ISO/IEC 27701.

An extension, not a standalone standard

ISO/IEC 27701 does not stand on its own. It is built as an extension to ISO/IEC 27001 and ISO/IEC 27002, which means you cannot certify to it without first having a working information security management system (ISMS). The standard takes the security controls you already operate and layers privacy-specific requirements and guidance on top, turning the ISMS into a Privacy Information Management System (PIMS). For an organisation that already runs ISO 27001, this is an efficient move: you reuse the same governance, the same risk methodology, the same audit cycle, and you extend the scope to cover the handling of personally identifiable information (PII).

That architectural choice is the whole point. Rather than running privacy as a separate programme with its own committees and its own evidence, ISO 27701 lets you certify a single management system that covers both security and privacy. The Statement of Applicability is broadened, the risk assessment now considers privacy risk to individuals and not only risk to the organisation, and the same certification body audits the lot in one engagement.

Controller and processor obligations

ISO 27701 splits its additional requirements along the same line that data protection law draws: between the organisation acting as a controller (deciding why and how PII is processed) and the organisation acting as a processor (handling PII on behalf of someone else). Many organisations are both at once, depending on the dataset, so the standard gives you two sets of guidance and asks you to apply whichever fits each processing activity.

• Controller-side topics include lawful basis and purpose, consent and choice, transparency to individuals, handling data subject requests, records of processing, and obligations when you share PII with third parties.
• Processor-side topics include acting only on documented instructions, supporting the controller with their obligations, managing sub-processors, and returning or deleting PII at the end of a contract.

In practice this is what a privacy team already does under modern data protection regimes, but ISO 27701 organises it into auditable controls with documented evidence, which is exactly what turns a privacy posture into something a third party can verify.

Where it sits next to the GDPR

The most common misreading is that ISO 27701 certification makes you GDPR compliant. It does not, and it is careful not to claim that. The GDPR is law and ISO 27701 is a voluntary management-system standard. What 27701 gives you is a structured, certifiable framework whose controls map closely onto data protection principles, so it is strong evidence of accountability and a good operating backbone. But compliance with a specific legal regime still requires your own legal analysis, your records, and your demonstrable handling of individual rights under that law.

The clean way to run it is to anchor privacy on the same ISMS you use for security, certify the combined system to ISO 27001 plus ISO 27701, and keep your data protection officer and legal team owning the law itself. The standard handles the operating discipline; they handle the interpretation.