Document control
Versions, approvals and distribution with read receipts.
Software for ISO 27701
ISO 27701, without folders or surprises
Processing activities, impact assessments, data subject rights, breaches and processors in an auditable privacy system linked to the GDPR.
What it is and which edition applies
ISO/IEC 27701 is the international standard for privacy information management systems (PIMS), aimed at controllers and processors of personal data. Its second edition, published in October 2025, withdraws the 2019 version and turns it into a standalone management system standard: it is no longer an extension of ISO/IEC 27001 and can be implemented and certified on its own, although it is designed to sit alongside an information security system and includes a mapping table to the GDPR.
- Current edition
- ISO/IEC 27701:2025 Second edition, published in October 2025; it cancels and replaces the 2019 edition
- Main change
- Standalone management system standard The 2019 edition was drafted as an extension of ISO/IEC 27001 and ISO/IEC 27002
- Who it is for
- Controllers and processors Of any size, whether public, private or not-for-profit
- Structure
- Clauses 4 to 10 and Annexes A to F Annexes A (controls) and B (guidance) are normative; C to F map to ISO/IEC 29100, the GDPR, ISO/IEC 27018 and 29151, and the 2019 edition
- Link to the GDPR
- Informative Annex D Mapping to Regulation (EU) 2016/679; certification is no substitute for legal compliance
- Committee
- ISO/IEC JTC 1/SC 27 Information security, cybersecurity and privacy protection
Connected to your document cloud
Publish and version documents by connecting to OneDrive, Google Drive or SharePoint, without duplicating folders.
Audits
Annual program, checklists per standard, findings linked to actions.
Non-conformities
Root cause, action, owner, deadline and effectiveness check.
KPIs
Process objectives fed with real operating data.
Legal requirements
A register of legal and other requirements, with validity and compliance evaluation per standard.
Corrective actions
Root cause, action, owner, deadline and effectiveness check, all linked to the nonconformity.
Improvement actions
Improvement opportunities with an owner and tracking, beyond just fixing what already failed.
Management review
A pre-built report with indicators, audits and nonconformities, ready for the meeting.
Processing and lawful basis
Every processing activity with its purpose, data categories, recipients and erasure deadline.
Data subject rights
Access, erasure or objection requests with the one-month deadline monitored and the reply on record.
Data breaches
A log of every breach with the decision on whether to notify and the 72-hour clock in plain view.
Processors
Contracts, authorised sub-processors and periodic review of every supplier handling data on the company’s behalf.
Requirements covered
What it solves for ISO 27701
- Record of processing activities with its lawful basis
- Privacy risk and impact assessment
- Data subject requests answered on time
- Logging and notification of personal data breaches
- Contracts and oversight of processors and sub-processors
- Statement of applicability for privacy controls
Standards covered
Pick your standard and see what it solves
GMP+
Animal feed safety
Food industry · animal feed
IATF 16949
Automotive
Automotive
SQAS2022
Chemical and logistics assessment
Quality · chemical and logistics
ISO 19600
Compliance management systems
Compliance · guidance
ISO 37301
Compliance management systems
Compliance
ISO 22716
Cosmetics manufacturing
Quality · cosmetics
GDPR
Data protection
Legal · data protection
ISO 14001
Environmental management
Environment
SGE 21
Ethical and responsible management
Social responsibility
IFS Food
Food safety
Food industry
ISO 22000
Food safety
Food industry
FSSC 22000
Food safety management system
Food industry
BRCGS
Global food standard
Food industry
ISO 14064
Greenhouse gases
Environment · carbon footprint
HACCP
Hazard analysis and critical control points
Food industry
ISO 27001
Information security
Cybersecurity
ISO 20000
IT service management
Quality · IT services
ISO 13485
Medical devices
Healthcare
ISO 15189
Medical laboratories
Quality · healthcare
ENS
National Security Framework
Security · public sector
UNE 73401
Nuclear quality assurance
Quality · nuclear
ISO 45001
Occupational health and safety
Health & safety
ISO 27701
Privacy management
Cybersecurity
ISO 9001
Quality management
Quality · every sector
ISO 26000:2010
Social responsibility
Social responsibility · guidance
Sustainability
Sustainability management
ESG
UNE 19602
Tax compliance
Compliance · tax
ISO 17025
Testing and calibration laboratories
Quality · laboratories
Templates and records
ISO 27701 records, explained one by one
Which clause of ISO 27701 calls for each record, which fields it needs, a completed example and what the auditor usually flags.
