Templates and records · ISO 27701 · Clause 6.1.3

ISO 27701 statement of applicability template

The first document an auditor opens: it runs through every Annex A control and states which apply, why, and how far each has been implemented.

In one sentence

The ISO/IEC 27701 statement of applicability lists the Annex A controls, states which are applied and which are excluded with a justification, and gives the implementation status of each, because clause 6.1.3 requires the controls chosen to treat privacy risks to be compared with those in Annex A and that decision to be recorded.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 27701 · Clause 6.1.3 The 2025 edition is cited: numbers 4 to 10 are clauses; A.1, A.2 and A.3 are the Annex A tables with the controls for the controller, for the processor and common to both.
Type of information: Mandatory document A document that must be kept up to date (6.1.3)
Who fills it in: PIMS manager Approved by top management or by whoever holds the authority assigned under 5.3
When: After every risk assessment And whenever the scope, the organisation’s role or the controls change
How long it is kept: For as long as the processing exists It is a living document: it is updated and the previous version kept, so you can show what it looked like at any point.

What the standard requires

What ISO 27701 demands and what it leaves to your judgement

Once risks are assessed, the standard asks you to select the controls needed to treat them and compare them with Annex A so that none that is necessary is left out. The statement of applicability records the outcome: which controls are included, why, whether they are implemented and why the rest are excluded.

The organisation’s role weighs heavily: a processor can justify excluding the table A.1 controls for the processing it performs on behalf of customers, and a controller that uses no processors will have little to apply from table A.2. Exclusions must be reasoned, not assumed.

If the organisation also holds ISO/IEC 27001, it can keep two statements or a single integrated one; what it cannot have is two that contradict each other.

Read it in context: Privacy risks and planning, in the ISO 27701 Academy

Structure

Fields the template should include

Identifier and name of each Annex A control
Table it belongs to: A.1, A.2 or A.3
Applicable or not applicable
Reason for inclusion: risk, legal or contractual requirement
Reason for exclusion
Implementation status
Associated evidence or record
Control owner
Version, date and approval

Example

Example: three lines from the statement of a fictitious payroll software provider

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Organisation	Paywell Cloud Ltd (fictitious) · Processor for its customers and controller for its own staff
Consent control (A.1)	Applies only to its own marketing newsletter · Implemented · Evidence: consent log
Control on processing per customer instructions (A.2)	Applies · Implemented · Evidence: processor contracts and instructions procedure
Incident management control (A.3)	Applies · Implemented · Evidence: breach log shared with the ISMS
Sample exclusion	A.1 controls on informing data subjects, for customers’ payroll data: not applicable, the customer is the controller
Version	v3 · 2 May 2026 · Approved by the managing director

At the audit

Mistakes auditors commonly flag

Whole blocks of controls are excluded with a bare “not applicable” and no justification.
The statement does not match the risk assessment: applied controls that treat no risk, and risks with no control.
It still follows the 2019 numbering after the transition.
A control is marked as implemented with no evidence to show.

In Kimobox

How this record is kept in Kimobox

1Annex A controls are loaded as a versioned table with their status and owner.
2Each control is linked to the risks it treats and to the record that evidences it.
3The statement is a controlled document: every version is approved and dated.

Frequently asked questions

What people ask us before getting started

Can I use the ISO 27001 statement of applicability?

It can be integrated, but it is not enough as it stands: the ISO/IEC 27701 Annex A contains privacy controls for controllers and processors that are not in ISO/IEC 27001.

What happens if a necessary control is excluded?

It is one of the most common nonconformities at certification: if the risk or the GDPR makes the control necessary, the exclusion does not stand.

Keep your ISO 27701 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring