Overview
ISO/IEC 27701:2025, published in October 2025, is now a standalone management system standard. Organizations can implement and certify a Privacy Information Management System (PIMS) without first holding ISO 27001 certification, and it can still be integrated with an existing ISMS, QMS, or AI Management System. The 2025 edition replaces the 2019 version; certificates to the 2019 edition remain valid during a three-year transition period ending October 2028.
What it covers
- Standalone standard, no longer an extension of ISO 27001
- Full management system clauses (4–10) in the harmonized structure
- Reorganized Annex A controls: about 31 for PII controllers, 18 for PII processors, and 29 shared information security controls
- Stronger alignment with global privacy regulations, including GDPR, and with ISO 27001:2022 and ISO 42001
- Its own privacy risk assessment process, focused on risks to individuals
How we help
Implementation, audits and maintenance.
Implementation
We help you define scope and roles (controller, processor, or both), run a privacy risk assessment, design controls, and build the governance and documentation needed for a certifiable PIMS. For organizations already certified to the 2019 edition, we map the transition to the 2025 control set and clauses.
Audits
Internal PIMS audits, readiness reviews against the 2025 requirements, and certification audit support, including transition audits for organizations moving from the 2019 edition.
Maintenance
Ongoing privacy control reviews, surveillance support, and continual improvement so the PIMS stays effective as regulations and processing activities change.
Typical outcomes
What you have at the end
- Clear scope and documented roles for PII processing
- Privacy risk assessment and treatment plan
- Statement of Applicability aligned to Annex A (2025)
- Evidence ready for certification or transition audit
- A system that can stand alone or integrate with ISO 27001, ISO 9001, or ISO 42001
Relevant credentials
Who does the work
Lead Auditor
Mastermind Assurance · valid to Sep 2029Typical engagement
From gap analysis to certification.
Gap analysis
Current-state assessment against the standard and your obligations.
Risk assessment
Identify what could go wrong and plan how to treat it.
Governance & process design
Roles, policies and processes sized to how you operate.
Implementation & controls
Hands-on support designing and evidencing controls.
Internal audit & readiness
Independent internal audit and Stage 1 / Stage 2 preparation.
Training
Build capability so your team can run the system.
Related services
Often implemented together
Information Security
Build and certify an ISMS, from risk assessment and Annex A controls to Stage 2.
Learn more → ISO/IEC 42001:2023AI Management System
Accountability, AI impact assessments and controls for a certifiable AIMS.
Learn more → ISO · CMMI · NISTGovernance, Risk & Compliance
Governance and control frameworks aligned to ISO, CMMI and NIST.
Learn more →Ready to start on ISO/IEC 27701?
Preparing for ISO certification, tightening governance, or need an independent assessment? Tell us where you are and we’ll map the route.
Or email sales@metronguard.com