ISO/IEC 27701:2025

International

v2025

10 domains

108 controls

Verified

ISO/IEC 27701:2025 is a compliance framework from International with 10 domains and 108 controls that map to 1 other frameworks. The largest domains are Annex A Table A.1 PIMS controls for PII controllers – ISO/IEC 27701:2025 (31 controls), Annex A Table A.3 information security controls with PII-specific guidance – ISO/IEC 27701:2025 (29 controls), Annex A Table A.2 PIMS controls for PII processors – ISO/IEC 27701:2025 (18 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (10)

Annex A Table A.1 PIMS controls for PII controllers – ISO/IEC 27701:2025

31 controls

Controls in the Annex A Table A.1 PIMS controls for PII controllers – ISO/IEC 27701:2025 domain of ISO/IEC 27701:2025: 31 controls
Code	Title	Description
iso-iec-27701-2025::A.1.2.2	Identify and document purpose	The organization must pin down and record the particular purposes its processing of personal data will serve, written cl...
iso-iec-27701-2025::A.1.2.3	Identify lawful basis	The organization must determine, document and comply with the lawful basis for each processing activity against its iden...
iso-iec-27701-2025::A.1.2.4	Determine when and how consent is to be obtained	The organization must set and document a process that lets it prove whether consent to processing was given, when and in...
iso-iec-27701-2025::A.1.2.5	Obtain and record consent	The organization must obtain and record consent according to its documented process, recording it so that on request it...
iso-iec-27701-2025::A.1.2.6	Privacy impact assessment	Each time new processing of personal data, or a change to current processing, is planned, the organization must judge wh...
iso-iec-27701-2025::A.1.2.7	Contracts with PII processors	The organization must have a written contract with every processor it uses and must ensure those contracts address imple...
iso-iec-27701-2025::A.1.2.8	Joint PII controller	Where the organization is a joint controller, it must determine the respective roles and responsibilities for processing...
iso-iec-27701-2025::A.1.2.9	Records related to processing PII	The organization must identify, and keep securely, the records that back up its processing obligations. Usually this is...
iso-iec-27701-2025::A.1.3.10	Handling requests	The organization must set out and document policies and procedures for dealing with valid requests from individuals, suc...
iso-iec-27701-2025::A.1.3.11	Automated decision making	The organization must identify and address the obligations, including legal obligations, that it owes to individuals ari...
iso-iec-27701-2025::A.1.3.2	Determining and fulfilling obligations to PII principals	The organization must identify and document the legal, regulatory and business obligations it owes to the individuals wh...
iso-iec-27701-2025::A.1.3.3	Determining information for PII principals	The organization must determine and document what information is to be provided to individuals about the processing of t...
iso-iec-27701-2025::A.1.3.4	Providing information to PII principals	The organization must give individuals information, clear and easy to find, that names the controller and explains how t...
iso-iec-27701-2025::A.1.3.5	Providing mechanism to modify or withdraw consent	The organization must provide a mechanism for individuals to modify or withdraw consent, inform them of their rights to...
iso-iec-27701-2025::A.1.3.6	Providing mechanism to object to PII processing	The organization must give individuals a way to object to their data being processed. It must document the legal and reg...
iso-iec-27701-2025::A.1.3.7	Access, correction or erasure	The organization must have policies, procedures or mechanisms that let individuals see, correct and erase their personal...
iso-iec-27701-2025::A.1.3.8	PII controllers' obligations to inform third parties	When personal data has been passed to third parties, the organization must let them know of any correction, withdrawal o...
iso-iec-27701-2025::A.1.3.9	Providing copy of PII processed	When an individual asks, the organization must be able to hand over a copy of the personal data it holds about them, in...
iso-iec-27701-2025::A.1.4.10	PII transmission controls	Personal data the organization sends across a network must be protected by controls meant to make sure it arrives where...
iso-iec-27701-2025::A.1.4.2	Limit collection	The organization must collect no more personal data than is adequate, relevant, proportionate and needed for the identif...
iso-iec-27701-2025::A.1.4.3	Limit processing	The organization must confine its processing of personal data to what the identified purposes make adequate, relevant an...
iso-iec-27701-2025::A.1.4.4	Accuracy and quality	The organization must make sure, and record, that personal data is correct, complete and current to the degree its proce...
iso-iec-27701-2025::A.1.4.5	PII minimization objectives	The organization must set and document objectives for minimising data, and the mechanisms that achieve them. It must sho...
iso-iec-27701-2025::A.1.4.6	PII de-identification and deletion at the end of processing	When the identified purposes stop requiring the original personal data, the organization must erase it or convert it int...
iso-iec-27701-2025::A.1.4.7	Temporary files	The organization must make sure that temporary files produced while processing personal data are wiped or destroyed with...
iso-iec-27701-2025::A.1.4.8	Retention	The organization must not keep personal data for longer than its processing purposes need. It must draw up and maintain...
iso-iec-27701-2025::A.1.4.9	Disposal	The organization must have documented policies, procedures or mechanisms for getting rid of personal data. It must pick...
iso-iec-27701-2025::A.1.5.2	Identify basis for PII transfer between jurisdictions	The organization must identify and record the legal basis on which personal data moves between jurisdictions, documentin...
iso-iec-27701-2025::A.1.5.3	Countries and international organizations to which PII can be transferred	The organization must set out and document every country and international organization that personal data may end up be...
iso-iec-27701-2025::A.1.5.4	Records of transfer of PII	The organization must keep a record of personal data it sends to, or receives from, third parties, and must work with th...
iso-iec-27701-2025::A.1.5.5	Records of PII disclosures to third parties	The organization must keep a record of each disclosure of personal data to a third party, stating which data went, to wh...

