ISO/IEC 27701 — Privacy information management systems
What is ISO/IEC 27701?
ISO/IEC 27701 is the international standard for privacy information management systems (PIMS). Serbia has adopted it as SRPS EN ISO/IEC 27701:2025; the field is also commonly called data protection. It covers how an organisation collects, processes, stores, transfers and deletes personal data — on what legal basis, for how long and with which records.
Since the ISO/IEC 27701:2025 edition, the standard is standalone: organisations can be certified to it without ISO/IEC 27001. It is voluntary; compliance with the GDPR and Serbian law is a separate legal obligation, which a certificate doesn’t replace.
Moving to ISO/IEC 27701:2025
ISO/IEC 27701:2025 was published on 14 October 2025 and replaces the 2019 edition. The change is substantial, not cosmetic:
- The standard has become standalone. A PIMS can be implemented and certified without ISO/IEC 27001. Under the 2019 edition this wasn’t possible.
- The harmonised structure (clauses 4–10), the same as in other management system standards — so integration doesn’t require mapping clauses across.
- The requirements have been reorganised to stand on their own, instead of being read as an extension of the information security requirements.
- Annex A reorganised — 78 controls in three tables (controllers, processors, shared), so a new Statement of Applicability is needed.
Organisations certified to the 2019 edition have a three-year transition period ending in October 2028; the exact cut-off date is set by the accreditation body, so we confirm it with your certification body. Until then, certificates to the 2019 edition remain valid, and we plan the transition audit with you.
What the standard explicitly requires
The standard covers the whole journey of data through the organisation. What it explicitly requires:
- Controller and processor roles — the standard separates them and gives each its own set of controls, with a third, shared set of information security controls.
- Legal basis and purpose of processing — for every processing activity you must know why it is done and on what basis.
- Data subjects’ rights — access, rectification, erasure, objection: how a request is received, who handles it and within what time.
- Limits on collection and retention — how much data and for how long, with rules for deletion.
- Data transfers, including transfers to other countries and records of them.
- Obligations towards processors — what must be agreed in a contract and how it is monitored.
- Handling personal data breaches, with the notification obligations.
- Risk assessment, internal audit and management review — as in other management systems.
Since the 2025 edition, the standard follows the harmonised structure (clauses 4–10), the same one used by ISO 9001, ISO 14001 and ISO/IEC 27001 — so it can be combined with them without duplicating work.
Controller and processor — who applies what
The standard distinguishes two roles and sets out a separate set of controls for each. The same company often has both — it is a controller towards its own employees and a processor towards its clients.
- The controller decides why and how data is processed. Its controls concern the legal basis, informing individuals, data subjects’ rights and privacy impact assessment.
- The processor processes data on someone else’s behalf. Its controls concern acting only on instructions, contractual obligations, sub-processors and returning or deleting data when the contract ends.
Typical users are software-as-a-service providers, agencies that process data for others, accounting and HR service providers, call centres, marketing agencies, healthcare institutions and anyone who processes data for a client in the European Union.
What implementation looks like
- Defining the scope and roles — which processing activities are in the system, and where you are a controller and where a processor.
- An inventory of processing activities — what data you collect, where from, why, where it is stored, who has access and how long it is kept. Everything else depends on this step.
- Establishing the legal basis for each processing activity and aligning your privacy notices.
- Assessing the risks to the individuals whose data is processed, and the measures to address them.
- A procedure for data subjects’ rights, with deadlines and named responsibilities.
- Arrangements with processors and sub-processors — contracts, monitoring, transfers.
- A data breach procedure — detection, assessment, notification.
- Internal audit and management review, followed by the certification audit.
If you already have ISO/IEC 27001, most of the framework exists and you add only what concerns personal data. If you don’t, the PIMS is implemented on its own.
What changes in how you handle data
The change is that ‘well, we have that data somewhere’ is no longer an answer. The inventory of processing activities is easy to put off, yet it is what holds everything else together.
- You know what data exists, where it is and who has access — so access can also be removed.
- A request for erasure or access has a route and a deadline, instead of drifting between departments.
- Data isn’t kept ‘just in case’, because every type has a retention period.
- Contracts with processors contain what they must, so responsibility isn’t left unclear.
- When a breach happens, someone assesses it and knows whom to notify, without improvising.
- For clients in the European Union, you have the evidence they ask for in supplier due diligence.
How it relates to the GDPR and Serbian law
This is a misunderstanding the standard itself clears up. An ISO/IEC 27701 certificate doesn’t confirm compliance with the GDPR or with Serbia’s Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti). The law is the obligation; the standard is a way of organising that obligation and demonstrating it.
