ISO 27701:2025 — What Changed and the Move to a Standalone Standard

What Changed

• Standalone MSS: Clauses 4–10 align with other ISO management-system standards
• No 27001 prerequisite: for certification under the 2025 edition
• Annex restructuring: controller/processor privacy controls consolidated versus the 2019 separate Annex A/B pattern
• Guidance integrated: requirements + guidance in the 2025 package (confirm your purchased edition’s parts with ISO/CB materials)

Transition

Certification and accreditation bodies commonly describe an approximately three-year transition from publication—often cited through about October 2028. Confirm the exact end date and dual-certificate rules with your accredited CB; treat the window as accreditation-path guidance, not a separate legal mandate from ISO.

What To Do Now

1. Ask your CB which edition they will audit next surveillance/recertification
2. Remap your SoA to 2025 structure
3. Decide whether to keep ISO 27001 for security buyers even if PIMS no longer requires it

Frequently Asked Questions

When was ISO 27701:2025 published?

14 October 2025.

Is the transition exactly three years?

Bodies commonly describe ~3 years from publication (often through ~October 2028). Use your CB’s written transition plan as authoritative for your certificate.

Must we drop ISO 27001?

No. Many keep both. 27001 is optional for 2025 PIMS certification, not forbidden.

Related Privacy Resources

Requirements · Checklist · CSA Privacy