ISO/IEC 27701 transition: dates and changes
- Current edition
- ISO/IEC 27701:2025
- New edition
- ISO/IEC 27701:2025 (standalone; replaces the 2019 extension)
- Published
- 14 October 2025
- Old certificates expire
- 719 days left
Certification bodies are expected to transition all certified clients by 31 October 2028. Some accreditation bodies may set their own dates, confirm with your certification body.
Timeline
- 14 Oct 2025ISO/IEC 27701:2025 and ISO/IEC 27706:2025 published
- 1 May 2026Accreditation assessments of certification bodies begin
- 31 Oct 2027Certification bodies complete their own transition
- 31 Oct 2028All certified clients transitioned
Key changes
- Now a standalone management system standard, no ISO 27001 certificate required
- Full management system clauses aligned with the Harmonized Structure
- Controller and processor controls restructured
- Updated mapping to privacy laws and to ISO/IEC 27002:2022 controls
Our advice: If you hold a 2019 certificate as an ISO 27001 extension, decide whether to keep an integrated scope or certify privacy separately, then run a delta assessment.
Last checked 28 October 2026. Your certification body confirms the dates that apply to your certificate.
ISO/IEC 27701 specifies requirements for a privacy information management system (PIMS). It covers how you identify personal data, decide lawful purposes, respect individuals’ rights, manage processors and transfers, and handle privacy incidents.
Why the 2025 edition matters
ISO/IEC 27701:2025 is now a standalone standard. You no longer need an ISO 27001 certificate first, which opens privacy certification to organisations whose main risk is personal data rather than broader information security.
What we deliver
- A records-of-processing inventory and data-flow maps
- Controller and processor role analysis for each processing activity
- Privacy notices, consent and rights-handling procedures
- Data protection impact assessment (DPIA) method and templates
- Supplier and international transfer controls
- A mapping of PIMS controls to GDPR, India’s DPDP Act, UAE and Saudi PDPL and other laws relevant to you
Who it is for
- Organisations processing personal data at scale
- Processors and SaaS providers serving regulated customers
- Companies operating across several privacy jurisdictions
- Teams already certified to ISO 27001 wanting to extend scope
What you gain
- Demonstrable accountability under GDPR and similar laws
- One privacy framework covering multiple jurisdictions
- Clear roles for controllers and processors
- Stronger position in data-processing negotiations
- Integrates with an existing ISO 27001 ISMS
Your path to certification
Gap assessment
We compare what you do today with every requirement and control, then give you a prioritised gap report and a realistic timeline.
Design and documentation
Scope, policies, procedures, risk methodology and records, written to fit how your teams actually work, not a template binder.
Implementation and training
We help owners put controls in place, train the people who run them and start collecting evidence.
Internal audit and management review
An independent internal audit and a structured management review prove the system works before the certification body looks at it.
Certification audit support
We prepare you for Stage 1 and Stage 2 with your chosen accredited certification body and help close any findings quickly.
Surveillance and continual improvement
Optional managed support keeps evidence current through annual surveillance audits and the three-year recertification.