In short
ISO/IEC 27701:2025, published on 14 October 2025, is a standalone standard: it can be certified even without ISO 27001.
In Italy, certificates issued against the 2019 version must be transitioned to 2025 by 31 March 2028 (Accredia circular DC 33/2026), ideally during an audit already scheduled.
ISO 27701 helps demonstrate the accountability required by the GDPR, but it is not a GDPR certification under Article 42.
It is especially useful for processors, SaaS companies and IT suppliers that must provide guarantees to customers (Article 28 GDPR).
If you already hold ISO 27001, the most efficient route is an integrated security and privacy system.
ISO 27701 is the international standard for managing privacy as a system rather than a pile of documents. For many companies the problem is a practical one: customers ask for evidence of GDPR compliance, supplier security questionnaires keep getting longer, and ISO 27001 on its own is no longer enough to answer questions about personal data.
In October 2025 the standard was substantially revised. The new ISO/IEC 27701:2025 is no longer an extension of ISO 27001: it has become a standalone standard that can be certified on its own. Organisations certified to the 2019 version must move to the new edition by a set deadline, and anyone considering certification today needs to work out whether to start with 27001, with 27701 or with both.
In this guide you will find what ISO 27701 certifies, what changed with the 2025 revision, how it relates to the GDPR, who really needs it, how it fits into an existing ISO 27001 system and which steps to follow, along with the mistakes to avoid along the way.
What is ISO 27701 and what does it certify?
ISO 27701 sets out the requirements for a privacy information management system, known as a PIMS (Privacy Information Management System). In practice, it establishes how an organisation should plan, implement, monitor and continually improve the way it handles personal data, which the standard calls PII (Personally Identifiable Information).
What is a PIMS? A PIMS is the set of roles, rules, processes and controls through which a company governs its processing of personal data. It is not a piece of software or a single document: it is the way the organisation decides who does what, how it assesses risks to individuals, how it responds to their requests and how it checks that everything works.
From "paperwork" compliance to a management system
Many companies approached the GDPR with a document-driven mindset: privacy notices, appointments, a record of processing activities, a few procedures. The limits show after a year or two. The record is not updated when a supplier changes, access requests land in a generic inbox and nobody knows who should reply, and impact assessments are stuck at their first version.
ISO 27701 solves this by applying the logic of ISO management systems to privacy. There are measurable objectives, top management that takes responsibility, internal audits, periodic reviews and corrective actions. What changes, compared with a purely document-based approach, is the ability to demonstrate over time that the rules are actually applied. It is the same difference as between having a data breach procedure and being able to show an auditor the incident log for the past year, with handling times and reasoned decisions.
Controller and processor in the language of the standard
The standard distinguishes two roles that anyone familiar with the GDPR will recognise straight away. The PII controller is the data controller: it decides why and how data is processed. The PII processor is the data processor: it processes data on behalf of the controller, following its instructions.
The distinction is not theoretical. The controls a company must apply change according to its role: a controller has to deal with legal bases, privacy notices, consent and data subject rights; a processor has to demonstrate that it follows the customer's instructions, manages sub-processors properly and returns or deletes data at the end of the contract. Many companies are both: a software house is the controller for its own employees' data and its sales leads, but the processor for the data its customers upload to its platform. Defining the role clearly for each processing activity is the first step of the project, and the scope of the certification depends on it.
ISO/IEC 27701:2025: what changed from the 2019 version?
ISO/IEC 27701:2025 was published on 14 October 2025 as the second edition of the standard and replaces the first edition from 2019. The main change is structural: the standard is no longer an extension of ISO 27001 and ISO 27002, but a standalone management system standard.
From extension to standalone standard
In the 2019 version, ISO 27701 could not stand on its own. It was built as an "add-on" to ISO 27001: to get certified you needed an information security management system compliant with 27001 (or to obtain one at the same time), on top of which privacy-specific requirements and controls were added. This is why, for years, ISO 27701 was described as "the privacy extension of 27001", and it is the reason for the title of this guide.
