What is ISO 27701

What is ISO 27701?

ISO/IEC 27701:2019 is a data privacy extension to ISO 27001. This newly published information security standard provides guidance for organizations looking to put in place systems to support compliance with GDPR and other data privacy requirements. ISO 27701, also abbreviated as PIMS (Privacy Information Management System) outlines a framework for Personally Identifiable Information (PII) Controllers and PII Processors to manage data privacy. Privacy information management systems are sometimes referred to as personal information management systems.

This reduces risk to the privacy rights of individuals and to the organization by enhancing an existing Information Security Management System.

This standard is a great way of demonstrating to customers, external stakeholders, and internal stakeholders that effective systems are in place to support compliance with GDPR and other related privacy legislation.

Organizations looking to get certified to ISO 27701 in order to comply with GDPR will either need to have an existing ISO 27001 certification or implement ISO 27001 and ISO 27701 together as a single implementation audit. ISO 27701 is a natural expansion of the requirements and guidance set out in ISO 27001.