ISO/IEC 27701:2025 is an international standard that specifies requirements for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS). The standard helps organizations systematically manage privacy risks arising from the processing of personally identifiable information (PII, broadly corresponding to personal data in many legal frameworks) and demonstrate accountability to individuals, customers, partners and regulatory authorities.

This is the second edition of the standard, published by ISO and IEC in October 2025 to replace ISO/IEC 27701:2019. The principal change is that ISO/IEC 27701 has been redrafted as a stand-alone management system standard. Organizations can therefore establish and certify a PIMS under ISO/IEC 27701:2025 without being required to implement or be certified to ISO/IEC 27001. They may still integrate the PIMS with an Information Security Management System (ISMS) under ISO/IEC 27001 to share governance, risk assessment, control, internal audit, management review and improvement processes.

ISO/IEC 27701:2025 applies to organizations of all types, sizes and sectors, including businesses, government bodies and not-for-profit organizations. Depending on each PII processing activity, an organization may act as a PII controller, a PII processor or both.

This role must be determined separately for each processing activity, product or service rather than assigned uniformly across the organization. For example, an organization may determine the purposes and means of PII processing in one activity and therefore act as a PII controller, while in another activity it may process PII only on a customer's instructions and therefore act as a PII processor.

The scope of the Privacy Information Management System (PIMS) should fully cover PII processing activities; relevant categories of PII principals; processing locations; systems and technology platforms; data flows; third parties and subcontracted PII processors; and the countries or jurisdictions in which PII is collected, stored, used, shared or transferred.

The standard follows the management system structure set out in Clauses 4 to 10, covering the context of the organization, leadership, planning, support, operation, performance evaluation and improvement. The privacy risk assessment and treatment process must consider consequences for both the organization and PII principals; determine the necessary controls; establish a risk treatment plan; obtain acceptance of residual risks; and prepare a Statement of Applicability (SoA) identifying the necessary controls, their implementation status and the justification for their inclusion or exclusion.

The control structure and implementation guidance of ISO/IEC 27701:2025 include:

• Controls applicable to PII controllers (Table A.1): These apply to organizations that determine the purposes and means of PII processing. The controls cover lawful basis and processing purposes; consent; privacy impact assessment; obligations to PII principals and the handling of their requests; automated decision-making; privacy by design and by default; PII minimization, quality, retention and disposal; and the sharing, transfer and disclosure of PII.
• Controls applicable to PII processors (Table A.2): These apply to organizations that process PII under customer agreements and instructions. The controls cover processing purposes and conditions; assistance to customers in fulfilling their obligations and responding to PII principal requests; temporary files; the return, transfer or disposal of PII; disclosure requests; and the selection, use and replacement of subcontracted PII processors.
• Common information security controls (Table A.3): These include controls for policies and assigned roles; information classification and labelling; information transfer; identity and access management; supplier management; information security incident and PII breach management; legal compliance; protection of records; endpoint devices; authentication; backup; logging; cryptography; and secure system development.
• Implementation guidance and mappings: Annex B provides guidance on implementing the controls. Other informative annexes provide mappings to the privacy principles in ISO/IEC 29100, the European Union General Data Protection Regulation (GDPR), ISO/IEC 27018, ISO/IEC 29151 and ISO/IEC 27701:2019.

Relationship with ISO/IEC 27001 and ISO/IEC 27002: ISO/IEC 27701:2025 requires the organization to establish, implement and maintain an appropriate information security programme to protect PII. ISO/IEC 27002:2022 provides guidance and information security controls for organizations to consider; however, ISO/IEC 27002 is not a certification standard. Organizations already operating an ISMS under ISO/IEC 27001:2022 can integrate privacy requirements and use ISO/IEC 27002 to support the selection, design and implementation of necessary controls.

Keeping legal requirements up to date: The PIMS must identify, update and control applicable statutory and regulatory requirements, decisions issued by competent authorities, contractual requirements and internal commitments in each jurisdiction. In Vietnam, organizations should consider the Law No. 91/2025/QH15 on Personal Data Protection and Decree No. 356/2025/ND-CP detailing certain articles and measures for implementing the Law on Personal Data Protection, both effective from 1 January 2026, together with relevant sector-specific laws and regulations. For activities within the scope of the GDPR, Annex D of ISO/IEC 27701:2025 provides a reference mapping to help organizations determine their applicable obligations.