ISO 27701:2025 Without ISO 27001

ISO 27701:2025 stands on its own

ISO/IEC 27701:2025 is a Privacy Information Management System (PIMS), and it no longer requires ISO 27001. ISO published the second edition on 14 October 2025 and withdrew ISO/IEC 27701:2019. ISO’s own answer is yes: it is an independent management system standard, so it can be used alone. If you process personal data and need a certifiable privacy system, you can build the PIMS without holding an ISO 27001 certificate first. If you already have an ISMS, you can still run the two together.

What changed from the 2019 extension?

The 2019 edition was a privacy extension. It added requirements on top of ISO 27001 and guidance on top of ISO 27002, so you could not implement it without those standards as the base. That sentence is now false for the current edition.

The 2025 edition has its own management system requirements. ISO describes it as requirements and guidance for establishing, implementing, maintaining, and continually improving a PIMS, for PII controllers and PII processors. It follows the same harmonized structure as other ISO management system standards, which is why it still lines up with an existing ISMS, a quality system, or an ISO 42001 AI management system. Alignment is a design choice. It is not a prerequisite.

UKAS, the UK accreditation body, describes the same shift in its transition bulletin of 18 August 2026: the 2025 edition converted the PIMS into a standalone management system standard and restructured controller and processor controls. That bulletin is an accreditation-body document, not the ISO text. Use it for the transition clock, and use the ISO standard for the requirements.

Controllers and processors still matter

The standard is written for both roles. A controller decides why and how personal data is processed. A processor processes it for someone else. Many organizations are both, depending on the activity. A SaaS company is often a processor for customer data and a controller for its own employee and marketing data. The controls follow the role, not the logo on the contract.

Typical controller work includes a lawful basis for each activity, a way to answer data subject requests, privacy impact assessments where the processing warrants them, rules for sharing and cross-border transfers, and retention that actually ends in deletion. Typical processor work includes processing only on documented instructions, the security measures agreed with the controller, telling the controller about a breach without undue delay, helping with data subject requests, and binding sub-processors to equivalent terms.

Those are the jobs the PIMS has to make reliable. We are not citing annex letters from the 2019 edition, because that edition has been withdrawn and the 2025 text was restructured. Confirm the control layout in the 2025 standard you buy, not in a 2019 summary.

Integrate, or keep the PIMS separate?

You already have ISO 27001. Do not start over, and do not assume the old “extension” project plan. The useful overlap is real: access control, encryption, logging, supplier security, and incident handling already support privacy. The gaps are usually purpose limitation, consent where you rely on it, data subject rights, and retention and deletion. Your risk assessment has to include privacy risk, and the scope has to name the PII processing you are actually accountable for. An integrated audit is often the calmer path, because one internal audit programme and one management review can cover both systems.

You do not have ISO 27001, and privacy is the problem you were asked to solve. You can implement ISO 27701:2025 on its own. That is the point of the 2025 edition. Do it when clients or a regulator want a certifiable privacy system and a full ISMS would be a wider project than the risk justifies. You will still need security controls inside the PIMS. “Standalone” means ISO 27001 certification is not a ticket you must buy first. It does not mean you can ignore confidentiality, integrity, and availability of the personal data.

You are choosing between ISO 27701 and ISO 31700. They answer different questions. ISO 27701 is the management system you can certify under an accredited scheme. ISO 31700-1:2023 sets high-level requirements for privacy by design of consumer products and services. It is not an accredited management-system certification. We compare them in ISO 27701 vs ISO 31700.

What about a 2019 certificate?

UKAS tells accredited certification bodies to have transitioned all certified clients by 31 October 2028. The same bulletin sets 14 October 2025 as the publication date and asks bodies to move their own accreditation across as well, including to ISO/IEC 27706:2025, which is the requirements standard for bodies that audit a PIMS. The 31 October 2028 date is UKAS’s date for its accredited bodies. It is not printed in ISO/IEC 27701. Confirm the end date, the audit type, and the evidence your body wants before you plan the year. Another accreditation body can set the same window. Do not treat a UK bulletin as a worldwide ISO rule.

Until that transition is done, a 2019 certificate can remain in the market only on the terms your certification body and its accreditation body still accept. After the transition date they set, a 2019 certificate is the wrong artefact to show a customer.

ISO says the standard helps organizations show accountability for personally identifiable information and supports privacy laws such as the GDPR. That is a fair description of a management system. It is not a legal finding. The GDPR is broader than any one standard, and a certificate does not mean a regulator has signed off your processing. What it does give you is auditable evidence: scope, roles, risk decisions, controls, and a cycle of internal audit and management review. The overlap with security work is covered in ISO 27001 and the GDPR.

This page is an implementation note, not legal advice. If a processing question turns on a lawful basis or a transfer tool, involve counsel.

How to start

Name the processing you are accountable for, and mark controller or processor for each activity.
Decide whether the PIMS will stand alone or share a scope, risk method, and audit programme with an existing ISMS.
If you hold a 2019 certificate, ask your certification body for its transition rules and the date it will stop certifying the old edition.
Close the privacy gaps an ISMS usually does not cover: rights requests, retention and deletion, and purpose limitation.
Keep one set of records. A second privacy binder that the security team never sees will fail the first audit that asks for both.

How 27kay can help

We implement ISO 27001 and privacy programmes for the same clients, so the question is usually scope, not a new methodology. We will tell you if a standalone PIMS is enough, and we will tell you if the ISMS should come first.

For people who need the 2025 edition in a course, PECB’s ISO/IEC 27701 Transition course is the change-focused one, and the Lead Implementer course is the build-the-system one. The privacy and data protection bundle groups related courses. A course certificate is an individual’s credential. It is not your organization’s ISO 27701 certificate, and it does not replace the standard.

Let’s talk - we will scope the work from the system you have now and the privacy obligations you actually carry.