Learning path
ISO 27701 — Privacy management
Clauses 4 to 10 of the 2025 edition, the Annex A controls for controllers and processors and how they map to the GDPR, explained with examples.
Your progress
It is saved only in this browser on this device: no account needed and nothing leaves your machine. Clear the site data or open it on another device and you start from scratch.
- 1 Context and scope of the PIMS How to decide which processing activities the system covers and in what role the organisation acts in each. Clause 4
- 2 Leadership and privacy policy What top management must demonstrate and what the privacy policy should say. Clause 5
- 3 Privacy risks and planning How to assess the risk to individuals, treat it and build the statement of applicability. Clause 6
- 4 Support, competence and documentation Resources, training, awareness, communication and the system’s documented information. Clause 7
- 5 Operating the PIMS Planning and controlling processes and repeating risk assessment and treatment. Clause 8
- 6 Performance evaluation Privacy indicators, internal audit and management review. Clause 9
- 7 Improvement and nonconformities How to deal with system failures and demonstrate continual improvement. Clause 10
- 8 Controls for controllers and processors What Annex A contains, how it is split between controllers and processors and how Annex B is used. Anexos A y B
- 9 Mapping to the GDPR and ISO 27001 What the mapping tables add and how to work alongside ISO 27001 and the GDPR. Anexos C a F
Every clause of ISO 27701, explained with examples
Since the October 2025 edition, ISO/IEC 27701 has its own management system clauses, with the same structure as ISO/IEC 27001 or ISO 9001, and no longer depends on an existing information security system to be certified.
This path works through each clause with the records an auditor usually asks for —privacy risk assessment, statement of applicability, rights requests, breaches— and explains where the standard overlaps with GDPR obligations and where it does not.
Keep exploring
Related pages
GDPR · Data protection
Free learning path on the GDPR: principles, data subject rights, security measures, and breaches explained…
ISO 27001 · Information security
A free learning path on ISO 27001: the information security standard's seven clauses explained with examples…
ISO 27001, without folders or surprises
Asset inventory, risk analysis and Annex A controls, each with its status and owner.
What your IT lead is going to ask
Encryption, access control, an audit log, verified backups, and a data processing agreement that reads…