ISO 27701

Are you a PII controller, a processor, or both? Learn the difference in ISO 27701, why it determines which controls (Annex A vs Annex B) apply, and how to decide.

ISO 27701 helps operationalize GDPR through a certifiable privacy management system — records of processing, data subject rights, and a GDPR mapping. But certification is not legal compliance.

ISO 27701 extends ISO 27001 — it is not standalone. Learn how the privacy standard builds on the ISMS, what it adds, and why organizations certify to both.

ISO 27701 certification step by step — the ISO 27001 prerequisite, determining your controller/processor role, extending the system, and the integrated audit.

ISO 27701 documentation comes in two layers — your ISO 27001 ISMS plus privacy-specific documents. Here is the complete checklist of what the PIMS adds.

ISO/IEC 27701:2019 extends ISO 27001 to manage data privacy. Learn what a PIMS is, how it maps to GDPR, the controller/processor roles, and how to get certified.