They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
ISO/IEC 27701 ANNEX A · FOUR CONTROL THEMES
If your organisation decides why and how personal data is processed, you are a PII controller. ISO 27701 Annex A adds the privacy controls that govern that role — organised under four clear themes.
Annex A controls are additional to your ISO 27001 security controls, selected through the Statement of Applicability.
4Annex A control themes
A.7.2–7.5Control reference
ControllerRole covered
ISO/IEC 27701:2019 Annex A · PII controllers · Last reviewed June 2026
Direct Answer
What are the controller controls?
A PII controller determines the purposes and means of processing personal data. ISO 27701 Annex A adds the privacy controls specific to that role, grouped under four themes — from establishing a lawful basis through to governing cross-border transfer. They are additional to, not a replacement for, the ISO 27001 security controls, and you document them in the same Statement of Applicability.
Key Takeaways
- Annex A applies to PII controllers — organisations that decide the purpose and means of processing.
- Its controls are grouped under four themes: conditions for processing, obligations to PII principals, privacy by design and default, and PII sharing and transfer.
- They are additional to — not a replacement for — the ISO 27001 security controls.
- You select and document them through the Statement of Applicability, exactly as with ISO 27001.
The four themes
Annex A control themes
A.7.2
Conditions for collection and processing
Establish and document why and how you may process PII before you collect it.
- Identify and document the lawful basis for each purpose
- Obtain and record consent where it is the chosen basis
- Carry out a privacy impact assessment (DPIA) where required
- Put processor contracts and joint-controller arrangements in place
A.7.3
Obligations to PII principals
Give individuals the information and mechanisms to exercise their rights.
- Provide clear information to PII principals about processing
- Offer mechanisms to give, modify, and withdraw consent
- Handle access, correction, and erasure requests
- Address rights around automated decision-making
A.7.4
Privacy by design and by default
Build data minimisation and protection into systems and processes from the start.
- Limit collection and processing to what each purpose requires
- Keep PII accurate and minimise what is retained
- Define retention periods and securely dispose of PII
- Control temporary files and the transmission of PII
A.7.5
PII sharing, transfer, and disclosure
Govern how PII moves to third parties and across borders.
- Establish the basis for transferring PII between jurisdictions
- Keep records of PII transfers and disclosures to third parties
- Govern disclosure to third parties and respond to requests
- Notify third parties of changes to shared PII
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Frequently Asked Questions
Common questions about the ISO 27701 controller controls.
Who has to implement the ISO 27701 controller controls?
Any organisation acting as a PII controller — one that decides why and how personally identifiable information is processed. If you also process PII on behalf of others, you apply the Annex B processor controls as well.
How is ISO 27701 Annex A organised?
Annex A groups its PII-controller controls under four themes — conditions for collection and processing, obligations to PII principals, privacy by design and default, and PII sharing, transfer, and disclosure. You select and apply them through your Statement of Applicability, just as you do for ISO 27001 Annex A.
Do these controls replace ISO 27001 Annex A controls?
No — they are additional. ISO 27701 controller controls sit on top of the ISO 27001 security controls you already operate, and together they cover both information security and privacy.
Continue your ISO 27701 research
- ISO 27701 processor controls (Annex B) — the controls for organisations that process PII on a controller’s behalf.
- The ISO 27701 PIMS framework — how Annex A fits into the overall standard.
- ISO 27701 hub — PIMS overview, controls, and certification in one place.
Keep Exploring
Related Reading
Privacy
ISO 27701 (PIMS)
The privacy extension to ISO 27001 — one audit, two certificates.
Read morePrivacy
Processor Controls (Annex B)
PII processor-specific controls for data processing agreements.
Read morePrivacy
PIMS Framework Explained
How the Privacy Information Management System extends an ISMS.
Read morePrivacy
ISO 27701 × GDPR Alignment
How ISO 27701 maps onto GDPR Articles — and what it proves.
Read morePrivacy
GDPR Compliance
The EU's data protection regulation for any company with EU users.
Read morePrivacy
DPDP Act Overview
India's Digital Personal Data Protection Act, explained.
Read more