ISO Publishes Major Update to Privacy Standard ISO/IEC 27701, First Revision Since 2019
The International Organization for Standardization (ISO) has officially published the second edition of its landmark privacy standard, ISO/IEC 27701:2025. This new release supersedes the 2019 version and introduces the most significant changes to formal privacy management in years.
Designed to guide organisations in managing personally identifiable information (PII), this standard provides the framework for a Personal Information Management System (PIMS). The 2025 update fundamentally alters its accessibility, structure, and scope to address the pressing challenges of the modern data landscape, from artificial intelligence to cross-border data flows.
A Standalone, Certifiable Management System Standard
The most impactful change in the 2025 edition is the decoupling of ISO 27701 from ISO/IEC 27001 (the information security standard).
While the 2019 version functioned purely as an “extension” to ISO 27001, the 2025 version is a complete, standalone standard. This is a game-changer, especially for small to medium organisations (SMEs) who no longer need a full Information Security Management System (ISMS) to get certified.
Structural Evolution
THE OLD WAY (2019 Version)
ISO 27001 (ISMS) (Required Prerequisite) └── ISO 27701 (PIMS) (As an Extension Only)
THE NEW WAY (2025 Version)
ISO 27701 (PIMS) (Direct, Standalone Certification) OR ISO 27001 + 27701 (Integrated System)
Many organisations have mature privacy programmes but lack a formal ISMS. The new standard allows them to implement and certify a PIMS independently, making robust privacy validation more accessible and affordable without the mandatory prerequisite of a full ISMS.
Alignment with the Harmonised Structure (HS)
To streamline integration with other management systems, ISO 27701:2025 now adopts the Harmonised Structure (HS) (formerly known as the High-Level Structure, or HLS).
This aligns its core clause structure (Clauses 4–10) with all other major ISO standards, including:
- ISO 9001:2015 (Quality Management)
- ISO/IEC 27001 (Information Security)
- ISO/IEC 42001 (Artificial Intelligence Management)
For organisations that already maintain multiple ISO certifications, this alignment is a major benefit. It allows for a single, integrated management system, reducing duplication of effort and simplifying audits. For example, the processes for “Context of the Organisation,” “Leadership,” and “Risk Assessment” can now be shared across security, privacy, and AI management frameworks.
Built for Modern Data & Risks
The 2025 standard directly confronts emerging privacy threats and technologies with a host of new and updated requirements:
- Artificial Intelligence (AI): The standard introduces new controls to address the unique privacy risks of AI and automated decision-making. It aligns closely with ISO/IEC 42001 (the AI Management System standard) to ensure that privacy is a core component of AI governance.
- Modern Data Types: The scope has been explicitly expanded to cover the protection of sensitive data types, including biometric data, health data, and data from Internet of Things (IoT) devices.
- Enhanced Privacy Risk Management: The standard places a stronger emphasis on consent and transparency. It also removes the dependency on the ISO/IEC 27001 Statement of Applicability (SoA), introducing its own focused set of privacy controls tailored for PII controllers and processors.
- Cross-Border Data Transfers: Requirements for managing the international transfer of PII have been strengthened, providing a clearer framework for navigating complex global regulations.
Innovations in Privacy and Risk Management
ISO 27701:2025 broadens the definition of “risk” to include modern organisational challenges. In a novel move for a technology standard, it mandates that organisations assess their “Context of the Organisation” (Clause 4.1) to include the impact of climate change. This requires leadership to consider how environmental risks could affect the protection of personal data (e.g. data centre vulnerability to extreme weather).
The standard also refines its approach to risk by treating privacy risks on par with security risks, rather than as a simple add-on. This requires a more comprehensive risk identification and treatment process that is deeply embedded in the organisation’s governance.
Benefits for Organisations
Adopting the new standard offers tangible, practical benefits beyond just a certificate on the wall:
| Benefit | Description |
|---|---|
| Improved Privacy Governance | Provides a clear, internationally recognised framework for embedding privacy accountability across all business functions. |
| Build Customer Trust | In an age of data scepticism, a certified PIMS is a powerful market differentiator, proving to customers and clients that their data is being handled responsibly. |
| Demonstrable Regulatory Compliance | The standard is mapped to global regulations like the GDPR (EU), CCPA/CPRA (California), and LGPD (Brazil). Certification serves as strong evidence to regulators and partners that the organisation has a robust system for compliance. |
| Future-Proofing | By addressing AI, IoT, and biometrics, the standard helps organisations build privacy-by-design into their next generation of products and services, particularly in high-growth sectors like tech, healthcare, and finance. |
How to Adopt ISO 27701:2025
Whether you are transitioning from the 2019 version or starting fresh, there is a clear path forward.
PATH 1: Transition from ISO 27701:2019
- Gap Analysis: Analyse new HS clauses and technology-specific controls.
- Update Risk Assessment: Include AI, biometrics, and climate change risks.
- Implement New Controls: Address any identified gaps in your PIMS.
- Transition Audit: Schedule an audit with your certification body.
PATH 2: New Adoption
- Define PIMS Scope: Determine what processes and data will be covered.
- Secure Leadership: Get commitment and necessary resources from the top.
- Privacy Risk Assessment: Identify key threats directly impacting personal data.
- Implement & Audit: Implement privacy controls, run internal audits, then certify.
Transition Timeline: For organisations already certified to ISO 27701:2019, a transition period (typically 2–3 years) will be established. These organisations will need to conduct a thorough gap analysis to address the new standalone structure, the Harmonised Structure clauses, and the new technology-specific controls.
A More Accessible, Powerful Framework for Privacy
The release of ISO/IEC 27701:2025 marks a pivotal moment for data privacy. By making the standard standalone, aligning it with other management systems, and embedding controls for AI and other emerging technologies, ISO has provided a framework that is both more accessible and more powerful.
As privacy continues to evolve from a niche compliance issue to a core business imperative, organisations that adopt this new standard will be better equipped to manage risk, ensure compliance, and earn a lasting competitive advantage built on digital trust.
