ISO/IEC 27701:2025: plan a standalone privacy management system

PRACTICAL GUIDANCE

The starting point

The 2025 edition is a standalone privacy management-system standard. Review the actual processing scope and governance, and use the published UKAS transition dates rather than treating them as still pending.

What changed and when

ISO/IEC 27701:2025 was published on 14 October 2025. It establishes a standalone privacy information management system, whereas the 2019 edition extended ISO/IEC 27001 and ISO/IEC 27002.

UKAS revision 1 of its PIMS bulletin, dated 18 August 2026, sets 31 October 2027 for transition of accredited certification bodies and 31 October 2028 for their certified clients. These are UKAS arrangements; confirm the applicable scheme and assessment schedule for your own certificate.

Start with actual processing and responsibility

Our practical starting point is a map of the processing activities that the proposed system will cover. Include the purpose, personal information, systems, recipients and accountable decision-makers. The organisation may play different roles in different activities.

ICO guidance explains that controller and processor status follows the facts of who determines the purposes and means of processing. A contract label is not sufficient on its own. Resolve uncertain roles before using them to select controls or describe the scope.

• Identify the services and legal entities included in the proposed PIMS.
• Map controller, processor and any joint-controller activities separately.
• Connect each processing activity to its risk decisions and operational evidence.
• Record interfaces with security, procurement, rights handling and incident management.

Reuse working arrangements carefully

A standalone structure does not prevent integration with an information security management system. Shared document control, audit planning or review processes may be useful, provided they preserve the privacy-specific decisions and responsibilities.

Test whether management information explains what happens to people’s information, rather than simply showing that IT tasks were completed. Sample a new service, a supplier change or a rights request to examine the handovers.

Keep the compliance claim precise

A privacy management system can organise accountability, but certification is not a blanket finding of compliance with every privacy law. Legal duties and their application still depend on the processing and jurisdiction.

Use the audit brief to describe your processing scope, current system and transition concerns without including personal records. Agree what needs specialist legal assessment as well as management-system review.

Related guidance and practical next steps