The international standard for privacy information management. ISO 27701 certifies how you handle personal data, helping organisations demonstrate GDPR and global privacy law compliance.
What is ISO 27701?
ISO/IEC 27701:2025, published in October 2025, provides a framework for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS). It addresses both PII controllers and PII processors. The 2025 edition replaced the 2019 version and made the standard standalone: prior ISO 27001 certification is no longer a prerequisite, so a PIMS can now be certified on its own.
The standard maps directly to GDPR requirements, making it one of the most practical tools for demonstrating accountability under European data protection law. It is also aligned with other global privacy regulations including CCPA, LGPD, and PIPEDA.
ISO 27701 certification provides independent assurance to customers, regulators, and partners that your organisation has implemented a robust privacy management programme.
Compliance requirements
ISO 27701 sets out privacy-specific requirements and controls, covering both PII controllers and processors.
A management system for personal data, covering privacy-specific policies, objectives, and controls, built standalone or alongside an existing ISMS.
Organisations acting as PII controllers must implement controls covering purpose limitation, consent management, data subject rights, and third-party disclosures.
Organisations acting as PII processors must implement controls for processing under instruction, sub-processor management, and customer obligations.
Conduct privacy-specific risk assessments (Privacy Impact Assessments) to identify and treat risks to individuals arising from personal data processing.
Implement processes to handle access, rectification, erasure, portability, and objection requests within required timeframes.
Embed privacy considerations into system design, data minimisation practices, and default privacy settings across all processing activities.
Audit process
Netru manages the complete ISO 27701 certification journey, building your PIMS standalone or alongside an existing ISO 27001 ISMS.
Since 2025 a PIMS can be certified standalone. We confirm whether an existing ISMS is worth building on or whether to certify the PIMS on its own.
We assess your current privacy practices against ISO 27701 Annex A (controller) and Annex B (processor) controls.
Your compliance manager designs the PIMS scope, privacy policy framework, and data processing inventory.
We implement privacy controls, draft Records of Processing Activities (RoPA), and build your privacy evidence library.
A formal internal audit verifies the PIMS is operating effectively before the external certification audit.
The certification body assesses your PIMS alongside your ISMS. Netru manages the entire process and auditor liaison.
You receive ISO 27701 certification, demonstrating accountability and privacy governance to customers and regulators.
How Netru delivers it
Our team combines ISO 27001 and privacy law expertise to design and implement your PIMS. We handle everything from RoPA creation to certification body liaison, so your team can focus on your business.
Talk to our teamBefore you talk to anyone