Annex A Table A.2 PIMS controls for PII processors – ISO/IEC 27701:2025

18 controls

Controls in the Annex A Table A.2 PIMS controls for PII processors – ISO/IEC 27701:2025 domain of ISO/IEC 27701:2025: 18 controls
Code	Title	Description
iso-iec-27701-2025::A.2.2.2	Customer agreement	Where relevant, the contract for processing personal data must set out how the organization will help the customer meet...
iso-iec-27701-2025::A.2.2.3	Organization’s purposes	The organization must make sure that personal data it handles for a customer is used only for the purposes set out in th...
iso-iec-27701-2025::A.2.2.4	Marketing and advertising use	The organization must not use personal data it processes under contract for marketing or advertising unless it has confi...
iso-iec-27701-2025::A.2.2.5	Infringing instruction	The organization must tell the customer whenever it believes a processing instruction breaks the law or regulations that...
iso-iec-27701-2025::A.2.2.6	Customer obligations	The organization must supply the customer with the information it needs to show that it meets its own obligations. This...
iso-iec-27701-2025::A.2.2.7	Records related to processing PII	The organization must work out which records it needs to show that it meets its contractual obligations for the processi...
iso-iec-27701-2025::A.2.3.2	Comply with obligations to PII principals	The organization must give the customer what it needs to meet its duties to individuals. It should recognise that those...
iso-iec-27701-2025::A.2.4.2	Temporary files	The organization must make sure that temporary files produced while processing personal data are wiped or destroyed with...
iso-iec-27701-2025::A.2.4.3	Return, transfer or disposal of PII	The organization must be able to return, transfer or dispose of personal data securely and must share its policy on this...
iso-iec-27701-2025::A.2.4.4	PII transmission controls	Personal data the organization sends across a network must be protected by controls meant to make sure it arrives where...
iso-iec-27701-2025::A.2.5.2	Basis for PII transfer between jurisdictions	The organization must tell the customer promptly on what basis personal data moves from one jurisdiction to another, and...
iso-iec-27701-2025::A.2.5.3	Countries and international organizations to which PII can be transferred	The organization must set out and document every country and international organization that personal data may end up be...
iso-iec-27701-2025::A.2.5.4	Records of PII disclosures to third parties	The organization must keep a record of each disclosure of personal data to a third party, stating which data went, to wh...
iso-iec-27701-2025::A.2.5.5	Notification of PII disclosure requests	The organization must tell the customer about every legally binding request it receives to disclose personal data, doing...
iso-iec-27701-2025::A.2.5.6	Legally binding PII disclosures	The organization must turn down any request to disclose personal data that is not legally binding, must speak to the cus...
iso-iec-27701-2025::A.2.5.7	Disclosure of subcontractors used to process PII	The organization must tell the customer, before it happens, whenever subcontractors will process personal data, with ter...
iso-iec-27701-2025::A.2.5.8	Engagement of a subcontractor to process PII	The organization must bring in a subcontractor to process personal data only as the customer contract allows, and must h...
iso-iec-27701-2025::A.2.5.9	Change of subcontractor to process PII	Where it operates under a general written authorization, the organization must tell the customer in advance about any pl...

