# ISO/IEC 27701:2025 PIMS Controls > The Privacy Information Management System extension to ISO/IEC 27001 — controls for PII controllers and processors that evidence GDPR-style accountability and form the most-recognised international way to demonstrate alignment with major privacy regulations. - Source: https://support.icompaas.com/compliance/iso-27701-2025 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## ISO/IEC 27701:2025 PIMS Controls: control library 78 controls in 10 sections. Each control page has implementation guidance and the evidence to collect; append `.md` to any link for Markdown. ### Conditions for collection and processing ISO/IEC 27701:2025 PIMS Controls - [ISO/IEC 27701:2025 A.1.2.2 — Identify and document purpose](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-2-identify-and-document-purpose) - [ISO/IEC 27701:2025 A.1.2.3 — Identify lawful basis](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-3-identify-lawful-basis) - [ISO/IEC 27701:2025 A.1.2.4 — Determine when/how consent obtained](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-4-determine-when-how-consent-obtained) - [ISO/IEC 27701:2025 A.1.2.5 — Obtain & record consent](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-5-obtain-record-consent) - [ISO/IEC 27701:2025 A.1.2.6 — Privacy impact assessment](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-6-privacy-impact-assessment) - [ISO/IEC 27701:2025 A.1.2.7 — Contracts with PII processors](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-7-contracts-with-pii-processors) - [ISO/IEC 27701:2025 A.1.2.8 — Joint PII controller](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-8-joint-pii-controller) - [ISO/IEC 27701:2025 A.1.2.9 — Records related to processing PII](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-9-records-related-to-processing-pii) ### Obligations to PII principals ISO/IEC 27701:2025 PIMS Controls - [ISO/IEC 27701:2025 A.1.3.2 — Comply with obligations](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-2-comply-with-obligations) - [ISO/IEC 27701:2025 A.1.3.3 — Information for PII principals](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-3-information-for-pii-principals) - [ISO/IEC 27701:2025 A.1.3.4 — Providing info to PII principals](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-4-providing-info-to-pii-principals) - [ISO/IEC 27701:2025 A.1.3.5 — Modify/withdraw consent](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-5-modify-withdraw-consent) - [ISO/IEC 27701:2025 A.1.3.6 — Mechanism to object](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-6-mechanism-to-object) - [ISO/IEC 27701:2025 A.1.3.7 — Access / correction / erasure](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-7-access-correction-erasure) - [ISO/IEC 27701:2025 A.1.3.8 — Inform third parties](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-8-inform-third-parties) - [ISO/IEC 27701:2025 A.1.3.9 — Providing copy](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-9-providing-copy) - [ISO/IEC 27701:2025 A.1.3.10 — Handling requests](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-10-handling-requests) - [ISO/IEC 27701:2025 A.1.3.11 — Automated decision obligations](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-11-automated-decision-obligations) ### Privacy by design / default ISO/IEC 27701:2025 PIMS Controls - [ISO/IEC 27701:2025 A.1.4.2 — Limit collection](https://support.icompaas.com/compliance/iso-27701-2025/a-1-4-2-limit-collection) - [ISO/IEC 27701:2025 A.1.4.3 — Limit processing](https://support.icompaas.com/compliance/iso-27701-2025/a-1-4-3-limit-processing) - [ISO/IEC 27701:2025 A.1.4.4 — Accuracy & quality](https://support.icompaas.com/compliance/iso-27701-2025/a-1-4-4-accuracy-quality) - [ISO/IEC 27701:2025 A.1.4.5 — PII minimization objectives](https://support.icompaas.com/compliance/iso-27701-2025/a-1-4-5-pii-minimization-objectives) - [ISO/IEC 27701:2025 A.1.4.6 — De-identification / deletion](https://support.icompaas.com/compliance/iso-27701-2025/a-1-4-6-de-identification-deletion) - [ISO/IEC 27701:2025 A.1.4.7 — Temporary files disposal](https://support.icompaas.com/compliance/iso-27701-2025/a-1-4-7-temporary-files-disposal) - [ISO/IEC 