With the 2025 edition this constraint disappears. ISO 27701 now contains its own management system clauses and can be certified even by an organisation that does not hold ISO 27001. This does not mean information security disappears: the standard includes security controls applicable to personal data, because protecting data remains a privacy requirement. It means that a company whose main goal is personal data governance can build its system starting from privacy, without first having to certify the entire information security scope.
Harmonised structure and privacy risk at the centre
The new edition adopts the harmonised structure shared by all ISO management system standards, with clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation, improvement. It is the same architecture as ISO 27001:2022, ISO 9001 and ISO 42001, which makes managing integrated systems much simpler.
According to summaries published by accreditation bodies, the revision has also strengthened the requirements on leadership, governance and performance evaluation, formally brought privacy risk management into the management system and introduced the climate change considerations already added to other ISO management system standards. In practical terms, risk assessment no longer concerns only data security (confidentiality, integrity, availability), but also the risk to the rights and freedoms of individuals: processing that is perfectly protected against cyber attacks can still be risky if it collects more data than necessary or keeps it for too long.
Controls reorganised for controllers and processors
The specific controls for controllers and processors have been restructured and clarified. In 2025 they are gathered in Annex A, a normative annex organised in three tables: A.1 with the controls for controllers, A.2 with the controls for processors and A.3 with some information security controls common to both. Annex B provides implementation guidance for the controls; among the informative annexes, the standard includes a mapping to the GDPR (Annex D) and a correspondence table with the 2019 edition (Annex F), which is useful for anyone who has to transition.
For those already working with ISO 27001 the effect is familiar: as with Annex A of 27001, the company selects the applicable controls based on its risks and its role, and justifies any exclusions. A company acting only as a processor, for example, can exclude with justification the controls designed for controllers, and vice versa. As Accredia, the Italian national accreditation body, points out, the Annex A controls, and the A.3 security controls in particular, are not exhaustive: depending on the risk assessment, further controls may be needed, for example on asset inventory, business continuity and physical security.
Certified to the 2019 version: when do you need to move to 2025?
For certificates issued in Italy under Accredia accreditation, the move to the 2025 version must be completed by 31 March 2028. This is set out in Accredia technical circular DC no. 33/2026, under which certificates that have not transitioned must be withdrawn from 1 April 2028. Internationally, the timeline agreed among accreditation bodies in the IAF working group and adopted, for example, in the United Kingdom and Canada sets the deadline at 31 October 2028 instead.
Key dates to keep in mind
The timeline has three milestones. The first is the publication of the standard, on 14 October 2025. The second concerns certification bodies, which must be accredited to the new edition: in Italy the transition of accreditations must be completed by 31 October 2027, and from 1 November 2027 accreditations that have not transitioned will be withdrawn. The third is the one that directly affects companies: by 31 March 2028 all ISO/IEC 27701:2019 certifications issued under Accredia accreditation must be transitioned to the 2025 version. For certificates issued under another accreditation, the deadline set by the relevant accreditation body applies.
Until then, a 2019 certificate remains valid under normal conditions, meaning as long as surveillance audits take place regularly and the system keeps working. A practical detail: Accredia does not require a dedicated transition audit. The certification body carries out a gap analysis for each client and, if needed, adds audit days to the next scheduled audit or holds an extraordinary audit, so it is worth asking early which window it proposes.
How to plan the transition without stress
The most efficient way to handle the transition is to tie it to an audit that is already scheduled, either surveillance or recertification, so you avoid an extra visit: this is also the route Accredia provides for, allowing any additional audit days to be carried out at the next scheduled audit. The work to do before the audit comes down to a few practical steps:
Gap analysis between the current system and the 2025 requirements, using the standard's correlation table to map old controls to new ones.
Updating the risk assessment, explicitly including the risk to data subjects and not just the risk to data security.
Reviewing the Statement of Applicability, with the new control references and the justifications for exclusions.
Aligning the management system clauses (context, objectives, top management roles, review) with the harmonised structure.
Targeted training for those who run the system and an internal audit against the new edition before the certification body's visit.
