations involved, and keep records of transfers and disclosures.
Clause 8 / Annex B

Additional guidance and controls for PII processors

Annex B contains 18 controls for processors, with implementation guidance in Clause 8.

Conditions for collection and processing
Process PII only as agreed with the customer, do not use it for marketing or advertising without consent, tell the customer if an instruction may infringe the law, and keep records.
Obligations to PII principals
Give the customer the means to meet its obligations to individuals.
Privacy by design and privacy by default
Manage temporary files, return, transfer or dispose of PII at the end of the contract, and control transmission over networks.
PII sharing, transfer and disclosure
Inform the customer about transfers, subcontractors and changes to them, record disclosures, and notify the customer of legally binding disclosure requests where permitted.
Annexes C–F

Mappings and application guidance

Annex C
Mapping to the privacy principles in ISO/IEC 29100.
Annex D
Mapping to articles of the EU General Data Protection Regulation.
Annex E
Mapping to ISO/IEC 27018 and ISO/IEC 29151.
Annex F
How ISO/IEC 27001 and ISO/IEC 27002 are extended to the protection of privacy when processing PII.

Implementation roadmap

How to implement it, step by step

A typical route to a PIMS under the 2019 edition, built on an existing or parallel ISO 27001 ISMS. Organisations starting now should also consider the 2025 edition and the transition arrangements.

  1. 1

    Confirm the ISMS baseline

    Under the 2019 edition, the PIMS extends an ISO 27001 ISMS. Confirm the ISMS scope and how far it covers the systems and processes that handle PII.

    OutputsISMS scope review
  2. 2

    Determine your roles

    For each processing activity, decide whether the organisation acts as a PII controller, a processor, or both. This decides whether Annex A, Annex B or both apply.

    OutputsController and processor role map
  3. 3

    Map processing activities

    Record what PII is processed, for what purpose, on what basis, where it is stored and with whom it is shared, including transfers across jurisdictions.

    OutputsRecords of processingData flow maps
  4. 4

    Assess privacy risks and impacts

    Extend the ISMS risk assessment to privacy risks to individuals, and carry out privacy impact assessments where needed.

    OutputsPrivacy risk assessmentPrivacy impact assessments
  5. 5

    Select controls and update the Statement of Applicability

    Choose controls from Annex A or B and the extended ISO 27002 guidance, and record inclusions and justified exclusions in the Statement of Applicability.

    OutputsUpdated Statement of Applicability
  6. 6

    Implement privacy processes

    Put in place notices, consent handling, individual request handling, retention and disposal, processor and subcontractor contracts, and breach handling.

    OutputsPrivacy noticesRequest handling procedureUpdated contracts
  7. 7

    Audit, review and certify

    Include privacy in internal audit and management review. Certification to the 2019 edition is an extension of the ISO 27001 certificate, assessed by a certification body.

    OutputsInternal audit resultsCertificate extension
  8. 8

    Plan the move to the 2025 edition

    Review the differences with the certification body and plan the transition within the period set by accreditation bodies.

    OutputsTransition gap analysis

Audit and evidence guide

What auditors look for, and the evidence to keep

Under the 2019 edition, the PIMS is audited by an accredited certification body alongside, or as an extension of, the ISO 27001 audit. The auditor checks the privacy extensions to the management system and the controls in the Statement of Applicability.

What reviewers look for

  • A clear determination of where the organisation is a controller, a processor or both
  • A scope that covers the processing of PII
  • Records of processing that match what the systems actually do
  • Privacy risks and impacts assessed, not only information security risks
  • A Statement of Applicability that covers Annex A or B controls, with justified exclusions
  • Lawful basis and consent records for controller processing
  • Requests from individuals handled within the organisation’s defined timelines
  • Processor contracts and subcontractor arrangements that reflect the controls
  • Retention, de-identification and disposal carried out as defined
  • Records of transfers and disclosures to third parties

Key timelines

Certificate cycle, with surveillance audits between3 years
Internal audits and management reviewsAt planned intervals
Privacy risk assessmentsPlanned intervals, on change
Move certified clients to the 2025 edition, as set by UKAS and SCCBy 31 Oct 2028

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Roles and scope

  • Controller and processor role determination
  • PIMS scope
  • Interested parties register

Processing records

  • Records of processing
  • Purposes and lawful basis
  • Data flow and transfer records

Risk and impact

  • Privacy risk assessment
  • Privacy impact assessments
  • Statement of Applicability

Individuals

  • Privacy notices
  • Consent records
  • Request log with response times

Contracts

  • Controller and processor agreements
  • Subcontractor list and notifications
  • Disclosure records

Life cycle

  • Retention schedule
  • Disposal and de-identification records
  • Temporary file handling

Areas that often need attention

  • Roles as controller or processor never formally determined
  • Records of processing written once and not kept current
  • Privacy impacts left out of the risk assessment
  • Processor contracts that do not reflect the Annex B controls
  • Retention periods defined but disposal not carried out
  • Requests from individuals handled by email with no tracking
  • ISO 27002 references still tied to 2013 numbering after the ISMS moved to 2022, with no mapping

How Netra helps

Where each part of the work lives in Netra

Netra loads ISO 27701:2019 as requirements, tasks and policies alongside ISO 27001, so privacy work and security work share one record.

Privacy controls owned and tracked

Task Engine

Requirements arrive as tasks with owners and due dates. Recurring tasks keep records of processing, reviews and retention checks current.

Status for each clause and control

Compliance Centre

Status is derived from completed tasks and evidence. Work done for ISO 27001 also counts here where the same control applies.

Privacy and topic-specific policies

Policy Hub

A policy library generated at onboarding, with a score that moves as the work behind each policy is completed.

Privacy risk assessment

Risk Manager

A risk register with inherent and residual heatmaps, with risks reduced as the treating tasks are completed.

Processors, subcontractors and transfers

Third-Party Risk

Find vendors from what Accounts and Purchase pay, assess them through a vendor portal and record each decision with a rating.

Requests from individuals

Compliance Centre

Erasure and export requests are tracked against a 30-day SLA in Security & Privacy settings.

Internal and certification audits

Audit Centre

Run audits end to end with findings and corrective actions, using evidence held in a tamper-evident vault.

Netra organises privacy work and evidence. It is not a legal adviser and does not by itself establish compliance with ISO/IEC 27701 or any privacy law. Certification is assessed and issued by an independent certification body.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Privacy

GDPR

Make privacy accountability easier to demonstrate

Privacy

CCPA

Keep California privacy obligations organised

Security

ISO 27001:2022 (Requirements)

Build an ISMS your team can run every day

See ISO 27701:2019 in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.