What is it?
ISO/IEC 27701 extends ISO/IEC 27001 (ISMS) and 27002 with privacy-specific requirements and controls, creating a Privacy Information Management System (PIMS). It is the de-facto international standard for demonstrating accountability under GDPR (it maps clause-by-clause to GDPR Articles), with mappings to LGPD (Brazil) and other privacy laws.
How it is structured
- Adapts the ISO 27001 management-system clauses (4–10) with privacy additions.
- Adds two normative annexes of PII-specific controls: Annex A for PII controllers, Annex B for PII processors. (Many organisations are both, for different processing activities.)
- Annex D provides the GDPR mapping; Annexes E and F map to ISO 27018 and ISO 29100.
Why it's worth doing
If you already operate ISO 27001, 27701 is an incremental add — typically 4–8 weeks of incremental effort for a mature ISMS — that gives you a global, externally-audited story for privacy. It satisfies many enterprise buyer privacy questionnaires "out of the box".
GDPR mapping highlights
- Annex A.7.2 → GDPR Art. 6 (lawful basis), Art. 9 (special categories).
- Annex A.7.3 → GDPR Art. 12-22 (data subject rights).
- Annex B.8.5 → GDPR Art. 28 (processor obligations).
- Annex A.7.4 / B.8.4 → GDPR Art. 5(2), 24 (accountability).
Certification
27701 is an extension certificate — it can only be issued in conjunction with a current 27001 certificate. Same audit body, same surveillance cycle.
How iCompaas helps
iCompaas operates an integrated ISMS + PIMS: the same scope/risk/treatment/SoA artefacts are extended with PII processing-activity records, lawful-basis register, DSR workflow, DPIA library, and processor due-diligence questionnaires.