A practical example
Take an Italian company certified to ISO 27001 and ISO 27701:2019, with its certificate renewal due in mid-2027. In this case it makes sense to align the transition with the renewal: the system is updated in the preceding months and the recertification audit already assesses the 2025 version. If, however, the certification cycle ends after March 2028, the transition will have to take place during an intermediate surveillance audit or an extraordinary audit, because the renewal would come too late. Another common scenario: the company holds 27001 and 27701:2019 on the same certificate. With the 2025 version it can decide whether to keep the two standards integrated or manage 27701 as a separate certification, for example with a different scope.
ISO 27701 and the GDPR: what does certification prove and what does it not?
ISO 27701 is a tool for demonstrating the accountability required by the GDPR, but it is not the same as a GDPR compliance certification. This is the most important distinction to understand before starting the project, and also the one most often blurred in sales messaging.
An accountability tool
The GDPR requires the controller not only to comply with the principles of the regulation, but to be able to demonstrate it (Article 5(2) and Article 24). The regulation, however, does not say how to organise that demonstration. This is where ISO 27701 helps: it offers an internationally recognised framework for keeping processing activities, risks, data subject rights, suppliers and incidents under control, with evidence verified by an independent third party.
The standard contains an informative table linking its requirements and controls to the articles of the GDPR. It is a valuable working tool for the DPO or privacy lead, because it shows which parts of the system address which obligations. It remains informative, though: the certification audit assesses the ISO standard, not the regulation. If you want a refresher on the regulation's obligations, you will find them in our guide to the GDPR, its origins and what's new.
Supplier relationships: Article 28
For processors, ISO 27701 has very concrete value. Article 28 of the GDPR requires controllers to use only processors that provide sufficient guarantees regarding technical and organisational measures. In practice, every customer has to vet its suppliers, and does so through questionnaires, document requests and sometimes audits.
An ISO 27701 certificate does not legally replace this check, but it makes it much simpler: the customer finds, in a single document, proof that the supplier has a privacy management system verified by a third party, with specific controls for processors such as following instructions, managing sub-processors, returning or deleting data and notifying incidents. For a SaaS company that receives dozens of questionnaires a year, this means shorter sales cycles and fewer hours spent answering the same questions over and over.
Why it is not a "GDPR certification" under Article 42
The GDPR provides for its own certification mechanisms (Articles 42 and 43), based on criteria approved by national supervisory authorities or, for the European Data Protection Seal, by the European Data Protection Board (EDPB). ISO 27701 is not one of these mechanisms: it is a voluntary technical standard, and Accredia itself states that ISO 27701 certification is not to be considered a certification mechanism under Article 42. That is why it is correct to say that ISO 27701 certification "supports" or "facilitates" GDPR compliance, while it is wrong to present it as a "GDPR certification". The difference also matters during an inspection: before the data protection authority (in Italy, the Garante Privacy) the certificate is useful evidence of how the organisation is run, but it does not exempt the company from responsibility for individual processing activities. After all, not even the certifications provided for by the GDPR reduce the responsibility of the controller or processor (Article 42(4)).
Who needs ISO 27701 certification?
ISO 27701 is not legally mandatory for any company. It does, however, become very useful, and sometimes effectively necessary, for those who process personal data on behalf of others or who handle sensitive processing on a large scale.
Processors, SaaS companies and IT suppliers
This is the audience for which ISO 27701 delivers the most immediate return. Software houses, SaaS platforms, cloud service providers, data centres, development companies, call centres and HR or administrative outsourcers process their customers' personal data and must show that they know how to do it. When the customer is a large enterprise, a bank or a public authority, supplier qualification procedures increasingly ask for specific privacy evidence on top of ISO 27001.
A typical example: a software house running a management system for medical practices processes health data, which falls under the special categories of Article 9 of the GDPR. Its customers are required to verify that the supplier provides adequate guarantees. With ISO 27701 the software house can respond with a certificate and a Statement of Applicability showing which controls it applies as a processor, instead of filling in fifty-question questionnaires every time.