Annex A Table A.3 information security controls with PII-specific guidance – ISO/IEC 27701:2025

29 controls

Controls in the Annex A Table A.3 information security controls with PII-specific guidance – ISO/IEC 27701:2025 domain of ISO/IEC 27701:2025: 29 controls
Code	Title	Description
iso-iec-27701-2025::A.3.10	Addressing information security within supplier agreements	Supplier agreements shall state whether the supplier processes PII and set the baseline technical and organizational saf...
iso-iec-27701-2025::A.3.11	Information security incident management planning and preparation	Within its information security incident management arrangements, the organization shall assign responsibilities and set...
iso-iec-27701-2025::A.3.12	Response to information security incidents	For a PII controller, any incident touching PII shall prompt an assessment of whether a PII breach calling for action ha...
iso-iec-27701-2025::A.3.13	Legal, statutory, regulatory and contractual requirements	When working out which laws, regulations, statutory duties and contractual commitments bind it, the organization shall i...
iso-iec-27701-2025::A.3.14	Protection of records	The organization shall keep its privacy policies and supporting procedures, and every earlier version replaced by an upd...
iso-iec-27701-2025::A.3.15	Independent review of information security	Where the organization acts as a PII processor and audits by each customer are not practical or would raise security ris...
iso-iec-27701-2025::A.3.16	Compliance with policies, rules and standards for information security	When the organization technically checks conformance with its security policies and standards, it shall include ways of...
iso-iec-27701-2025::A.3.17	Information security awareness, education and training	The organization shall have measures in place, awareness of how to report incidents among them, so that the staff concer...
iso-iec-27701-2025::A.3.18	Confidentiality or non-disclosure agreements	Everyone working under the organization's direction who can reach PII shall be bound by a duty of confidentiality, set o...
iso-iec-27701-2025::A.3.19	Clear desk and clear screen	The organization shall keep printed or other paper copies containing PII to the least that the identified processing pur...
iso-iec-27701-2025::A.3.20	Storage media	The organization shall record every use of removable media or portable devices to hold PII and, where practicable, choos...
iso-iec-27701-2025::A.3.21	Secure disposal or re-use of equipment	Whenever storage space is re-assigned the organization shall ensure that any PII previously residing on it is not access...
iso-iec-27701-2025::A.3.22	User endpoint devices	The organization shall make sure PII is not put at risk through mobile phones, laptops and other endpoint devices, by me...
iso-iec-27701-2025::A.3.23	Secure authentication	When a customer asks for it, the organization shall offer a secure sign-in capability for the user accounts that the cus...
iso-iec-27701-2025::A.3.24	Information backup	The organization shall keep a policy covering how PII is backed up, recovered and restored, together with any contractua...
iso-iec-27701-2025::A.3.25	Logging	The organization shall operate a process for reviewing event logs, either through ongoing automated monitoring with aler...
iso-iec-27701-2025::A.3.26	Use of cryptography	The organization's cryptography rules shall take account of the fact that certain jurisdictions mandate encryption for s...
iso-iec-27701-2025::A.3.27	Secure development life cycle	The organization's system design and development policies shall give direction on how it handles PII, grounded in its du...
iso-iec-27701-2025::A.3.28	Application security requirements	The organization shall make sure PII is encrypted whenever it travels across networks it cannot trust, such as the inter...
iso-iec-27701-2025::A.3.29	Secure system architecture and engineering principles	Any system or component that processes PII shall be engineered on privacy by design and by default principles, built so...
iso-iec-27701-2025::A.3.3	Policies for information security	The organization's information security policies, or a separate set of privacy policies, shall declare its backing for,...
iso-iec-27701-2025::A.3.30	Outsourced development	Where development or information systems are outsourced, the organization shall, as applicable, extend to them the priva...
iso-iec-27701-2025::A.3.31	Test information	Real PII shall not serve as test data; the organization shall use invented or synthetic personal data in its place. If t...
iso-iec-27701-2025::A.3.4	Information security roles and responsibilities	The organization shall name a contact for customers on matters of PII processing and, where it acts as a PII controller,...
iso-iec-27701-2025::A.3.5	Classification of information	The organization's scheme for classifying information shall treat PII expressly, including its kinds and any special cat...
iso-iec-27701-2025::A.3.6	Labelling of information	The organization shall make sure the people working under its direction know what counts as PII and can tell when a piec...
iso-iec-27701-2025::A.3.7	Information transfer	The organization's rules and procedures for transferring information shall make sure the PII processing rules apply at e...
iso-iec-27701-2025::A.3.8	Identity management	The procedures for enrolling and removing users who run or administer PII-processing systems and services shall cover wh...
iso-iec-27701-2025::A.3.9	Access rights	The organization shall keep a correct and current register of the user profiles set up for people permitted to use infor...

