Controls for controllers and processors

An annex of controls in its own right

In the 2019 edition the controls built on those of ISO/IEC 27002 with privacy additions. In the 2025 edition Annex A stands alone: it groups the controls according to whether they apply to the controller, the processor or both, and it brings in the security controls that have a direct impact on privacy.

What they cover

For the controller: conditions for collection and processing —purpose, lawful basis, consent, impact assessment—, obligations towards data subjects, privacy by design and transfers. For the processor: agreements with the customer, processing only on its instructions, sub-processors and disclosures to third parties.

Annex B and the statement of applicability

Annex B is the implementation guidance for each control. Every Annex A control is either applied or excluded with a justification in the statement of applicability (6.1.3): no auditor expects a processor to apply the controller’s controls, but they do expect it to explain why.

What an auditor usually asks for

• The organisation’s role defined for each processing activity
• A statement of applicability that covers the whole of Annex A
• Evidence of implementation for each applied control
• A justification for every exclusion

How to cover the controls in Kimobox

1. 1Load the Annex A controls into the statement of applicability with their status.
2. 2Link each control to the record that evidences it: processing activities, rights, contracts.
3. 3Assign an owner and a review date to each applied control.

ISO 27701 templates and records in this chapter

• ISO 27701 record of processing activities template · Mandatory document
• ISO 27701 privacy impact assessment template · Mandatory record
• ISO 27701 consent record template · Mandatory record
• ISO 27701 data subject request log template · Mandatory record
• ISO 27701 personal data breach log template · Mandatory record
• ISO 27701 data processing agreement template · Mandatory document

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

1. ISO/IEC 27701:2025 — Privacy information management systems. Requirements and guidance ISO/IEC · Second edition, October 2025
2. ISO/IEC 27701:2019 — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management ISO/IEC · First edition, August 2019; withdrawn in October 2025
3. Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) EUR-Lex · 27 April 2016; applicable since 25 May 2018
4. ISO/IEC 27001:2022 — Information security management systems ISO/IEC · 25 October 2022