ISO/IEC 27701 sets out a privacy information management system (PIMS). The 2019 edition was an extension to ISO 27001: you couldn't hold it on its own. The 2025 edition, published in October 2025, is a standalone management system standard.
The deadline
UKAS has set the transition arrangements in its technical bulletin on PIMS (Revision 1, 18 August 2026, which replaces the original bulletin of 18 March 2026). Organisations certified to the 2019 edition must move to the 2025 edition by 31 October 2028. Most will do it at a surveillance or recertification audit, so the real deadline is the audit date before then.
What changed
UKAS lists six main changes from the 2019 edition:
- It's a standalone management system standard.
- It follows the harmonised structure used by ISO 27001, ISO 9001 and the other management system standards.
- Leadership, governance and performance evaluation carry more weight.
- Climate change considerations are included, as in the other harmonised standards.
- Privacy risk management is formally embedded.
- The controls for controllers and processors are restructured.
What it means if you hold ISO 27001
If you already run an ISO 27001 management system, much of the machinery is shared: the clause structure, internal audit, management review and document control. The privacy work sits on top: your role as controller or processor, the privacy risk assessment, records of processing, and the controller and processor controls.
Before committing to the standalone route, confirm with your certification body which edition it's accredited for and whether it certifies 27701 on its own or alongside 27001. During the transition, the answer varies between bodies.
A sensible order of work
- Gap review. Compare your 2019 PIMS against the 2025 clauses and controls, and list what's missing.
- Scope and roles. Confirm where you act as controller and where as processor, product by product.
- Risk and controls. Update the privacy risk assessment and the Statement of Applicability against the restructured controls.
- Internal audit and management review against the 2025 edition, before the external audit.
- Agree the audit date with your certification body, comfortably before 31 October 2028.
If you don't hold 27701 yet
Customers whose personal data you process, or who ask detailed privacy questions in procurement, may ask for 27701 alongside 27001. With the 2025 edition, a new certificate starts on the current version, so there's no transition to plan.
Next step: see ISO 27701 for the transition review and implementation options, or book a free diagnostic.
Sources: UKAS technical bulletin, Transition arrangements for PIMS (ukas.com/resources/technical-bulletins/transition-arrangements-for-pims, Revision 1, 18 August 2026); ISO, ISO/IEC 27701:2025 (iso.org/standard/27701).