ISO/IEC 27701:2025
Privacy Information Management System
ISO/IEC 27701 (2025) is a management system standard: Privacy Information Management System. Specifies requirements and guidance for a privacy information management system for PII controllers and processors. ISO describes the 2025 edition as an independent management system standard that can be used on its own. It applies to organisations processing personal data, especially SaaS, healthcare, finance, HR, marketing and contact centres.
- Class
- Management system standard
- Edition
- 2025
- Related sectors
- 3
- Last verified
What is this standard?
Specifies requirements and guidance for a privacy information management system for PII controllers and processors. ISO describes the 2025 edition as an independent management system standard that can be used on its own.
What ISO/IEC 27701 does not replace
- It must not be claimed to replace KVKK or GDPR compliance, or legal advice.
- It does not replace an information security management system (ISO/IEC 27001); ISO says the 2025 edition can be used alone.
Who is it for?
Organisations processing personal data, especially SaaS, healthcare, finance, HR, marketing and contact centres.
What triggers an assessment?
- PII is processed as a controller or processor.
- A customer or contract requires a privacy assurance.
- The processor/controller role needs to be evidenced.
Official source
Last verified:
This page is for information only; it is not legal advice. A record appearing here does not mean it is required for your business. This library does not issue certificates.