ISO 27701 Platform for Your PIMS

PIMS stands for privacy information management system. An ISO 27001 ISMS protects information in general; a PIMS addresses who handles personal data, in which role, and with what safeguards for the people behind that data. It reuses the same management machinery (roles, risk assessment, continual improvement) and adds privacy-specific requirements: informing data subjects, handling consent, international transfers, oversight of processors. It can be run on its own or integrated into an ISMS you already operate.

Yes. Unlike guidance standards such as ISO 27005, it sets out auditable requirements. First published in 2019 as an extension to ISO/IEC 27001, it was revised in October 2025: the second edition is a standalone management system standard, certifiable without holding ISO/IEC 27001 first, while still integrating with an existing ISMS. Certificates issued against the 2019 edition stay valid through a three-year transition period. Check with your accredited certification body which edition your audit will target.

No. Article 42 of the GDPR provides for certification mechanisms approved by supervisory authorities, and ISO 27701 is not one of them: no ISO certificate exempts an organisation from applying the regulation. What the standard gives you is a documented organisation and, in its Annex D, a mapping between its requirements and the articles of the GDPR, which makes compliance far easier to evidence in front of a customer, an auditor or a regulator. It is a means of proof, not a legal shield.

Any organisation processing personal data, whether as a controller or as a processor, of any size and in any sector. The standard separates those two roles and attaches a different set of measures to each: a hosting provider or a SaaS vendor does not carry the same duties as the organisation instructing it. Unlike the GDPR, which applies by law, adopting the standard is voluntary. In practice it is usually driven by customers or by tenders that demand a recognised privacy guarantee.

The record of processing activities required by Article 30 of the GDPR is a document: it lists your processing activities, their purposes, their recipients and their retention periods. A PIMS is the system that produces and maintains that document, among others. It sets out who owns it, how often it is reviewed, when an impact assessment is triggered, and how a data subject request is handled. An up-to-date record does not by itself evidence a PIMS; a working PIMS is what keeps the record up to date.

Because the hard part of a PIMS is not writing the documents, it is keeping them consistent over time. A purpose changes, a processor is replaced, a retention period is shortened: in a spreadsheet nothing flags the measures and the evidence that have quietly become wrong. A platform keeps the link between a processing activity, the measure covering it, the matching ISO 27701 control and the evidence filed against it, and surfaces what breaks when one element moves. That chain is what an auditor asks to see.