Context of the organization – ISO/IEC 27701:2025

4 controls

Controls in the Context of the organization – ISO/IEC 27701:2025 domain of ISO/IEC 27701:2025: 4 controls
Code	Title	Description
iso-iec-27701-2025::4.1	Understanding the organization and its context	The organization shall identify the internal and external issues, relevant to its purpose, that bear on its capacity to...
iso-iec-27701-2025::4.2	Understanding the needs and expectations of interested parties	The organization shall identify which interested parties matter to its privacy information management system, what those...
iso-iec-27701-2025::4.3	Determining the scope of the privacy information management system	The organization shall fix the boundaries and applicability of its privacy information management system to define its s...
iso-iec-27701-2025::4.4	Privacy information management system	The organization shall set up, operate, keep up and keep improving a privacy information management system, covering the...

Improvement – ISO/IEC 27701:2025

2 controls

Controls in the Improvement – ISO/IEC 27701:2025 domain of ISO/IEC 27701:2025: 2 controls
Code	Title	Description
iso-iec-27701-2025::10.1	Continual improvement	The organization shall continually improve the suitability, adequacy and effectiveness of the privacy information manage...
iso-iec-27701-2025::10.2	Nonconformity and corrective action	If a nonconformity arises, the organization shall respond to it and, where relevant, act to contain and fix it and to ha...

Leadership – ISO/IEC 27701:2025

3 controls

Controls in the Leadership – ISO/IEC 27701:2025 domain of ISO/IEC 27701:2025: 3 controls
Code	Title	Description
iso-iec-27701-2025::5.1	Leadership and commitment	Top management shall show leadership of, and commitment to, the privacy information management system by: making sure pr...
iso-iec-27701-2025::5.2	Privacy policy	Top management shall set a privacy policy that suits the organization's purpose, gives a basis for setting privacy objec...
iso-iec-27701-2025::5.3	Roles, responsibilities and authorities	Top management shall make sure that responsibility and authority for each role that matters to the privacy information m...

Operation – ISO/IEC 27701:2025

3 controls

Controls in the Operation – ISO/IEC 27701:2025 domain of ISO/IEC 27701:2025: 3 controls
Code	Title	Description
iso-iec-27701-2025::8.1	Operational planning and control	The organization shall plan, run and control the processes it needs to satisfy the PIMS requirements and to carry out th...
iso-iec-27701-2025::8.2	Privacy risk assessment	The organization shall carry out privacy risk assessments on a planned schedule and also whenever a significant change i...
iso-iec-27701-2025::8.3	Privacy risk treatment	The organization shall put its privacy risk treatment plan into effect and keep documented evidence of what the treatmen...

