ISO 27701: what it is, who needs it, and how certification works

What is ISO 27701?

ISO/IEC 27701:2025 is the international standard for a privacy information management system: the policies, roles, risk and impact assessments and controls an organisation runs around the personal data it holds, whether it decides how that data is used or processes it for someone else.

The 2025 edition replaces ISO/IEC 27701:2019, which was an extension to ISO 27001 and could only be certified beside an ISO 27001 certificate. The new edition stands on its own, on the Annex SL clauses 4 to 10 that ISO 9001, 27001 and 42001 share, with controller and processor controls in its Annex A and an informative mapping to the GDPR.

Who needs ISO 27701?

Software, AI and data companies in life sciences that hold patient, participant or health data for customers in the EU and US, where procurement asks for the certificate beside ISO 27001 and the vendor questionnaire has a privacy section of its own

Suppliers that process personal data for these companies, from hosting to analytics, whose data processing agreement names the controls the customer expects to see audited

The standard becomes urgent when a customer's security review adds a privacy section and asks for the certificate, when a data processing agreement names controls nobody has written down, or when the first data subject request arrives and the procedure for answering it is one person's inbox.

ISO 27701 IN QUALIO

Qualio maps your privacy policies, assessments and events to ISO 27701 beside ISO 27001, so each shared requirement is answered once

Qualio breaks ISO 27701 down clause by clause and maps your privacy policies, assessments, training and events to each one, beside ISO 27001 and 42001, so one record answers a shared requirement. When a record changes, it reassesses the clauses it touches and recommends a fix on each gap. Copilot drafts the policy update and your team approves it. Before the audit, you export the audit pack by clause.

The privacy policy and the procedures behind it for clauses 5 and 7, held as controlled documents with training assigned on the effective date of every revision

Privacy risk assessments for clause 6, and the impact assessments Annex A asks for, held as controlled records in the same risk register as your information security risks

Internal audit and management review run as events for clause 9, reading the requests, incidents and assessments as they stand

Standards that apply alongside ISO 27701

Management systemsISO 27001: The information security management system standard the previous edition of 27701 was an extension to, and the certificate most customers ask for first, which a company holding both still runs as one system
Management systemsISO 42001: The AI management system standard, on the same Annex SL clauses, whose AI system impact assessment is read beside the privacy impact assessment when a model is trained on personal data
Management systemsISO 9001: The quality management system standard on the same clauses, which shares its document control, internal audit and management review with a privacy management system
ClinicalICH E6 (R3): Good clinical practice, which makes a sponsor answerable for the participant data its trial collects and for the systems that hold it
Electronic records21 CFR Part 11: The FDA's rule for electronic records and signatures, which governs the trial and patient records a privacy management system also has to keep under control, where they are kept electronically

Koneksa

Koneksa provides digital biomarker technology to clinical trial sponsors to unlock the remote capture of clinical data from patients.

Read the Koneksa story

“Qualio has given us one more staff member in a company where we throw nickels around like manhole covers.”

Mike TrudnakVP of IT & Information Security, xCures

Guides for ISO 27701

Guide

Annex SL: the core of your ISO journey

Checklist

Audit readiness checklist: Be prepared to pass your next audit

Questions about ISO 27701

What is ISO 27701?

ISO/IEC 27701:2025 is the international standard for a privacy information management system, the policies, roles, risk and impact assessments and controls an organisation runs around the personal data it holds, as the party that decides how it is used or the one that processes it for another.

Do we need ISO 27001 to certify to ISO 27701?

Not any more. The 2019 edition was an extension to ISO 27001 and could only be certified beside an ISO 27001 certificate. The 2025 edition is a standalone management system standard, so a company can certify to it on its own. Most still hold both, because the two share their clauses and a customer asks for 27001 first.

Does ISO 27701 cover the GDPR?

It maps to it. The standard carries an informative annex that lines its controls up against the GDPR's articles, and separates what a controller has to do from what a processor has to do, which is the split the GDPR draws. A certified system is evidence toward the regulation's obligations and does not discharge them.

Is Qualio privacy management software?

No. Qualio holds the privacy policies and procedures, the risk and impact assessments and the request and incident events the standard asks for, and assesses them against every clause. Data mapping, consent management and data subject request tooling stay in the tools you use for them. Qualio is ISO 27701 certified, and the certificate is available on request.

Can we add ISO 27701 to the standards we already run in Qualio?

Yes. Add it from the library and Qualio assesses the records you already hold against every clause, so the policy control, training, risk assessment, internal audit and management review that answer ISO 27001 or ISO 9001 count towards 27701 without being re-filed. The first assessment lists the privacy-specific gaps on their own.

When is the privacy audit?

Bring the date and your privacy procedures. We will show you ISO 27701 assessed against them clause by clause, beside ISO 27001, with the gaps listed and the audit pack exported.

Book a demo Get started

Less time on audit prep. More time on quality.