ISO/IEC 27701

ISO/IEC 27701 started as an extension to ISO/IEC 27001 and 27002, adding privacy requirements to an information security management system. Its latest edition was restructured so it can also be used as a standalone management system standard, while remaining compatible with the 27001 family. It uses the term PII (personally identifiable information) and distinguishes controls for PII controllers from controls for PII processors.

The controls cover conditions for collection and processing, obligations to individuals, privacy by design and by default, and sharing, transfer and disclosure of PII. Annexes map the controls to the GDPR and other frameworks, which helps organisations show how the system supports legal obligations, although certification does not by itself prove compliance with any law.

Auditors assess conformity by sampling evidence and raising nonconformities, the same method used for ISO/IEC 42001, and the two management systems can share processes such as risk assessment, internal audit and management review. Example: a cloud processor seeks 27701 certification to answer customer due diligence questions with independent audit evidence. The standard is assessed in the AUDAI exam.