They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
ISO/IEC 27701:2019 ANNEX B · FOUR CONTROL THEMES
If you process personal data on behalf of your customers, you are a PII processor. ISO 27701 Annex B adds the privacy controls for that role — built around acting only on documented instructions.
The defining principle is processing only on documented instructions — never for your own purposes.
4Annex B control themes
B.8.2–8.5Control reference
ProcessorRole covered
ISO/IEC 27701:2019 Annex B · PII processors · Last reviewed June 2026
Direct Answer
What are the processor controls?
A PII processor handles personal data on a controller’s behalf and does not decide the purpose of processing. ISO 27701 Annex B adds the privacy controls specific to that role, grouped under four themes — all anchored in acting on the controller’s documented instructions, managing sub-processors, and returning or disposing of PII when the engagement ends.
Key Takeaways
- Annex B applies to PII processors — organisations that handle personal data on a controller’s behalf.
- The defining principle is processing only on the controller’s documented instructions, never for your own purposes.
- Controls span records, return and disposal of PII, transmission security, and authorised sub-processor management.
- Certification answers most of the privacy section of enterprise vendor security reviews with independent evidence.
The four themes
Annex B control themes
B.8.2
Conditions for collection and processing
Process PII strictly within the bounds the controller has set.
- Process PII only on the customer’s documented instructions
- Do not use PII for your own purposes such as marketing
- Flag any instruction that may infringe applicable law
- Keep records that support the controller’s obligations
B.8.3
Obligations to PII principals
Help the controller meet its duties to individuals.
- Assist the controller in meeting its obligations to PII principals
- Pass on access, correction, and erasure requests appropriately
- Support the controller’s response within agreed timelines
B.8.4
Privacy by design and by default
Protect PII through its lifecycle in your environment.
- Control temporary files and intermediate copies of PII
- Return, transfer, or securely dispose of PII as agreed
- Protect PII in transit with appropriate transmission controls
B.8.5
PII sharing, transfer, and disclosure
Govern onward transfer and the engagement of sub-processors.
- Establish the basis for transferring PII between jurisdictions
- Record disclosures and the jurisdictions PII may be disclosed to
- Handle legally binding requests for disclosure correctly
- Engage sub-processors only with authorisation and notify of changes
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Frequently Asked Questions
Common questions about the ISO 27701 processor controls.
Who needs the ISO 27701 processor controls?
Any organisation that processes personally identifiable information on behalf of another party — a SaaS vendor, a BPO, a managed-service or offshore development provider. These are the PII processor controls in Annex B. If you also decide why data is processed, you apply the Annex A controller controls too.
What is the core principle for a PII processor?
Acting only on the controller’s documented instructions. A processor does not decide the purpose of processing and must not use PII for its own ends — Annex B builds the records, contracts, and sub-processor controls that make that demonstrable.
How does this help us win enterprise customers?
Enterprise buyers increasingly require privacy assurance from their vendors. An ISO 27701 certificate covering the processor controls answers most of the privacy section of a vendor security review with independent evidence rather than a questionnaire.
Continue your ISO 27701 research
- ISO 27701 controller controls (Annex A) — the controls for organisations that decide why and how PII is processed.
- ISO 27701 certification process — the path from gap analysis to the Stage 1 and Stage 2 audits.
- ISO 27701 hub — PIMS overview, controls, and certification in one place.
Keep Exploring
Related Reading
Privacy
ISO 27701 (PIMS)
The privacy extension to ISO 27001 — one audit, two certificates.
Read morePrivacy
Controller Controls (Annex A)
PII controller-specific controls mapped to GDPR obligations.
Read morePrivacy
PIMS Framework Explained
How the Privacy Information Management System extends an ISMS.
Read morePrivacy
ISO 27701 × GDPR Alignment
How ISO 27701 maps onto GDPR Articles — and what it proves.
Read morePrivacy
GDPR Compliance
The EU's data protection regulation for any company with EU users.
Read moreHIPAA
Business Associate Agreements
What a BAA must contain and when you need one.
Read more