In short: ISO/IEC 27701:2025, published on 14 October 2025, turns privacy information management into a standalone management system standard. You no longer need ISO 27001 to certify against it, it follows the same clause 4 to 10 structure as other ISO management system standards, and its controls are aligned with ISO/IEC 27001:2022. If you hold a 2019 certificate, plan your transition now rather than in the final year.
| Topic | ISO 27701:2019 | ISO 27701:2025 |
|---|---|---|
| Status | An extension to ISO 27001 and ISO 27002 | A standalone privacy information management system standard |
| Certification | Only alongside an ISO 27001 certificate | Certifiable on its own, or integrated with ISO 27001 |
| Structure | Clauses that modified ISO 27001 requirements | Full management system clauses 4 to 10 |
| Control alignment | Based on ISO 27002:2013 | Aligned with ISO/IEC 27001:2022 and 27002:2022 |
| Controls | Annexes for PII controllers and PII processors | A revised Annex A with privacy controls for PII controllers and processors, plus the security controls a standalone PIMS needs |
Under the 2019 edition, privacy certification was locked behind an information security certificate. Organisations whose main obligation is data protection, rather than information security, had to build an entire ISO 27001 system first. The 2025 edition removes that barrier. A processor that needs to demonstrate accountability under UK GDPR can now certify its privacy management system directly.
For organisations that already run ISO 27001, the better route is usually an integrated system: one set of leadership, risk, internal audit and management review processes serving both standards. That is the approach we describe in The Triangle of Control.
Certification bodies accredited by UKAS are working to a transition deadline of 31 October 2028 for certificates issued against the 2019 edition. After that date, 2019 certificates lapse. In practice, most organisations will transition at a surveillance or recertification audit, and certification body audit slots fill up quickly in the final year, so planning for 2026 or 2027 is sensible.
No. The 2025 edition is a standalone standard. Many organisations will still choose an integrated system, because the two share most of their management system processes.
Yes, until the transition deadline. You will need to transition to the 2025 edition before your certificate lapses.
For a well-run 2019 system, a focused gap analysis and update usually takes weeks rather than months. The bigger task is evidencing the changes before the transition audit.
Planning your ISO 27701 transition? Our ISO 27701 privacy consultancy runs gap analyses against the 2025 edition, or you can book a free scoping call with a senior lead auditor.