The international standard for a privacy information management system (PIMS) has been revised, and it’s more than just a 2025 update!
ISO 27701 PIMS is now a Stand-Alone Standard!
Previously the ISO 27701 standard provided additional controls to be applied to an ISO 27001 information security management system (ISMS) base framework.
However the 2025 update, and associated ISO 27706 standard, now stands completely alone, with its own Annex A of controls. This means it provides every requirement you need to build a full PIMS and certify to ISO 27701 in its own right!
What are the Benefits of PIMS as a Stand-Alone Management System?
- No need to implement an ISMS to ISO 27001 in order to implement a PIMS to ISO 27701 (although there are benefits to both).
- No need to change certification bodies if your ISO 27001 supplier does not also certify ISO 27701.
- Improved competition in the certification market.
Other Changes in ISO 27701:2025
Other significant changes to ISO 27701 include:
- The move away from the 2013 format of the ISO 27001 controls and alignment to the new 2022 edition.
- The control numbers in Annex A have changed, although many of the requirements remain the same or similar.
- There is also expanded guidance for data controllers and data processors.
- 78 Controls in Annex A.
This means even existing ISO 27701 systems will need work to bring their PIMS up-to-date.
Of course as consultants we can help with that.
Transition to ISO 27701:2025
If you are certified to ISO 27701:2019, you will have already integrated the controls with ISO 27001, so it makes sense to maintain this integrated system.
It’s likely that certification bodies will offer a 3-year transition period, like any other standard.
It will be important to address the changes in the standard.
