Templates and records · ISO 27701
ISO 27701 templates and records
Nine records that hold a privacy system together: which clause of the standard or which GDPR article calls for them, which fields they carry and what a properly completed one looks like.
In one sentence
ISO/IEC 27701 prescribes no forms, but a certifiable privacy system must retain the privacy risk assessment (6.1.2 and 8.2), the statement of applicability (6.1.3) and evidence for every Annex A control it applies; several of those records —processing activities, breaches, processor contracts, proof of consent— are also direct GDPR obligations, so one and the same record serves both the auditor and the supervisory authority.
- Edition
- ISO/IEC 27701:2025 A standalone management system standard since October 2025
- System records
- Clauses 6 to 10 Risks, statement of applicability, audits, management review and nonconformities
- Annex A records
- Depending on the statement of applicability Every applied control needs its evidence; every excluded one, its justification
- Legal obligations
- GDPR arts. 7, 28, 30, 33 and 35 Consent, processors, record of processing, breaches and impact assessment
- Format
- Free, in writing GDPR art. 30(3) expressly allows electronic form
Contents
ISO 27701 templates and records
The 2025 edition is cited: numbers 4 to 10 are clauses; A.1, A.2 and A.3 are the Annex A tables with the controls for the controller, for the processor and common to both.
Record of processing activities
What the record of processing activities must contain in an ISO 27701 PIMS and under GDPR article 30…
Personal data inventory
How to build a personal data inventory for an ISO 27701 PIMS: where the data live, in which systems, who has…
Privacy risk assessment
How to document an ISO 27701 privacy risk assessment: criteria, risk to individuals, likelihood, impact…
Statement of applicability
What an ISO 27701 statement of applicability must contain: the Annex A controls, the reasons for each…
Privacy impact assessment
What a privacy impact assessment must contain under ISO 27701 and GDPR article 35: description, necessity…
Consent log
How to record consent so you can prove it under ISO 27701 and GDPR article 7(1): who, when, for what…
Data subject requests
How to log access, rectification, erasure or objection requests under ISO 27701 and the GDPR: the one-month…
Breach log
What a personal data breach log records under GDPR article 33(5) and ISO 27701: facts, effects, remedial…
Processor contract
What a processor contract includes under GDPR article 28(3) and ISO 27701: instructions, sub-processors…
Frequently asked questions
What people ask us before getting started
Which records are mandatory under ISO 27701?
Those of the system itself —privacy risk assessment and treatment, statement of applicability, audit programme and results, management review and nonconformities— plus evidence for every Annex A control that the statement of applicability marks as applied. A control excluded with a justification needs no record.
Do the same records work for the GDPR?
Largely, yes. The record of processing activities, the breach log, processor contracts and proof of consent are direct obligations under the Regulation, and the standard treats them as controls. The difference is that the certification auditor also checks that the system keeps them up to date and improves them.
Do I need ISO 27001 to use these templates?
No. Since the 2025 edition the standard stands on its own. If an ISMS already exists, the risk assessment, the statement of applicability and the incident log can be shared, extended with a privacy lens.
Keep your ISO 27701 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring