The ultimate guide to ISO 27701: privacy extension to ISO 27001 (PIMS explained)

Photo: Unsplash

ISO/IEC 27701 extends ISO/IEC 27001 and 27002 with requirements and guidance for a Privacy Information Management System (PIMS). Organizations processing personal data use it to show structured privacy governance inside the same ISO-style management system they use for security.

Related guides:

• ISO 27001 vs ISO 27701
• How GDPR and ISO 27001 work together
• ISO 27001 collection

---

Key takeaways

• 27701 builds on an existing ISO 27001 ISMS—it is not a standalone replacement.
• It adds privacy-specific controls and roles (controller/processor) to your control set.
• GDPR compliance is a legal obligation; 27701 helps operationalize privacy in an auditable structure but does not equal GDPR certification.
• Certification statements may reference ISO 27001 with 27701 extension when your certification body supports it.

---

What is ISO/IEC 27701?

ISO/IEC 27701:2019 defines:

• Extensions to ISO 27001/27002 for privacy management
• Additional controls for PII controllers and PII processors
• Guidance on privacy roles, consent, retention, and subprocessors

It is commonly pursued by SaaS vendors, HR tech, healthtech, and any supplier processing customer or employee personal data at scale.

---

PIMS vs ISMS

	ISMS (27001)	PIMS (27701 extension)
Primary focus	Information security (CIA)	Privacy of PII
Risk lens	Security risk	Privacy risk + legal bases
Artifacts	SoA for security controls	Privacy extensions to SoA / policies
Stakeholders	CISO, IT, engineering	DPO, legal, product, security

In practice, many teams run one program with shared policies, unified risk register tags, and mapped evidence.

---

ISO 27701 and GDPR

GDPR requires accountability (records of processing, DPIAs, breach notification, etc.). ISO 27701 provides a control framework that aligns with many GDPR operational expectations—but:

• GDPR is law in the EU/UK context
• 27701 is a voluntary standard for management system design

See GDPR and ISO 27001 alignment.

---

When to adopt ISO 27701

Consider 27701 when:

• Enterprise buyers ask for privacy program evidence beyond security questionnaires
• You process large volumes of personal data across regions
• You already maintain ISO 27001 and want a structured privacy extension
• You act as a processor and need clearer processor/control mappings

If you only need security assurance today, ISO 27001 alone may suffice initially.

---

Implementation overview

1. Maintain or achieve ISO 27001 certification baseline.
2. Define privacy scope (which processing activities and roles).
3. Extend risk assessment for privacy threats and legal requirements.
4. Add 27701 controls to policies, SoA, and evidence plan.
5. Train teams on controller vs processor obligations.
6. Audit via certification body that supports 27701 extension (confirm scope with your CB).

---

SecureSlate for security + privacy programs

SecureSlate helps teams manage controls and evidence across ISO 27001 and privacy-aligned requirements—reducing duplicate work between security and privacy stakeholders.

Get started for free

---

Disclaimer (legal note)

This article is not legal advice. Privacy obligations depend on jurisdiction, role (controller/processor), and data categories. Consult qualified counsel.