office@rigcert.org
18 October 2025
On 14 October 2025 ISO published a new edition of ISO/IEC 27701, the international standard for Privacy Information Management Systems (PIMS).
This 2025 edition replaces the original 2019 version and brings several important updates that reflect the growing complexity of data protection and the evolving global privacy landscape.
Organizations certified to ISO/IEC 27701 — or planning to obtain certification — should be aware of these changes and prepare for the transition.
A stand-alone standard
The most significant change is that ISO/IEC 27701 is now a stand-alone standard. The 2019 edition of ISO/IEC 27701, it was an extension for privacy to ISO/IEC 27001 and ISO/IEC 27002, meaning that a certified Privacy Information Management System could not exist without an Information Security Management System (ISMS).
With the 2025 edition, this is no longer the case. Organizations can now implement and certify a Privacy Information Management System independently from their ISMS. This change makes ISO/IEC 27701 certification more accessible, especially for companies that may not yet have an ISMS but wish to demonstrate strong privacy governance.
Of course, privacy and information security remain closely related. Many organizations will still choose to maintain integrated systems, but the key difference is that this is now optional, not mandatory.
Updated controls
The revised ISO/IEC 27701 builds on existing elements from ISO/IEC 27701:2019, ISO/IEC 27001:2022 and ISO/IEC 27002:2022. It remains fully compatible with other management system standards such as ISO 9001, ISO/IEC 27001 and ISO/IEC 42001.
The standard now includes more comprehensive privacy controls for both PII controllers and processors, ensuring stronger alignment with global privacy frameworks such as the GDPR. It also refines the information security controls derived from ISO/IEC 27001, narrowing them down to 29 controls that have a direct impact on privacy — a more focused approach compared to the 93 controls in ISO/IEC 27001.
In short, the updated standard provides clearer guidance for implementing and maintaining a robust, auditable Privacy Information Management System.
Transition process
As with other ISO standards, the transition period is expected to be up to three years, but the exact timeline will be confirmed later.
For now, certified organizations are advised to wait for the official transition guidelines before starting formal changes to their systems. However, familiarizing yourself with the new standard and planning the update early will help ensure a smooth transition once the rules are published.
Organizations currently certified to ISO/IEC 27701:2019 — or preparing for certification — should begin by reviewing the new edition to understand the changes. Identify which elements of your existing PIMS may need to be updated and ensure that your team is trained on the revised requirements.
Once transition details are available, establish a plan to update your documentation, controls and processes in line with the 2025 edition.
We hope to be able to provide accredited ISO/IEC 27701 certification in 2026.
The release of ISO/IEC 27701:2025 marks an important milestone. Privacy management has matured into a discipline strong enough to stand on its own, while still maintaining its connection to information security. The new edition provides organizations with greater flexibility and a clearer path to demonstrating accountability, compliance and trustworthiness in how they manage personal data.