Controllers with sensitive data or high volumes
Controllers can also benefit greatly from the standard, especially in certain contexts. These are the cases where privacy management is part of the value offered to customers or of the business risk:
private healthcare providers, laboratories, diagnostic centres and organisations that process health or genetic data;
e-commerce, retail and companies with loyalty programmes that manage large customer bases and profiling activities;
recruitment and HR services companies, which process data on candidates and workers;
companies operating across several countries that need to manage data transfers outside the EU;
corporate groups with multiple controllers and joint controllers, which need common rules.
For these profiles, ISO 27701 helps move from compliance done "once" to continuous control, with internal audits and reviews that surface problems before they turn into complaints or breaches.
When ISO 27701 is not the first priority
In some cases certification can wait. A small company that only processes employee and B2B customer data, with no special categories or large-scale processing, and that receives no requests from customers, will gain more from solid GDPR compliance and, where appropriate, the support of a DPO. Similarly, if customers mainly ask for information security guarantees, for example because of NIS2 obligations, the priority is often ISO 27001, to which 27701 can be added later. Choosing the right order avoids investing time in a certification the market is not yet asking for.
How does ISO 27701 integrate with ISO 27001?
If you already have an ISO 27001 system, ISO 27701 fits in naturally: the two standards share the same structure and many of the same tools. Even though the 2025 version is standalone, for those who already hold 27001 the most efficient route is almost always an integrated system covering security and privacy.
What you can reuse from your ISO 27001 system
Thanks to the harmonised structure, many components of the information security management system can be extended rather than duplicated. Analysis of context and interested parties, document management, internal audit, management review, handling of nonconformities and corrective actions, training and incident management can remain single processes, with dedicated privacy additions.
The security controls in Annex A of 27001, such as access control, cryptography, backup, supplier security and incident management, also provide the foundation for the common security controls of 27701. If the 27001 system is well built, a significant part of the work is already done. For a refresher on clauses, Annex A and the Statement of Applicability, you can start from our complete guide to ISO 27001.
What you need to add for privacy
What 27001 does not cover is the data subject's perspective. For ISO 27701 you need to add, or bring to an auditable level, a few specific elements: identifying the role (controller, processor or both) for each processing activity, the record of processing activities linked to the asset inventory, privacy risk assessment and impact assessments, management of legal bases and consent, processes for responding to data subject rights, retention and deletion rules, management of transfers outside the EU and contracts with sub-processors.
A practical example: in the 27001 system, the incident management process assesses the impact on the company. In the integrated system, the same process must also assess whether the incident is a personal data breach, whether it must be notified to the data protection authority within 72 hours and whether it must be communicated to data subjects, documenting the decision even when notification is not required.
Integrated or separate audit
With the 2025 version the company can choose. It can certify 27001 and 27701 in the same integrated audit, with a single surveillance schedule and a consistent scope, or keep two separate certifications, perhaps with different scopes: for example 27001 across the whole company and 27701 only on the platform that processes customer data. The choice depends on what the market is asking for and how the company is organised. If you do not yet have 27001, it is worth considering ISO 27001 certification together with 27701, because building the two systems in parallel takes less work than doing it at two different times.
How to get ISO 27701 certified: the operational phases
The path to ISO 27701 certification follows the typical phases of any ISO management system, with some privacy-specific activities. The sequence is the same whether you start from scratch or extend an existing 27001 system; what changes is the amount of work in each phase.
Phase 1: scope, roles and gap analysis
The first step is deciding what to certify. You define the scope (the whole company, a business unit, a product), the processing activities included and the role the company plays in each one. Then you compare the current situation with the requirements of the standard: which GDPR documents already exist and are up to date, which processes actually work, where evidence is missing.
A mistake to avoid at this stage is defining an overly broad scope "to look good". A narrower but well-governed scope gets certified sooner and holds up better over the years; it can always be widened later.
Phase 2: building the system
In this phase you write or update policies and procedures, complete the record of processing activities, carry out the privacy risk assessment and prepare the Statement of Applicability with the selection of controls. Contracts with customers and suppliers are reviewed, particularly data processing agreements, and the processes for data subject rights, data retention and breach management are defined.
