> ISO 27701 privacy management: document processing records, data subject rights, DPIAs and personal data breaches in one PIMS – aligned with the GDPR. Source: [https://docxpert.io/en/standards/iso-27701](https://docxpert.io/en/standards/iso-27701) # ISO 27701 Privacy Management with docxpert ## What ISO 27701 is ISO/IEC 27701 describes a privacy information management system (PIMS). It helps organisations protect personal data systematically and demonstrably meet privacy obligations – for example under the GDPR. The standard distinguishes between **controllers** and **processors** and contains specific controls for each role. Until 2025, ISO 27701 was an extension of ISO 27001 and required an existing ISMS. With the **ISO/IEC 27701:2025** edition it has become a standalone management system standard following the Harmonized Structure. It can now be certified on its own or together with ISO 27001. Transition rules of the certification bodies apply to existing certificates. ISO 27701 and the GDPR An ISO 27701 certificate is not a certification under Art. 42 GDPR and does not replace your own accountability. But the standard structures exactly the processes supervisory authorities want to see: records, legal bases, data subject rights, technical and organisational measures, processors and breach notification. ## Key requirements | Area | Content | GDPR reference | | --- | --- | --- | | Context and scope | Role as controller or processor, processing in scope | Art. 24, 28 | | Risk assessment | Risks to data subjects, not only to the organisation | Art. 32, 35 | | Record of processing | Purposes, categories, recipients, retention | Art. 30 | | Legal bases and consent | Determine and document, demonstrate consent | Art. 6, 7, 9 | | Data subject rights | Access, rectification, erasure, objection, portability | Art. 12–23 | | Privacy by design and default | Privacy in development and default settings | Art. 25 | | Processors and transfers | Contracts, sub-processors, third-country transfers | Art. 28, 44 ff. | | Personal data breaches | Detect, assess, notify, document | Art. 33, 34 | ## How docxpert supports your PIMS Privacy templates22 templates are mapped to ISO 27701, including the record of processing activities, data subject rights with DPIA and processing agreements, and security incidents and notification duties under Art. 33 and 34 GDPR. Gap analysisA requirement catalogue for ISO 27701:2025 is built in. The [gap analysis](https://docxpert.io/en/features/gap-analysis) shows which requirements are not yet covered by evidence. Together with ISO 27001Risk assessment, information assets and incident management are also mapped to [ISO 27001](https://docxpert.io/en/standards/iso-27001). Privacy sections appear when ISO 27701 applies to you. Training and awarenessPrivacy trainings with quiz and certificate through [training management](https://docxpert.io/en/features/training-certification) – including annual refreshers. Controlled policiesPrivacy policies, deletion concept and procedures are versioned, approved and distributed with a [read acknowledgement](https://docxpert.io/en/features/read-acknowledgement). TraceabilityThe audit trail records every change – important for accountability under Art. 5(2) GDPR. ## Controller or processor? Many companies are both: controller for their own employee and customer data, processor for data they handle on behalf of their customers. ISO 27701 requires you to define your role for each processing activity and apply the matching controls. | Topic | As controller | As processor | | --- | --- | --- | | Legal basis | Determine and document it yourself | Follow the customer's instructions | | Data subject rights | Handle and answer requests | Support the customer in handling them | | Sub-processors | Select processors and bind them contractually | Use sub-processors only with authorisation | | Personal data breach | Notify the supervisory authority within 72 hours | Inform the controller without undue delay | ## Step by step to a PIMS 1. 1 Record processing activities The record of processing is the foundation: which data is processed for what purpose, on which legal basis and for how long? 2. 2 Define roles and scope Clarify for each processing activity whether you act as controller or processor. 3. 3 Assess risks to data subjects Extend the risk assessment with the data subject's perspective; carry out a DPIA where the risk is high. 4. 4 Document processes Govern data subject rights, deletion, processors, third-country transfers and breach notification. 5. 