27701:2025 A.1.4.8 — Retention schedule](https://support.icompaas.com/compliance/iso-27701-2025/a-1-4-8-retention-schedule) - [ISO/IEC 27701:2025 A.1.4.9 — Disposal policies](https://support.icompaas.com/compliance/iso-27701-2025/a-1-4-9-disposal-policies) - [ISO/IEC 27701:2025 A.1.4.10 — PII transmission controls](https://support.icompaas.com/compliance/iso-27701-2025/a-1-4-10-pii-transmission-controls) ### PII sharing, transfer & disclosure ISO/IEC 27701:2025 PIMS Controls - [ISO/IEC 27701:2025 A.1.5.2 — Basis for transfer](https://support.icompaas.com/compliance/iso-27701-2025/a-1-5-2-basis-for-transfer) - [ISO/IEC 27701:2025 A.1.5.3 — Countries to which PII transferred](https://support.icompaas.com/compliance/iso-27701-2025/a-1-5-3-countries-to-which-pii-transferred) - [ISO/IEC 27701:2025 A.1.5.4 — Records of transfer](https://support.icompaas.com/compliance/iso-27701-2025/a-1-5-4-records-of-transfer) - [ISO/IEC 27701:2025 A.1.5.5 — Records of disclosures](https://support.icompaas.com/compliance/iso-27701-2025/a-1-5-5-records-of-disclosures) ### Conditions for collection and processing (processors) ISO/IEC 27701:2025 PIMS Controls - [ISO/IEC 27701:2025 A.2.2.2 — Customer agreement](https://support.icompaas.com/compliance/iso-27701-2025/a-2-2-2-customer-agreement) - [ISO/IEC 27701:2025 A.2.2.3 — Organization's purposes](https://support.icompaas.com/compliance/iso-27701-2025/a-2-2-3-organization-s-purposes) - [ISO/IEC 27701:2025 A.2.2.4 — Marketing & advertising use](https://support.icompaas.com/compliance/iso-27701-2025/a-2-2-4-marketing-advertising-use) - [ISO/IEC 27701:2025 A.2.2.5 — Infringing instruction](https://support.icompaas.com/compliance/iso-27701-2025/a-2-2-5-infringing-instruction) - [ISO/IEC 27701:2025 A.2.2.6 — Customer obligations](https://support.icompaas.com/compliance/iso-27701-2025/a-2-2-6-customer-obligations) - [ISO/IEC 27701:2025 A.2.2.7 — Records related to processing PII](https://support.icompaas.com/compliance/iso-27701-2025/a-2-2-7-records-related-to-processing-pii) ### Obligations to PII principals (processors) ISO/IEC 27701:2025 PIMS Controls - [ISO/IEC 27701:2025 A.2.3.2 — Comply with obligations](https://support.icompaas.com/compliance/iso-27701-2025/a-2-3-2-comply-with-obligations) ### Privacy by design / default (processors) ISO/IEC 27701:2025 PIMS Controls - [ISO/IEC 27701:2025 A.2.4.2 — Temporary files disposal](https://support.icompaas.com/compliance/iso-27701-2025/a-2-4-2-temporary-files-disposal) - [ISO/IEC 27701:2025 A.2.4.3 — Return/transfer/disposal](https://support.icompaas.com/compliance/iso-27701-2025/a-2-4-3-return-transfer-disposal) - [ISO/IEC 27701:2025 A.2.4.4 — PII transmission controls](https://support.icompaas.com/compliance/iso-27701-2025/a-2-4-4-pii-transmission-controls) ### PII sharing, transfer & disclosure (processors) ISO/IEC 27701:2025 PIMS Controls - [ISO/IEC 27701:2025 A.2.5.2 — Basis for transfer](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-2-basis-for-transfer) - [ISO/IEC 27701:2025 A.2.5.3 — Countries to which PII transferred](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-3-countries-to-which-pii-transferred) - [ISO/IEC 27701:2025 A.2.5.4 — Records of PII disclosures](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-4-records-of-pii-disclosures) - [ISO/IEC 27701:2025 A.2.5.5 — Notification of requests](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-5-notification-of-requests) - [ISO/IEC 27701:2025 A.2.5.6 — Legally binding disclosures](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-6-legally-binding-disclosures) - [ISO/IEC 27701:2025 A.2.5.7 — Disclosure of subcontractors](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-7-disclosure-of-subcontractors) - [ISO/IEC 27701:2025 A.2.5.8 — Engagement of subcontractor](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-8-engagement-of-subcontractor) - [ISO/IEC 27701:2025 A.2.5.9 — Change of subcontractor](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-9-change-of-subcontractor) ### Security considerations (controllers/processors) ISO/IEC 27701:2025 PIMS Controls - [ISO/IEC 27701:2025 A.3.3 — Information security policies](https://support.icompaas.com/compliance/iso-27701-2025/a-3-3-information-security-policies) ### Security considerations ISO/IEC 27701:2025 PIMS Controls - [ISO/IEC 27701:2025 A.3.4 — Information security roles & responsibilities](https://support.icompaas.com/compliance/iso-27701-2025/a-3-4-information-security-roles-responsibilities) - [ISO/IEC 27701:2025 A.3.5 — Classification of information](https://support.icompaas.com/compliance/iso-27701-2025/a-3-5-classification-of-information) - [ISO/IEC 27701:2025 A.3.6 — Labelling of information](https://support.icompaas.com/compliance/iso-27701-2025/a-3-6-labelling-of-information) - [ISO/IEC 27701:2025 A.3.7 — Information transfer](https://support.icompaas.com/compliance/iso-27701-2025/a-3-7-information-transfer) - [ISO/IEC 27701:2025 A.3.8 — Identity management](https://support.icompaas.com/compliance/iso-27701-2025/a-3-8-identity-management) - [ISO/IEC 27701:2025 A.3.9 — Access rights](https://support.icompaas.com/compliance/iso-27701-2025/a-3-9-access-rights) - [ISO/IEC 27701:2025 A.3.10 — Supplier agreements](https://support.icompaas.com/compliance/iso-27701-2025/a-3-10-supplier-agreements) - [ISO/IEC 27701:2025 A.3.11 — Incident management planning](https://support.icompaas.com/compliance/iso-27701-2025/a-3-11-incident-management-planning) - [ISO/IEC 27701:2025 A.3.12 — Response to incidents](https://support.icompaas.com/compliance/iso-27701-2025/a-3-12-response-to-incidents) - [ISO/IEC 27701:2025 A.3.13 — Legal, statutory, regulatory & contractual reqs](https://support.icompaas.com/compliance/iso-27701-2025/a-3-13-legal-statutory-regulatory-contractual-reqs) - [ISO/IEC 27701:2025 A.3.14 — Protection of records](https://support.icompaas.com/compliance/iso-27701-2025/a-3-14-protection-of-records) - [ISO/IEC 27701:2025 A.3.15 — Independent review](https://support.icompaas.com/compliance/iso-27701-2025/a-3-15-independent-review) - [ISO/IEC 27701:2025 A.3.16 — Compliance with policies](https://support.icompaas.com/compliance/iso-27701-2025/a-3-16-compliance-with-policies) - [ISO/IEC 27701:2025 A.3.17 — Info security awareness & training](https://support.icompaas.com/compliance/iso-27701-2025/a-3-17-info-security-awareness-training) - [ISO/IEC 27701:2025 A.3.18 — Confidentiality agreements](https://support.icompaas.com/compliance/iso-27701-2025/a-3-18-confidentiality-agreements) - [ISO/IEC 27701:2025 A.3.19 — Clear desk & screen](https://support.icompaas.com/compliance/iso-27701-2025/a-3-19-clear-desk-screen) - [ISO/IEC 27701:2025 A.3.20 — Storage media](https://support.icompaas.com/compliance/iso-27701-2025/a-3-20-storage-media) - [ISO/IEC 27701:2025 A.3.21 — Secure disposal / re-use](https://support.icompaas.com/compliance/iso-27701-2025/a-3-21-secure-disposal-re-use) - [ISO/IEC 27701:2025 A.3.22 — User endpoint devices](https://support.icompaas.com/compliance/iso-27701-2025/a-3-22-user-endpoint-devices) - [ISO/IEC 27701:2025 A.3.23 — Secure authentication](https://support.icompaas.com/compliance/iso-27701-2025/a-3-23-secure-authentication) - [ISO/IEC 27701:2025 A.3.24 — Information backup](https://support.icompaas.com/compliance/iso-27701-2025/a-3-24-information-backup) - [ISO/IEC 27701:2025 A.3.25 — Logging](https://support.icompaas.com/compliance/iso-27701-2025/a-3-25-logging) - [ISO/IEC 27701:2025 A.3.26 — Use of cryptography](https://support.icompaas.com/compliance/iso-27701-2025/a-3-26-use-of-cryptography) - [ISO/IEC 27701:2025 A.3.27 — Secure development life cycle](https://support.icompaas.com/compliance/iso-27701-2025/a-3-27-secure-development-life-cycle) - [ISO/IEC 27701:2025 A.3.28 — Application security requirements](https://support.icompaas.com/compliance/iso-27701-2025/a-3-28-application-security-requirements) - [ISO/IEC 27701:2025 A.3.29 — Secure system architecture](https://support.icompaas.com/compliance/iso-27701-2025/a-3-29-secure-system-architecture) - [ISO/IEC 27701:2025 A.3.30 — Outsourced development](https://support.icompaas.com/compliance/iso-27701-2025/a-3-30-outsourced-development) - [ISO/IEC 27701:2025 A.3.31 — Test information](https://support.icompaas.com/compliance/iso-27701-2025/a-3-31-test-information)