Our own servers in Europe · GDPR · Support in your language
English
Let's talk

Learning path

ISO 27701 — Privacy management

Clauses 4 to 10 of the 2025 edition, the Annex A controls for controllers and processors and how they map to the GDPR, explained with examples.

9 modules ~40 min total Content reviewed on

  1. 1 Context and scope of the PIMS How to decide which processing activities the system covers and in what role the organisation acts in each. Clause 4
  2. 2 Leadership and privacy policy What top management must demonstrate and what the privacy policy should say. Clause 5
  3. 3 Privacy risks and planning How to assess the risk to individuals, treat it and build the statement of applicability. Clause 6
  4. 4 Support, competence and documentation Resources, training, awareness, communication and the system’s documented information. Clause 7
  5. 5 Operating the PIMS Planning and controlling processes and repeating risk assessment and treatment. Clause 8
  6. 6 Performance evaluation Privacy indicators, internal audit and management review. Clause 9
  7. 7 Improvement and nonconformities How to deal with system failures and demonstrate continual improvement. Clause 10
  8. 8 Controls for controllers and processors What Annex A contains, how it is split between controllers and processors and how Annex B is used. Anexos A y B
  9. 9 Mapping to the GDPR and ISO 27001 What the mapping tables add and how to work alongside ISO 27001 and the GDPR. Anexos C a F

ISO 27701 templates and records, explained field by field

See how ISO 27701 works in Kimobox and request a demo

← Back to the Academy

Every clause of ISO 27701, explained with examples

Since the October 2025 edition, ISO/IEC 27701 has its own management system clauses, with the same structure as ISO/IEC 27001 or ISO 9001, and no longer depends on an existing information security system to be certified.

This path works through each clause with the records an auditor usually asks for —privacy risk assessment, statement of applicability, rights requests, breaches— and explains where the standard overlaps with GDPR obligations and where it does not.

Keep exploring

Related pages

Learning path

GDPR · Data protection

Free learning path on the GDPR: principles, data subject rights, security measures, and breaches explained…

 Learning path

ISO 27001 · Information security

A free learning path on ISO 27001: the information security standard's seven clauses explained with examples…

 Software for ISO 27001

ISO 27001, without folders or surprises

Asset inventory, risk analysis and Annex A controls, each with its status and owner.

 Security and compliance

What your IT lead is going to ask

Encryption, access control, an audit log, verified backups, and a data processing agreement that reads…

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

  1. ISO/IEC 27701:2025 — Privacy information management systems. Requirements and guidance ISO/IEC · Second edition, October 2025
  2. ISO/IEC 27701:2019 — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management ISO/IEC · First edition, August 2019; withdrawn in October 2025
  3. Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) EUR-Lex · 27 April 2016; applicable since 25 May 2018
  4. ISO/IEC 27001:2022 — Information security management systems ISO/IEC · 25 October 2022