Software for ISO 27701

ISO 27701, without folders or surprises

Processing activities, impact assessments, data subject rights, breaches and processors in an auditable privacy system linked to the GDPR.

What it is and which edition applies

ISO/IEC 27701 is the international standard for privacy information management systems (PIMS), aimed at controllers and processors of personal data. Its second edition, published in October 2025, withdraws the 2019 version and turns it into a standalone management system standard: it is no longer an extension of ISO/IEC 27001 and can be implemented and certified on its own, although it is designed to sit alongside an information security system and includes a mapping table to the GDPR.

Content reviewed on 17 October 2026

Current edition: ISO/IEC 27701:2025 Second edition, published in October 2025; it cancels and replaces the 2019 edition
Main change: Standalone management system standard The 2019 edition was drafted as an extension of ISO/IEC 27001 and ISO/IEC 27002
Who it is for: Controllers and processors Of any size, whether public, private or not-for-profit
Structure: Clauses 4 to 10 and Annexes A to F Annexes A (controls) and B (guidance) are normative; C to F map to ISO/IEC 29100, the GDPR, ISO/IEC 27018 and 29151, and the 2019 edition
Link to the GDPR: Informative Annex D Mapping to Regulation (EU) 2016/679; certification is no substitute for legal compliance
Committee: ISO/IEC JTC 1/SC 27 Information security, cybersecurity and privacy protection

Document control

Versions, approvals and distribution with read receipts.

Connected to your document cloud

Publish and version documents by connecting to OneDrive, Google Drive or SharePoint, without duplicating folders.

Audits

Annual program, checklists per standard, findings linked to actions.

Non-conformities

Root cause, action, owner, deadline and effectiveness check.

KPIs

Process objectives fed with real operating data.

Legal requirements

A register of legal and other requirements, with validity and compliance evaluation per standard.

Corrective actions

Root cause, action, owner, deadline and effectiveness check, all linked to the nonconformity.

Improvement actions

Improvement opportunities with an owner and tracking, beyond just fixing what already failed.

Management review

A pre-built report with indicators, audits and nonconformities, ready for the meeting.

Processing and lawful basis

Every processing activity with its purpose, data categories, recipients and erasure deadline.

Data subject rights

Access, erasure or objection requests with the one-month deadline monitored and the reply on record.

Data breaches

A log of every breach with the decision on whether to notify and the 72-hour clock in plain view.

Processors

Contracts, authorised sub-processors and periodic review of every supplier handling data on the company’s behalf.

Requirements covered

What it solves for ISO 27701

Record of processing activities with its lawful basis
Privacy risk and impact assessment
Data subject requests answered on time
Logging and notification of personal data breaches
Contracts and oversight of processors and sub-processors
Statement of applicability for privacy controls

Standards covered

Pick your standard and see what it solves

GMP+ Animal feed safety Food industry · animal feed IATF 16949 Automotive Automotive SQAS2022 Chemical and logistics assessment Quality · chemical and logistics ISO 19600 Compliance management systems Compliance · guidance ISO 37301 Compliance management systems Compliance ISO 22716 Cosmetics manufacturing Quality · cosmetics GDPR Data protection Legal · data protection ISO 14001 Environmental management Environment SGE 21 Ethical and responsible management Social responsibility IFS Food Food safety Food industry ISO 22000 Food safety Food industry FSSC 22000 Food safety management system Food industry BRCGS Global food standard Food industry ISO 14064 Greenhouse gases Environment · carbon footprint HACCP Hazard analysis and critical control points Food industry ISO 27001 Information security Cybersecurity ISO 20000 IT service management Quality · IT services ISO 13485 Medical devices Healthcare ISO 15189 Medical laboratories Quality · healthcare ENS National Security Framework Security · public sector UNE 73401 Nuclear quality assurance Quality · nuclear ISO 45001 Occupational health and safety Health & safety ISO 27701 Privacy management Cybersecurity ISO 9001 Quality management Quality · every sector ISO 26000:2010 Social responsibility Social responsibility · guidance Sustainability Sustainability management ESG UNE 19602 Tax compliance Compliance · tax ISO 17025 Testing and calibration laboratories Quality · laboratories

Templates and records

ISO 27701 records, explained one by one

Which clause of ISO 27701 calls for each record, which fields it needs, a completed example and what the auditor usually flags.

