ISO 27701 Requirements and Privacy Controls (Controllers vs Processors)

Clauses 4–10 (High Level)

Controller vs Processor Themes

• Controllers: Purposes and means, notices, lawful basis / consent where applicable, DPIA/PIA triggers, rights fulfilment, breach assessment.
• Processors: Process only on documented instructions, assist the controller, sub-processor controls, return/delete PII at end of service.
• Shared: Inventory, access control, encryption where appropriate, logging, vendor due diligence, retention.

Note on 2019 Annex A/B

ISO/IEC 27701:2019 presented controller and processor privacy controls in separate annexes (often referenced as Annex A/B). The 2025 edition consolidates and restructures that pattern—map your Statement of Applicability to the edition your CB audits against.

Evidence Auditors Expect

• Scoped PIMS policy and role matrix
• Processing inventory / records linked to systems
• Rights / DSAR case logs with clocks
• Vendor/processor contracts and reviews
• Security monitoring artefacts (e.g. via ThreatHawk)

Frequently Asked Questions

Are Annex A and Annex B still separate in 2025?

The 2025 edition restructures annexes versus the 2019 separate controller/processor annex pattern. Use your CB’s SoA template for the edition under audit.

Does ISO 27701 list every GDPR article?

No. It is a management-system standard. Map controls to legal obligations separately for GDPR, PDPL, CCPA, and others.

Can processors certify without serving EU customers?

Certification depends on your PIMS scope and CB rules, not on a single geography. Scope the processing you claim.

Related Privacy Resources

Explained · vs GDPR · CSA Privacy