ISO 27701 was first published in 2019 by the International Organization for Standardization (ISO), which collaborates with national standards bodies from over 170 countries.
It serves as an extension to ISO 27001 and ISO 27002, focusing specifically on privacy information management. ISO 27701 was developed to address the growing need for robust privacy controls and to extend the reach of data protection management internationally.
ISO 27701 was designed to integrate seamlessly with existing information security management systems. It provides a structured framework for managing personal data privacy across various industries and sectors. This supports compliance with global privacy regulations.
ISO 27701 gives guidelines for setting up a strong privacy information management system for your business. It focuses on key areas to ensure solid data protection and privacy:
These requirements help you create a system that maintains high privacy standards, builds stakeholder trust, and improves compliance.
Achieving ISO 27701 is not a standalone certification – organisations need to achieve ISO 27001 certification and then implement ISO 27701 as an extension to their existing Information Security Management System (ISMS).
ISO 27701 certification shows that your organisation’s Privacy Information Management System (PIMS) meets the ISO 27701 standard. It assures customers and partners that you consistently manage personal data privacy effectively.
To achieve certification, follow these steps:
ISO 27001 is focused on establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It provides a framework for managing security risks and protecting information assets.
ISO 27701 extends ISO 27001 by providing guidelines for establishing a Privacy Information Management System (PIMS), focusing on managing personal data privacy. ISO 27701 aims to enhance the data privacy controls within the ISMS and support compliance with global privacy regulations.
ISO 27001 is not a legal requirement, but it is widely recognised as a best practice for information security management.
Organisations choose ISO 27001 certification to show their commitment to information security, build trust with clients, and meet contractual or regulatory obligations.
While not mandatory, achieving ISO 27001 can help organisations implement robust security measures and can be crucial for accessing certain markets or industries where strong data protection is essential.
ISO 27701 is a privacy extension to ISO 27001, providing guidelines for establishing a privacy information management system (PIMS), while GDPR is a legal framework within the European Union that mandates how personal data must be handled.
ISO 27701 sets out best practices for managing privacy and data protection risks, complementing existing data protection laws like GDPR.
While ISO 27701 offers a structured approach to helping businesses achieve compliance, GDPR imposes legal obligations with specific penalties for non-compliance.
Implementing ISO 27701 can benefit organisations of all sizes and industries, especially those that handle personal data, including staff data. Companies in sectors such as healthcare, finance, and e-commerce, where data privacy is critical, will find ISO 27701 particularly useful.
By adhering to ISO 27701, organisations can enhance their data protection practices, help businesses comply with privacy regulations, build trust with customers and stakeholders, and mitigate the risks associated with data breaches.
The specific documents required will depend on your organisation’s context and risk assessment.
Typical documents used to help organisations achieve ISO 27701 certification include the following:
These documents help to verify that the organisation has a comprehensive approach to managing personal data privacy and can demonstrate compliance with privacy regulations.
ISO 27701 doesn’t prescribe specific data classification categories, so organisations must establish their own classification methodology. Four common data classification categories typically include:
What Is the Difference Between ISO 27001 and 27701?
