What is ISO/IEC 27701?

The international standard for privacy management systems, certifiable and built upon ISO/IEC 27001.

Definition

ISO/IEC 27701 is the international standard that specifies the requirements for a privacy information management system (PIMS), with controls for controllers and processors of personal data, built upon the ISO/IEC 27001 information security management system.

The 2019 edition is an extension of ISO/IEC 27001 and ISO/IEC 27002; the 2025 edition allows for independent certification of PIMS. Certification is voluntary and serves as evidence of good practices to clients, partners, and authorities.

What the standard says

The standard is published in ISO websiteIt requires policy, roles, objectives, and critical analysis for the PIMS, an inventory of personal data with purposes and legal bases, management of consents and data subject rights, controls over third parties and transfers, privacy risk assessment, internal audits, and continuous improvement. LGPD (Art. 50) and the GDPR (Art. 42) recognize certifications and best practices as evidence of compliance. The page ISO/IEC 27701: requirements and certification It details the requirements.

In practice

Map the controls from Appendix A (controllers) and Appendix B (operators) that apply to the organization.
Gather the evidence the auditor requests: inventory, consents, requests, incident reports, and third-party assessments.
Conduct internal audits before certification.
Plan the 3-year cycle with annual maintenance audits.

How Privacy Tools it deals with the topic

Os Diagnoses and Assessments They measure adherence to each control; Audit Management It plans the audits and stores the evidence; the other modules generate the required records.

Updated October 3th, 2026.

Want to see this concept applied in practice?

Request a demo and see how... Privacy Tools It organizes mapping, legal bases, rights holder applications, and evidence all in one place.