This is also the phase in which staff are trained. A generic GDPR course is not what is needed: what is needed are clear instructions for those who respond to data subject requests, for those who manage suppliers and for those who develop the product and must apply privacy by design.
Phase 3: running the system and internal audit
A management system must operate for a period before the certification audit, so that it produces real evidence: data subject requests handled, suppliers assessed, incidents logged, objectives monitored. During this period the internal audit takes place, checking the system against the standard, along with the management review, in which top management assesses results and priorities. If you follow the path with Complaion, the internal audit is carried out by your Complaion Lead Auditor. Any nonconformities identified must be addressed with documented corrective actions.
Phase 4: certification audit and maintenance
The certification audit is conducted by an accredited certification body and checks both the company's documentation and readiness and the actual implementation of the system. Once the audit is passed, the certificate is maintained through periodic surveillance audits and renewed with a recertification audit at the end of the cycle, under the rules of ISO/IEC 17021-1 supplemented by ISO/IEC 27706. Maintenance is the part many companies underestimate: records, assessments and contracts must be kept up to date every month, not just in the weeks before the visit.
Time and effort: which factors affect the process?
There is no standard timeframe for achieving ISO 27701: time and effort depend on the company's starting point and the complexity of its processing. That is why a reliable estimate can only be made after an initial analysis, with a quote built around the specific case.
Your starting point
The factor with the greatest impact is what already exists. A company with a mature ISO 27001 system and up-to-date GDPR compliance mainly needs to integrate and formalise. A company without 27001 and with outdated privacy documentation has to build the system almost from scratch. The presence of a DPO or privacy lead with dedicated time also matters, as does the quality of the record of processing activities: if it is complete, the gap analysis is quick; if it needs rebuilding, interviews with every business function are required.
Complexity of processing and scope
For companies of the same size, timelines vary greatly depending on what is processed. The number and variety of processing activities, the presence of special categories of data, profiling, transfers outside the EU, the number of sub-processors and sites, and the choice to certify as a controller, as a processor or in both roles all carry weight. A SaaS company with a single product and a few cloud suppliers has a simpler scope than a group with several companies, several sites and dozens of suppliers.
Internal availability
Finally, it matters how much time the company can dedicate to the project. Key people, namely the privacy lead, IT manager, legal or procurement team and top management, must be available for interviews, decisions and document reviews. A project in which decisions are made within a few days moves much faster than one in which every approval takes weeks. For a tailored estimate, the right step is to request a personalised quote after an initial analysis of your situation.
What are the most common mistakes with ISO 27701?
The most frequent mistakes are not about missing documents but about how the project is set up. Spotting them early saves months.
Confusing the controller and processor roles
This is the most widespread mistake. Many SaaS companies declare themselves processors only and forget the processing for which they are controllers: marketing, product usage analytics, employee data, logs used to improve the service. Others declare themselves controllers of data they actually process only on behalf of customers. The result is an inconsistent Statement of Applicability, with controls excluded without valid justification, which the auditor spots immediately. The solution is to map the role processing activity by processing activity, not at company level.
Treating privacy as an appendix to security
Those extending a 27001 system tend to reuse the existing risk assessment and add a few items. But privacy risk looks at people, not just assets: collecting unnecessary data, keeping it longer than stated or using it for new purposes are risks even without any cyber attack. A risk assessment that ignores these aspects will not stand up to a 27701 audit, especially under the 2025 version, which has made privacy risk management more explicit.
GDPR documents never connected to reality
Privacy notices, the record of processing and impact assessments exist, but they describe the company as it was three years ago. The auditor compares the record with the actual systems and the supplier list: if new tools appear that have not been recorded, or suppliers without a data processing agreement, a nonconformity arises. The record must be tied to purchasing and development processes, so that every new tool goes through a privacy assessment.
Putting off the transition to 2025
For those certified to the 2019 version, waiting until 2028 is risky. In Italy, if the transition is not completed by 31 March 2028 the certificate is withdrawn, and starting again from scratch takes far more effort than updating the system during a surveillance audit. It is worth planning it now, in agreement with your certification body.
