_1762866128417-DS2_OO1j.png)
What ISO 27701 is
ISO/IEC 27701 describes a privacy information management system (PIMS). It helps organisations protect personal data systematically and demonstrably meet privacy obligations – for example under the GDPR. The standard distinguishes between controllers and processors and contains specific controls for each role.
Until 2025, ISO 27701 was an extension of ISO 27001 and required an existing ISMS. With the ISO/IEC 27701:2025 edition it has become a standalone management system standard following the Harmonized Structure. It can now be certified on its own or together with ISO 27001. Transition rules of the certification bodies apply to existing certificates.
Key requirements
| Area | Content | GDPR reference |
|---|---|---|
| Context and scope | Role as controller or processor, processing in scope | Art. 24, 28 |
| Risk assessment | Risks to data subjects, not only to the organisation | Art. 32, 35 |
| Record of processing | Purposes, categories, recipients, retention | Art. 30 |
| Legal bases and consent | Determine and document, demonstrate consent | Art. 6, 7, 9 |
| Data subject rights | Access, rectification, erasure, objection, portability | Art. 12–23 |
| Privacy by design and default | Privacy in development and default settings | Art. 25 |
| Processors and transfers | Contracts, sub-processors, third-country transfers | Art. 28, 44 ff. |
| Personal data breaches | Detect, assess, notify, document | Art. 33, 34 |
How docxpert supports your PIMS
Controller or processor?
Many companies are both: controller for their own employee and customer data, processor for data they handle on behalf of their customers. ISO 27701 requires you to define your role for each processing activity and apply the matching controls.
| Topic | As controller | As processor |
|---|---|---|
| Legal basis | Determine and document it yourself | Follow the customer's instructions |
| Data subject rights | Handle and answer requests | Support the customer in handling them |
| Sub-processors | Select processors and bind them contractually | Use sub-processors only with authorisation |
| Personal data breach | Notify the supervisory authority within 72 hours | Inform the controller without undue delay |
Step by step to a PIMS
- 1
Record processing activities
The record of processing is the foundation: which data is processed for what purpose, on which legal basis and for how long?
- 2
Define roles and scope
Clarify for each processing activity whether you act as controller or processor.
- 3
Assess risks to data subjects
Extend the risk assessment with the data subject's perspective; carry out a DPIA where the risk is high.
- 4
Document processes
Govern data subject rights, deletion, processors, third-country transfers and breach notification.
- 5
Train, check, improve
Raise employee awareness, carry out internal audits and the management review, track findings as corrective actions.
Typical PIMS documents
Which documents you need depends on your role and your processing activities. This list shows the documents found in almost every PIMS and that auditors and supervisory authorities ask about regularly:
- Scope, privacy policy and roles including the data protection officer
- Record of processing activities as controller and as processor
- Risk assessment method and results, plus data protection impact assessments
- Procedure for handling data subject requests with deadlines and evidence
- Deletion and retention concept
- Processing agreements and list of sub-processors
- Breach notification procedure and incident register
- Training records, audit reports and management review
Practical tips
- Keep the record alive: new tools and processes should only be used once they are in the record.
- Watch the deadlines: access requests must generally be answered within one month; breaches notified within 72 hours.
- Implement the deletion concept: setting retention periods is not enough – deletion must actually happen and be demonstrable.
- Involve the data protection officer: they advise and monitor, but responsibility remains with management.
Frequently asked questions
How long does it take to implement a PIMS?
If a record of processing and basic privacy processes already exist, three to six months to certification readiness is realistic. Without these foundations it takes longer, because processing activities must first be fully recorded.
Is there a template for the record of processing?
Yes. The "Record of processing activities" template is mapped to ISO 27701 and Art. 30 GDPR. You adapt it to your processing activities and control it like any other document with version and approval.
Do I need ISO 27001 certification for ISO 27701?
Since the 2025 edition, no longer necessarily: ISO/IEC 27701:2025 is a standalone management system standard. In practice both are often implemented together, because information security is a prerequisite for privacy.
Is an ISO 27701 certificate a GDPR certification?
No. Certifications under Art. 42 GDPR require approved criteria. ISO 27701 does help implement GDPR obligations in a structured way and meet the accountability principle.
Who benefits from ISO 27701?
Mainly companies that process a lot of personal data or act as processors for customers – such as SaaS providers, data centres, payroll providers or healthcare service providers. A certificate simplifies supplier assessments by customers.
Does docxpert replace a consent or cookie banner tool?
No. docxpert is the management system for policies, records, processes and evidence. Technical tools such as consent management or deletion routines in your systems remain separate.
How are ISO 27701 and ISO 27001 connected in docxpert?
Many templates are mapped to both standards and contain sections that only appear when ISO 27701 applies. You maintain one shared document instead of two parallel versions.
How should I connect a record of processing activities with privacy risks?
Use each processing activity as a traceable unit: record its purpose, groups of people affected, data categories, recipients, retention and involved service providers. Then assess risk in its actual context, including scale, sensitivity, access and possible consequences for individuals. The assessment should point to the relevant activity rather than remain a generic company-wide list. When a purpose or data flow changes, review both the record and its safeguards and agreements. Assign process owners so that privacy and operational teams can raise changes. This does not replace a required data protection impact assessment or legal advice; it creates a useful link between the documented activity, the risk decision and evidence that agreed controls are considered in day-to-day work.