4PIMS CLAUSES (5–8)

ISO 27701:2019 · Privacy Information Management

The ISO 27701
PIMS framework

ISO/IEC 27701 turns an ISO 27001 information security management system into a Privacy Information Management System (PIMS). Here is how the standard is structured, what it adds, and where controller and processor obligations differ.

ISO 27701 is an extension of ISO 27001 — you implement it on top of an ISMS, not instead of one.

Talk to a PIMS specialist Explore the ISO 27701 hub

4PIMS clauses (5–8)

A + BController & processor annexes

1,000+Audits delivered

ISO/IEC 27701:2019 · Extension to ISO 27001 · Last reviewed June 2026

Direct Answer

What is a PIMS?

A Privacy Information Management System (PIMS) is the privacy equivalent of an ISMS: a documented set of policies, roles, processes, and controls for governing how an organisation collects, uses, shares, and protects personally identifiable information (PII). ISO/IEC 27701:2019 specifies the requirements for a PIMS and provides guidance for both PII controllers and PII processors. Rather than re-inventing a management system, it extends the one you already operate under ISO 27001 and the controls described in ISO 27002.

Key Takeaways

ISO 27701 is a privacy extension of ISO 27001 — you implement it on top of an ISMS, not instead of one.
Clauses 5–6 extend the ISO 27001/27002 management system, while Clauses 7–8 (Annex A and B) add controller- and processor-specific privacy controls.
Annex D maps every control to the GDPR, so a PIMS produces much of the accountability evidence regulators expect.
You apply the controller controls, the processor controls, or both — based on how your organisation handles PII.

How it is structured

Four building blocks, two annexes

ISO 27701 reuses the ISO 27001 management system and ISO 27002 controls, then layers privacy requirements on top. You apply the controller and processor controls according to your role.

Clause 5

PIMS requirements (ISO 27001)

Extends each ISO 27001 clause (4–10) with privacy-specific requirements, so the management system governs the processing of personally identifiable information (PII), not just information security.

PII added to the scope of the ISMS
Privacy roles and responsibilities defined
Privacy risks assessed alongside security risks
Management review covers privacy objectives

Clause 6

PIMS guidance (ISO 27002)

Adds privacy interpretation to the ISO 27002 controls already implemented under ISO 27001 — the same controls, read through a privacy lens.

Existing security controls reused, not duplicated
Privacy-specific implementation guidance
Logging and access control extended to PII
Supplier and incident controls cover privacy

Clause 7 · Annex A

PII controller controls

Additional controls for organisations that decide why and how PII is processed — lawful basis, consent, PII principal rights, and disclosure.

Conditions for collection and processing
Obligations to PII principals
Privacy by design and by default
PII sharing, transfer, and disclosure

Clause 8 · Annex B

PII processor controls

Additional controls for organisations that process PII on a controller’s behalf — acting on documented instructions, sub-processor management, and return or disposal.

Process only on documented instructions
Support the controller’s obligations
Manage and authorise sub-processors
Return or securely dispose of PII

Informative annexes complete the standard: Annex C maps to ISO 29100, Annex D to the GDPR, and Annex E to ISO 27018 and ISO 29151 — which is what makes ISO 27701 a useful bridge to specific privacy regulations.

Know your role

Controller or processor?

PII controller controls

You decide why and how PII is processed. Annex A adds controls for lawful basis, consent, purpose limitation, PII principal rights, and disclosure to third parties.

Explore controller controls

PII processor controls

You process PII on a controller’s behalf. Annex B adds controls for acting on documented instructions, managing sub-processors, and returning or disposing of PII.

Explore processor controls

Proof

In their words.

Quotes verbatim from G2. Company names added where the client confirmed them.

Verify on G2

They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.

Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026

Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.

Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026

The team’s willingness to work with us and ease of communication.

sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026

They delivered the project with speed, accuracy, and cost-effectiveness.

Maneet P.Mid-MarketSOC 2 · August 2026

My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.

Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026

They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.

Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026

Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.

Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026

Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.

Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026

The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.

Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026

What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.

Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026

Frequently Asked Questions

Common questions about the ISO 27701 PIMS framework.

Can you get ISO 27701 certified without ISO 27001?

No. ISO 27701 is an extension to ISO 27001, not a standalone standard. You need an ISO 27001 ISMS in place — either already certified or certified at the same time — because ISO 27701 adds privacy requirements on top of that management system.

What is the difference between ISO 27701 Annex A and Annex B?

Annex A lists the additional controls for PII controllers (organisations that determine the purposes and means of processing). Annex B lists the additional controls for PII processors (organisations that process PII on a controller’s behalf). An organisation applies the annex — or both — that matches its role.

Does ISO 27701 certification make you GDPR compliant?

ISO 27701 is designed to align with the GDPR — Annex D maps its controls to specific GDPR articles — so a PIMS gives you much of the operational evidence regulators expect. Certification demonstrates accountability, but it is not a legal determination of GDPR compliance on its own.

How long does ISO 27701 take to implement?

Added to an existing ISO 27001 ISMS, a PIMS programme typically takes a few months because the management-system foundation already exists. Building ISO 27001 and ISO 27701 together takes longer. Timelines vary with scope, the volume of PII processed, and your starting maturity.

Continue your ISO 27701 research

ISO 27701 hub — PIMS overview, benefits, controls, and certification in one place.
ISO 27701 & GDPR alignment — how the PIMS maps to GDPR obligations through Annex D.
ISO 27701 certification process — the ISO 27001 prerequisite, Stage 1 and Stage 2, and surveillance.

Written By Expert Auditors

Surendra Pal SinghChief Information Security Officer & Data Protection OfficerCISODPOCISAMCSEITILISO 27001 Lead AuditorISO 27701 Lead AuditorISO 42001 Lead Auditor

Saundhi ChauhanLead AuditorISO 27001 Lead AuditorISO 27701 Lead AuditorISO 42001 Lead Auditor

Last reviewed: June 2026 • Content verified by certified lead auditors

Keep Exploring

The ISO 27701
PIMS framework

What is a PIMS?

Key Takeaways