See all ISO 27701 templates and records

Vocabulary

The terms, stated precisely

PIMS: Privacy information management system: the set of policies, processes, controls and records an organisation uses to govern the personal data it handles and to show that it handles it properly.
Controller: Whoever decides why and how personal data are processed. The standard calls it the PII controller and gives it its own group of controls.
Processor: Whoever processes personal data on behalf of the controller and following its instructions, such as a payroll or hosting provider. In the standard, the PII processor.
Personally identifiable information (PII): The term the standard uses for what the GDPR calls personal data: any information that identifies, or could identify, a natural person.
Data protection impact assessment (DPIA): A prior analysis of processing likely to pose a high risk to individuals, with the measures to reduce it. Article 35 of the GDPR requires one in those cases.
Statement of applicability: A document listing the Annex A controls, stating which apply and justifying those excluded. It is what ties the risk assessment to what is actually done.

Frequently asked questions

What people ask us before getting started

Which edition of the standard is current?

The edition in force is ISO/IEC 27701:2025. When the issuing body publishes a new one, a transition period opens; once it closes, certificates issued against the previous edition stop being valid.

Does this work if we are already certified?

Yes. Your existing system — processes, documents, records, audit history — is loaded in and kept alive from day one. Nothing needs redesigning and the certification cycle does not restart.

Will the auditor accept digital records?

Yes, provided they are traceable, controlled and able to show who did what and when. No standard requires paper; every standard requires reliable evidence, and a properly controlled electronic record provides it better than a folder.

Can it be combined with other standards?

Yes, and that is the sensible route. The common Annex SL structure lets a single integrated system share the process map, document control, internal audits, nonconformities and indicators between ISO 27701 and the rest, leaving only the standard-specific parts separate.

How long does it take to be ready for an audit?

It depends on the starting point. An organisation already working with written procedures is usually ready in two or three months; one starting from scratch needs longer. The bottleneck is rarely the tool — it is the availability of the people who know the processes.

What happens to the documentation we already have?

It is migrated. Existing procedures, forms and records are loaded with their version and approver, so the history is not lost and the system starts with the memory the organisation already had.

Can the auditor look directly at the system?

Yes. They are given read-only access with a defined scope and an expiry date. It is more comfortable for both sides than preparing a folder of screenshots and exports.

What is the difference between a major and a minor nonconformity?

A major one compromises the system's ability to meet a requirement — a required process missing altogether, systematic failure, or a failure affecting the product — and usually blocks certification until it is closed. A minor one is a specific lapse resolved with an action plan.

Are the indicators calculated automatically?

Yes, from the data the processes themselves generate. That is the difference between a dashboard that reflects what is happening and a spreadsheet somebody fills in the week before the management review.

Does it work across several sites or legal entities?

Yes. The model is multi-company and multi-site: what makes sense to share is shared, and what belongs to each location stays separate — including the certificate scope where it differs.

Get ready for your ISO 27701

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

ISO/IEC 27701:2025 — Privacy information management systems. Requirements and guidance ISO/IEC · Second edition, October 2025
ISO/IEC 27701:2019 — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management ISO/IEC · First edition, August 2019; withdrawn in October 2025
ISO/IEC 27001:2022 — Information security management systems ISO/IEC · 25 October 2022
Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) EUR-Lex · 27 April 2016; applicable since 25 May 2018

Software for ISO 27701 — Privacy management

Kimobox is a software for ISO 27701 that digitizes the requirements of the standard: record of processing activities with its lawful basis, privacy risk and impact assessment, data subject requests answered on time, logging and notification of personal data breaches, with full traceability and evidence ready for the auditor.

The platform lets you run an integrated management system that combines ISO 27701 with other ISO standards and sector protocols, sharing the process map, document control, internal audits, non-conformities and KPIs.