What the standard really brings is structure: an inventory of processing activities, legal bases, retention periods, data subjects’ rights, contracts with processors and breach handling — exactly what the law requires to be in place. An informative annex also maps its controls to the provisions of the GDPR, which makes it easier to show which control covers which obligation.
That is why clients ask for it, rather than supervisory authorities — as evidence in supplier due diligence, when a company in the European Union chooses whom to entrust with processing.
Climate change in the organisation’s context
Climate change became part of the context review through an amendment in February 2024. The ISO/IEC 27701:2019 edition wasn’t updated by that amendment — it wasn’t a standalone standard but an extension of ISO/IEC 27001, so climate applied to it indirectly, through the amendment to ISO/IEC 27001:2022.
The 2025 edition includes climate in its own text, in the clauses on the context of the organisation and interested parties — because it was published after the amendment. The organisation must determine whether climate change is a relevant issue; a note adds that interested parties can have requirements related to it. This isn’t a separate system or new documentation: the consideration must take place and be visible, in the context analysis and in the management review. If you conclude that climate change isn’t relevant to your privacy information management system, that is an acceptable outcome too, provided it is clear the question was asked.
How long implementation takes
Implementing ISO/IEC 27701 usually takes 30 to 90 days. Exactly how long depends on the size of the organisation, the number of employees and how much of the above is already in place. The inventory of processing activities takes the most time, because it needs people from several departments. We give an estimate for your case after a short conversation about the scope. On your side, for small and medium-sized organisations it takes 2 to 5 hours a week in total, spread across several people — more on this in our frequently asked questions.
What affects the price
Three things affect the cost of implementation:
- the size of the organisation;
- the number of employees;
- the standard being implemented — the amount of work differs from standard to standard.
We can only give an exact price after you get in touch and we have a short conversation about the scope. Without that, any figure would be guesswork, so we don’t give one here.
Frequently asked questions
Can we be certified to ISO/IEC 27701 alone, without ISO/IEC 27001?
Yes. Since the ISO/IEC 27701:2025 edition, the standard is standalone: organisations can be certified to it without ISO/IEC 27001. If you already have an information security management system, the two can be combined, which means less work — but ISO/IEC 27001 is no longer a prerequisite.
Does the certificate mean we comply with the GDPR?
No. Compliance with the law is determined by the competent authority, not by a certification body. The standard provides a structure that makes meeting your obligations orderly and demonstrable, which makes the job much easier — but it doesn’t confirm legal compliance.
What if we are both a controller and a processor?
That is common, and the standard provides for it. The controls for both roles apply, but only to the processing activities they relate to — so the inventory of processing activities comes before every other decision.
By when do we have to move from the 2019 edition?
The transition period ends in October 2028; your certification body will confirm the exact date. Until then, certificates to the 2019 edition remain valid, provided the usual requirements continue to be met.
Can any certification body audit us?
No. There is a separate document for auditing privacy information management systems — ISO/IEC 27706 — which sets requirements for the bodies that do this work. Before you choose, check that the body’s scope of accreditation covers ISO/IEC 27701, not just ISO/IEC 27001.
Does ISO/IEC 27701 replace the record of processing activities?
No. The standard requires an inventory of processing activities that largely matches that record, so you don’t do the work twice — but the obligation to keep the record (evidencija o radnjama obrade) comes from data protection law and remains regardless of the certificate.
General questions — cost and duration, who issues the certificate and how long it is valid — are covered in our frequently asked questions.
Related standards
- ISO 27001 — information security. No longer a prerequisite for ISO/IEC 27701, but they are often implemented together, because they share the structure and ISO/IEC 27701 includes a set of information security controls that overlap with ISO/IEC 27001.
- GDPR — the EU data protection regulation; the law this standard is linked to.
- GDPR compliance — our service for the legal side of the work, separate from the management system.
- ISO 22301 — business continuity; relevant because a data breach often comes together with a disruption to operations.
- Frequently asked questions about ISO standards — how certification works, how long a certificate is valid, what new editions mean.
- Overview of all standards — if you’re not sure what you need.
How STANDARDISO can help
We guide you through the whole process — from the inventory of processing activities and the legal bases, through the procedure for data subjects’ rights and contracts with processors, to breach handling and the internal audit. The certificate is issued by an independent, accredited certification body.
We work from your real processes: the documentation describes what you actually do, rather than forcing your work into a template. We train your staff so they can keep using the system after the audit. Everyone on our team works in English, and we can prepare your documentation in English, Serbian or both.