How Complaion supports you on the road to ISO 27701
ISO 27701 lets you turn privacy from a set of documents into an auditable system, and with the 2025 version it has become a certification you can obtain on its own or integrate with ISO 27001. Complaion works on both fronts: a dedicated Lead Auditor supports your company from the gap analysis through to the audit, while the Complaion platform collects evidence, manages documents, keeps track of surveillance and renewal deadlines and prepares you for the audit. Before the certification body's visit, your Lead Auditor carries out the internal audit and, if you already hold ISO 27001, covers security and privacy in a single review. If you also need ongoing privacy oversight, you can rely on our outsourced DPO service. We already work with more than 1,000 clients.
Discover the path to ISO 27701 certification or request a free consultation to work out where to start.
Frequently asked questions about ISO 27701
Is ISO 27701 mandatory?
No, ISO 27701 is a voluntary standard and no Italian or European law requires its adoption. It can, however, become a contractual requirement: customers, public tenders and supplier qualification procedures may ask for it or reward it. For suppliers that process data on behalf of others, it is often the simplest way to demonstrate the guarantees required by Article 28 of the GDPR. The decision to get certified therefore depends on the market in which the company operates.
Can I get ISO 27701 without ISO 27001?
Yes, with ISO/IEC 27701:2025 it is possible. The new edition is a standalone standard and, unlike the 2019 version, no longer requires an ISO 27001 system as a foundation. The standard still includes security controls to protect personal data, so an adequate level of information security remains necessary. For those who already hold 27001, integrating the two systems remains the most efficient route.
What happens to my ISO 27701:2019 certificate?
The certificate remains valid until the end of the transition period, provided that surveillance audits take place regularly. For certificates issued under Accredia accreditation, the move to the 2025 version must be completed by 31 March 2028: from 1 April 2028 certificates that have not transitioned will be withdrawn. If your certificate is issued under another accreditation, the deadline set by that body applies, which in several countries is 31 October 2028. The most efficient approach is to align the transition with a surveillance or recertification audit that is already scheduled.
Is ISO 27701 certification the same as a GDPR certification?
No. The GDPR provides for its own certification mechanisms in Articles 42 and 43, with criteria approved by supervisory authorities or by the EDPB, and ISO 27701 is not one of them, as Accredia also points out. ISO 27701 is a technical standard that helps organise and demonstrate the accountability required by the regulation. It is correct to say that it supports GDPR compliance, not that it certifies it.
What is the difference between ISO 27001 and ISO 27701?
ISO 27001 covers the security of all company information: personal data, but also trade secrets, financial data and source code. ISO 27701 deals specifically with personal data and the protection of the individuals it relates to, including topics 27001 does not address, such as legal bases, consent, data subject rights and relationships between controllers and processors. The two standards share the same structure and integrate well into a single management system.
How long is an ISO 27701 certificate valid?
Certificate duration and audit frequency follow the rules for accredited management system certification, namely ISO/IEC 17021-1, supplemented for privacy by ISO/IEC 27706. In practice, the certificate covers a certification cycle during which periodic surveillance audits check that the system continues to work. At the end of the cycle, a recertification audit takes place. Between audits the company must keep records, risk assessments and contracts up to date.
Do I need a DPO to get ISO 27701?
The standard does not require you to appoint a DPO: the obligation comes from the GDPR (Article 37) and only in certain cases, for example for public authorities or for organisations that carry out regular and systematic monitoring on a large scale. ISO 27701 does, however, require clear responsibilities for privacy to be assigned. In practice, having a competent DPO or privacy lead makes the project and its maintenance much simpler. Many SMEs choose an external DPO to access specialist expertise without creating a new internal function.
Should a SaaS company get certified as a controller or as a processor?
In most cases, both. A SaaS platform is the processor for the data its customers upload to the service, but the controller for the data of its own employees, its sales leads and often some product usage data. The certification scope can include one or both roles. The choice should be made processing activity by processing activity and justified in the Statement of Applicability.
