ISO 27701 vs ISO 31700: Which Do You Need?
Two privacy standards, different purposes
If your organization handles personal data and you are already working with ISO 27001, you have probably come across both ISO 27701 and ISO 31700. They both deal with privacy, but they solve different problems and work in different ways.
ISO/IEC 27701:2025 is a standalone Privacy Information Management System. ISO 31700 provides a framework for embedding privacy into product and service design from the start. Understanding the difference helps you decide which one - or both - your organization actually needs.
What ISO 27701 does
ISO/IEC 27701:2025 is its own management system standard for privacy. ISO published it on 14 October 2025 and withdrew the 2019 edition, which had been an extension of ISO 27001 and ISO 27002. You can implement the 2025 edition without an ISO 27001 certificate. If you already have an ISMS, you can still integrate the two. ISO says it can be used alone, because it is an independent management system standard.
In practical terms, ISO 27701 gives you:
- Additional controls for personal data - specific requirements for how you collect, process, store, and share personal information
- Roles and responsibilities - distinguishing between your obligations as a data controller versus a data processor
- Privacy-specific risk management - a privacy risk assessment, which can extend an existing ISO 27001 risk assessment when you have one
- Alignment with GDPR - ISO describes the standard as a way to show accountability for personal data. A certificate is not a legal finding that the GDPR is met
ISO 27701 is certifiable. Organizations that handle personal data - especially those serving EU markets - often pursue it alongside ISO 27001 to show clients and regulators that privacy management is systematic, not ad hoc.
What ISO 31700 does
ISO 31700-1:2023 takes a different approach. Rather than a privacy management system, it sets high-level requirements for embedding privacy into the design of consumer products and services. Privacy by design is older than the standard. Ann Cavoukian published the seven foundational principles in 2009, and GDPR Article 25 later required data protection by design and by default. The ISO 31700-1 text is the requirements document, not that 2009 essay.
ISO published ISO 31700-1:2023 on 31 January 2023. It applies to organizations of any size that design or develop consumer products and services. It does not require ISO 27001. Since October 2025, ISO 27701 does not require ISO 27001 either. The useful contrast is the kind of document: ISO 27701 is an accredited management-system standard. ISO 31700-1 is not.
The requirements cover areas including:
- Designing capabilities that let individuals enforce their privacy rights
- Conducting privacy risk assessments during product development
- Establishing privacy controls throughout the data lifecycle
- Preparing for and managing data breaches
- Assigning privacy roles and authorities within the organization
ISO 31700-1:2023 is a requirements document, not an accredited management-system standard. You do not receive an ISO 27701-style certificate against it. Product teams use it when they design processes that touch personal data. Part 2 of the series is the use-case document, not a second certification.
Key differences at a glance
| ISO 27701 | ISO 31700 | |
|---|---|---|
| Type | Standalone management system (2025 edition) | High-level requirements (ISO 31700-1:2023) |
| Prerequisite | None. ISO 27001 is optional | None |
| Certifiable | Yes, as an accredited management system | Not an accredited management-system certification |
| Focus | Managing personal data in a PIMS, alone or with an ISMS | Embedding privacy into product and process design |
| Audience | Organizations that process personal data | Product teams, designers, engineers building consumer-facing systems |
| GDPR alignment | Certifiable privacy system. Not a GDPR verdict | Supports Article 25 (Data Protection by Design) |
When to use which
ISO 27701 makes sense when you need a certifiable privacy management system. That can be on its own, or integrated with an ISO 27001 ISMS you already run. This is especially relevant for B2B companies processing personal data on behalf of clients - they want to see that your privacy controls are audited and certified, not just documented.
ISO 31700 makes sense when your organization builds products or services that collect or process consumer data. It helps your product and engineering teams think about privacy from the design phase rather than bolting it on after launch.
Both together provide the most comprehensive approach. ISO 27701 ensures your organization manages personal data properly at the operational level. ISO 31700 ensures privacy is built into what you create. For a SaaS company handling customer data, the combination covers both how you run your business and how you build your product.
That said, for most organizations that need an accredited management-system certificate, ISO 27701:2025 is the practical standard. ISO 31700-1:2023 is a high-level requirements document, not that kind of certificate. If the ISO 27001 work is already done, integrate. If it is not, the 2025 edition does not make you wait for it.
How 27kay can help
Privacy management is where information security meets regulatory compliance - getting the scope and approach right saves significant time and effort. We help organizations figure out which privacy standards fit their situation, whether that means a standalone ISO 27701:2025 PIMS, integrating it with an existing ISO 27001 implementation, or building privacy-by-design practices into product development.
Not sure which path makes sense for you? Let’s talk - we will give you an honest recommendation based on your actual situation, not a one-size-fits-all answer.