5 Train, check, improve Raise employee awareness, carry out internal audits and the management review, track findings as corrective actions. ## Typical PIMS documents Which documents you need depends on your role and your processing activities. This list shows the documents found in almost every PIMS and that auditors and supervisory authorities ask about regularly: - Scope, privacy policy and roles including the data protection officer - Record of processing activities as controller and as processor - Risk assessment method and results, plus data protection impact assessments - Procedure for handling data subject requests with deadlines and evidence - Deletion and retention concept - Processing agreements and list of sub-processors - Breach notification procedure and incident register - Training records, audit reports and management review ## Practical tips - **Keep the record alive:** new tools and processes should only be used once they are in the record. - **Watch the deadlines:** access requests must generally be answered within one month; breaches notified within 72 hours. - **Implement the deletion concept:** setting retention periods is not enough – deletion must actually happen and be demonstrable. - **Involve the data protection officer:** they advise and monitor, but responsibility remains with management. ## Frequently asked questions How long does it take to implement a PIMS? If a record of processing and basic privacy processes already exist, three to six months to certification readiness is realistic. Without these foundations it takes longer, because processing activities must first be fully recorded. Is there a template for the record of processing? Yes. The "Record of processing activities" template is mapped to ISO 27701 and Art. 30 GDPR. You adapt it to your processing activities and control it like any other document with version and approval. Do I need ISO 27001 certification for ISO 27701? Since the 2025 edition, no longer necessarily: ISO/IEC 27701:2025 is a standalone management system standard. In practice both are often implemented together, because information security is a prerequisite for privacy. Is an ISO 27701 certificate a GDPR certification? No. Certifications under Art. 42 GDPR require approved criteria. ISO 27701 does help implement GDPR obligations in a structured way and meet the accountability principle. Who benefits from ISO 27701? Mainly companies that process a lot of personal data or act as processors for customers – such as SaaS providers, data centres, payroll providers or healthcare service providers. A certificate simplifies supplier assessments by customers. Does docxpert replace a consent or cookie banner tool? No. docxpert is the management system for policies, records, processes and evidence. Technical tools such as consent management or deletion routines in your systems remain separate. How are ISO 27701 and ISO 27001 connected in docxpert? Many templates are mapped to both standards and contain sections that only appear when ISO 27701 applies. You maintain one shared document instead of two parallel versions. How should I connect a record of processing activities with privacy risks? Use each processing activity as a traceable unit: record its purpose, groups of people affected, data categories, recipients, retention and involved service providers. Then assess risk in its actual context, including scale, sensitivity, access and possible consequences for individuals. The assessment should point to the relevant activity rather than remain a generic company-wide list. When a purpose or data flow changes, review both the record and its safeguards and agreements. Assign process owners so that privacy and operational teams can raise changes. This does not replace a required data protection impact assessment or legal advice; it creates a useful link between the documented activity, the risk decision and evidence that agreed controls are considered in day-to-day work. ## Read next [ISO 27001ISMS documentation, policies, Statement of Applicability and awareness training under control.Learn more](https://docxpert.io/en/standards/iso-27001) [NIS2Implement risk management measures, management training duties and reporting deadlines.Learn more](https://docxpert.io/en/standards/nis2) [Gap analysisCheck existing documents against standard requirements and work off gaps as tasks.Learn more](https://docxpert.io/en/features/gap-analysis) [Template library65 templates for 20 standards and regulations – tailored to your company, in English and German.Learn more](https://docxpert.io/en/features/template-library) [ISO 27001 mandatory documentsThe documents and records ISO/IEC 27001:2022 requires, at a glance.Learn more](https://docxpert.io/en/guides/iso-27001-mandatory-documents) ## Try docxpert free for 14 days Document control, approvals, training and evidence in one platform – with English and German templates for more than ten standards. [Start free trial](https://docxpert.io/en/trial)[See pricing](https://docxpert.io/en/pricing)