Record of processing activities
What the record of processing activities must contain in an ISO 27701 PIMS and under GDPR article 30…
Personal data inventory
How to build a personal data inventory for an ISO 27701 PIMS: where the data live, in which systems, who has…
Privacy risk assessment
How to document an ISO 27701 privacy risk assessment: criteria, risk to individuals, likelihood, impact…
Statement of applicability
What an ISO 27701 statement of applicability must contain: the Annex A controls, the reasons for each…
Privacy impact assessment
What a privacy impact assessment must contain under ISO 27701 and GDPR article 35: description, necessity…
Consent log
How to record consent so you can prove it under ISO 27701 and GDPR article 7(1): who, when, for what…
Data subject requests
How to log access, rectification, erasure or objection requests under ISO 27701 and the GDPR: the one-month…
Breach log
What a personal data breach log records under GDPR article 33(5) and ISO 27701: facts, effects, remedial…
Processor contract
What a processor contract includes under GDPR article 28(3) and ISO 27701: instructions, sub-processors…
Vocabulary
The terms, stated precisely
- PIMS
- Privacy information management system: the set of policies, processes, controls and records an organisation uses to govern the personal data it handles and to show that it handles it properly.
- Controller
- Whoever decides why and how personal data are processed. The standard calls it the PII controller and gives it its own group of controls.
- Processor
- Whoever processes personal data on behalf of the controller and following its instructions, such as a payroll or hosting provider. In the standard, the PII processor.
- Personally identifiable information (PII)
- The term the standard uses for what the GDPR calls personal data: any information that identifies, or could identify, a natural person.
- Data protection impact assessment (DPIA)
- A prior analysis of processing likely to pose a high risk to individuals, with the measures to reduce it. Article 35 of the GDPR requires one in those cases.
- Statement of applicability
- A document listing the Annex A controls, stating which apply and justifying those excluded. It is what ties the risk assessment to what is actually done.
Frequently asked questions
What people ask us before getting started
Which edition of the standard is current?
The edition in force is ISO/IEC 27701:2025. When the issuing body publishes a new one, a transition period opens; once it closes, certificates issued against the previous edition stop being valid.
Does this work if we are already certified?
Yes. Your existing system — processes, documents, records, audit history — is loaded in and kept alive from day one. Nothing needs redesigning and the certification cycle does not restart.
Will the auditor accept digital records?
Yes, provided they are traceable, controlled and able to show who did what and when. No standard requires paper; every standard requires reliable evidence, and a properly controlled electronic record provides it better than a folder.
Can it be combined with other standards?
Yes, and that is the sensible route. The common Annex SL structure lets a single integrated system share the process map, document control, internal audits, nonconformities and indicators between ISO 27701 and the rest, leaving only the standard-specific parts separate.
How long does it take to be ready for an audit?
It depends on the starting point. An organisation already working with written procedures is usually ready in two or three months; one starting from scratch needs longer. The bottleneck is rarely the tool — it is the availability of the people who know the processes.
What happens to the documentation we already have?
It is migrated. Existing procedures, forms and records are loaded with their version and approver, so the history is not lost and the system starts with the memory the organisation already had.
Can the auditor look directly at the system?
Yes. They are given read-only access with a defined scope and an expiry date. It is more comfortable for both sides than preparing a folder of screenshots and exports.
What is the difference between a major and a minor nonconformity?
A major one compromises the system's ability to meet a requirement — a required process missing altogether, systematic failure, or a failure affecting the product — and usually blocks certification until it is closed. A minor one is a specific lapse resolved with an action plan.
Are the indicators calculated automatically?
Yes, from the data the processes themselves generate. That is the difference between a dashboard that reflects what is happening and a spreadsheet somebody fills in the week before the management review.
Does it work across several sites or legal entities?
Yes. The model is multi-company and multi-site: what makes sense to share is shared, and what belongs to each location stays separate — including the certificate scope where it differs.
Get ready for your ISO 27701
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
ISO 27001, without folders or surprises
Asset inventory, risk analysis and Annex A controls, each with its status and owner.
What your IT lead is going to ask
Encryption, access control, an audit log, verified backups, and a data processing agreement that reads…
GDPR · Data protection
Free learning path on the GDPR: principles, data subject rights, security measures, and breaches explained…
ENS, without folders or surprises
Security measures under Spain's National Security Framework for public-sector services and systems, with…
Software for ISO 27701 — Privacy management
Kimobox is a software for ISO 27701 that digitizes the requirements of the standard: record of processing activities with its lawful basis, privacy risk and impact assessment, data subject requests answered on time, logging and notification of personal data breaches, with full traceability and evidence ready for the auditor.
The platform lets you run an integrated management system that combines ISO 27701 with other ISO standards and sector protocols, sharing the process map, document control, internal audits, non-conformities and KPIs.