Performance evaluation – ISO/IEC 27701:2025

6 controls

Controls in the Performance evaluation – ISO/IEC 27701:2025 domain of ISO/IEC 27701:2025: 6 controls
Code	Title	Description
iso-iec-27701-2025::9.1	Monitoring, measurement, analysis and evaluation	The organization shall decide: what is to be monitored and measured, the privacy processes and controls among them; whic...
iso-iec-27701-2025::9.2.1	General	At planned intervals the organization shall run internal audits that tell it whether the privacy information management...
iso-iec-27701-2025::9.2.2	Internal audit programme	The organization shall plan, set up, run and keep up one or more audit programmes, covering how often audits happen, how...
iso-iec-27701-2025::9.3.1	General	At planned intervals, top management shall review the privacy information management system of the organization to confi...
iso-iec-27701-2025::9.3.2	Management review inputs	The management review shall take into account: progress on actions agreed at earlier reviews; shifts in the internal and...
iso-iec-27701-2025::9.3.3	Management review results	The management review shall produce decisions on opportunities for continual improvement and on any changes the privacy...

Planning – ISO/IEC 27701:2025

5 controls

Controls in the Planning – ISO/IEC 27701:2025 domain of ISO/IEC 27701:2025: 5 controls
Code	Title	Description
iso-iec-27701-2025::6.1.1	General	In planning the privacy information management system, the organization shall take account of the issues identified unde...
iso-iec-27701-2025::6.1.2	Privacy risk assessment	The organization shall set and apply a privacy risk assessment process that: sets and keeps up privacy risk criteria, co...
iso-iec-27701-2025::6.1.3	Privacy risk treatment	The organization shall set and apply a privacy risk treatment process that: chooses suitable treatment options in light...
iso-iec-27701-2025::6.2	Privacy objectives and planning to achieve them	The organization shall set privacy objectives for the relevant functions and levels. They shall align with the privacy p...
iso-iec-27701-2025::6.3	Planning of changes	Added in the second edition from the harmonized structure: whenever the organization decides the privacy information man...

Support – ISO/IEC 27701:2025

7 controls

Controls in the Support – ISO/IEC 27701:2025 domain of ISO/IEC 27701:2025: 7 controls
Code	Title	Description
iso-iec-27701-2025::7.1	Resources	The organization shall determine and provide the resources needed for the establishment, implementation, maintenance and...
iso-iec-27701-2025::7.2	Competence	The organization shall: determine what competence is needed by people working under its direction whose work affects its...
iso-iec-27701-2025::7.3	Awareness	Persons doing work under the organization's control shall be aware of the privacy policy, of their contribution to the e...
iso-iec-27701-2025::7.4	Communication	The organization shall decide which internal and external communications the privacy information management system needs...
iso-iec-27701-2025::7.5.1	General	The privacy information management system of the organization shall contain the documented information this document cal...
iso-iec-27701-2025::7.5.2	Creating and updating documented information	When creating and updating documented information the organization shall ensure appropriate identification and descripti...
iso-iec-27701-2025::7.5.3	Control of documented information	Documented information that the PIMS and this document require shall be controlled so that it can be found and used at t...

Maps to 1 other framework

108 total controls

CCPA/CPRA

16 source controls mapped|25 target controls covered

15%

Compare ISO/IEC 27701:2025 with CCPA/CPRA

Coverage is not the same as your position

This page shows what ISO/IEC 27701:2025 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is ISO/IEC 27701:2025 and who does it apply to?

ISO/IEC 27701:2025 is a compliance framework from International with 10 domains and 108 controls. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does ISO/IEC 27701:2025 actually require?

ISO/IEC 27701:2025 has 108 controls organised across 10 domains. The largest domains are Annex A Table A.1 PIMS controls for PII controllers – ISO/IEC 27701:2025 (31 controls), Annex A Table A.3 information security controls with PII-specific guidance – ISO/IEC 27701:2025 (29 controls), Annex A Table A.2 PIMS controls for PII processors – ISO/IEC 27701:2025 (18 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of ISO/IEC 27701:2025 do I already cover?

ISO/IEC 27701:2025 maps to 1 other compliance frameworks. The top mapping partners are CCPA/CPRA (15% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement ISO/IEC 27701:2025?

Start your ISO/IEC 27701:2025 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO/IEC 27701:2025 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 108 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.

Get Started Free →

Free forever, no credit card required