Privacy information management

STANDARD SUMMARY

The starting point

Make responsibility for personal information visible across the organisation. ISO/IEC 27701 sets requirements and provides guidance for a privacy information management system, or PIMS.

The 2025 edition can be implemented as a standalone management system. It can also work alongside an information security management system. Certification supports a structured approach to privacy; it does not replace the organisation’s responsibilities under applicable data protection law.

Who it is for. Organisations acting as controllers or processors of personally identifiable information, including service providers, employers and organisations with complex data sharing arrangements.

Treat privacy as an operating system

A PIMS helps an organisation organise responsibilities, decisions and evidence around personal information. The 2025 standard applies to PII controllers and processors and can operate independently of ISO/IEC 27001.

Our suggested starting point is to choose a real processing activity and trace it through collection, use, access, sharing, retention and deletion. Identify the people who make decisions at each step. Privacy work becomes easier to manage when the organisation can explain what happens to information and who can change the process, rather than maintaining separate inventories that describe different versions of the same activity.

Determine roles from the actual processing

Under the ICO’s guidance, controller and processor roles depend on the actual purposes and means of processing. An organisation may have different roles for different activities; a contractual label alone does not settle the analysis.

For implementation, describe each relevant relationship in plain language. What is the service, whose purposes are being served, which decisions are retained by each party and what instructions apply? Ask legal and operational colleagues to resolve unclear cases together. Record the reasoning and review it when the service changes. Avoid assigning one organisation-wide role if that hides meaningful differences between activities.

Connect governance to the data lifecycle

Our practical recommendation is a single route from an activity record to the decisions and evidence supporting it. That route might include the relevant notice, a legal basis assessment where applicable, a contract, access arrangements, retention decisions and the owner of any open issue.

Use the licensed standard and applicable law to determine what is required for the organisation. The items above are examples, not a claim that every activity needs the same documents. Where the evidence is held in another system, link to its controlled location instead of creating an unmanaged duplicate. Make changes reviewable so that an old description is not mistaken for current practice.

Test privacy processes through realistic cases

Choose a small set of realistic scenarios to test how teams respond. Examples include a request to access information, a proposed new supplier, a disputed deletion request or a change in the use of existing data. Set the facts carefully enough that the team can explain its decision.

Inspect the handovers between customer service, operations, security and legal roles. Check whether the organisation can find relevant records, verify the appropriate identity or authority, track the decision and communicate the outcome. These are suggested exercises. Applicable legal deadlines and exceptions require a separate assessment; a generic practice scenario should not be presented as legal advice.

Keep privacy and security risks connected

Information security and privacy overlap, but a secure processing activity can still raise privacy questions about purpose, fairness or the effect on individuals. Use separate reasoning where necessary while sharing factual information and relevant controls.

For a proposed service, consider what could go wrong for affected people, how the proposed controls address that harm and what uncertainty remains. Under ICO guidance, a DPIA is required where processing is likely to result in high risk; not every project automatically has that legal trigger. Record the assessment of the trigger and obtain the appropriate expertise for difficult decisions. Review assessments when the processing materially changes.

Prepare evidence for a standalone or integrated PIMS

Decide whether the organisation will implement a standalone PIMS or integrate it with an existing management system. Shared processes can reduce duplication, but the privacy scope and responsibilities still need to be understandable on their own.

Our proposed audit preparation includes tracing selected activities, sampling supplier responsibilities, testing privacy request handling and checking whether management decisions resolve recurring weaknesses. Confirm that the certification body has the relevant accreditation and transition arrangements for the edition and scope being offered. Do not describe ordinary ISO/IEC 27701 certification as regulatory approval of every processing activity or as an automatic GDPR certification scheme.

IMPLEMENTATION ADVICE

Evidence to prepare

• A PIMS scope identifying relevant entities, processing activities and controller or processor roles.
• Activity records connected to data flows, owners, purposes, recipients and retention decisions.
• Applicable requirement assessments, privacy risk decisions and DPIAs where required.
• Supplier and customer responsibilities reflected in actual instructions and operating arrangements.
• Evidence of privacy request handling, incident coordination and change review.
• Internal audit findings, management review decisions and effectiveness checks on improvements.

Common pitfalls

• Describing the 2025 edition as available only as an extension to ISO/IEC 27001.
• Assuming that a contractual label determines the controller or processor role.
• Equating a PIMS certificate with complete GDPR compliance or regulator endorsement.
• Maintaining a processing inventory that is disconnected from current services and suppliers.

FICTIONAL WORKED EXAMPLE

Fictional example: separating privacy roles by activity

A fictional hosted-service supplier handles customer records and also maintains its own marketing list. This educational scenario is not a legal conclusion about a real organisation.

A contract label, readiness score or PIMS certificate does not settle every legal role or establish complete data-protection compliance.

Related guidance and practical next steps