# ISO/IEC 27701:2019 — overview

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_overview_iso27701-isoiec-277012019-overview
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [ISO/IEC 27701 (Privacy Information Management)](https://support.icompaas.com/support/solutions/c_gen_iso27701) › [Overview](https://support.icompaas.com/support/solutions/folders/f_gen_cgeniso27701_overview)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

ISO/IEC 27701:2019 · PIMS — extension of ISO/IEC 27001 + 27002

### What is it?

**ISO/IEC 27701** extends ISO/IEC 27001 (ISMS) and 27002 with privacy-specific requirements and controls, creating a **Privacy Information Management System (PIMS)**. It is the de-facto international standard for _demonstrating accountability_ under GDPR (it maps clause-by-clause to GDPR Articles), with mappings to LGPD (Brazil) and other privacy laws.

### How it is structured

-   Adapts the ISO 27001 management-system clauses (4–10) with privacy additions.
-   Adds two normative annexes of **PII-specific controls**: Annex A for **PII controllers**, Annex B for **PII processors**. (Many organisations are both, for different processing activities.)
-   Annex D provides the GDPR mapping; Annexes E and F map to ISO 27018 and ISO 29100.

### Why it's worth doing

If you already operate ISO 27001, 27701 is an incremental add — typically 4–8 weeks of incremental effort for a mature ISMS — that gives you a global, externally-audited story for privacy. It satisfies many enterprise buyer privacy questionnaires "out of the box".

### GDPR mapping highlights

-   Annex A.7.2 → GDPR Art. 6 (lawful basis), Art. 9 (special categories).
-   Annex A.7.3 → GDPR Art. 12-22 (data subject rights).
-   Annex B.8.5 → GDPR Art. 28 (processor obligations).
-   Annex A.7.4 / B.8.4 → GDPR Art. 5(2), 24 (accountability).

### Certification

27701 is an **extension** certificate — it can only be issued in conjunction with a current 27001 certificate. Same audit body, same surveillance cycle.

### How iCompaas helps

iCompaas operates an integrated ISMS + PIMS: the same scope/risk/treatment/SoA artefacts are extended with PII processing-activity records, lawful-basis register, DSR workflow, DPIA library, and processor due-diligence questionnaires.