ISO/IEC 27701 Certification

ISO/IEC 27701 specifies requirements for a privacy information management system (PIMS). Since the 2025 edition it is a standalone management system standard that can be certified on its own or integrated with an ISO/IEC 27001 ISMS.

What is ISO/IEC 27701?

As more processes and transactions move online, the personal data of customers, employees and partners becomes an asset that needs special protection. ISO/IEC 27701 specifies requirements and guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS) for controllers and processors of personal data (PII).

The first edition, ISO/IEC 27701:2019, was designed as an extension of ISO/IEC 27001 and ISO/IEC 27002, so the PIMS scope was tied to the underlying ISMS. The second edition, ISO/IEC 27701:2025, was published on 14 October 2025 and replaces the 2019 edition. It is a standalone management system standard following ISO's Harmonized Structure: organisations can implement it and be certified without having to hold ISO/IEC 27001 certification, while it still integrates easily with an existing ISMS. Organisations certified to the 2019 edition need to transition within the applicable transition period; please contact us for information on the timeline.

Two roles: controller and processor

ISO 27701 distinguishes two roles, in line with the definitions in the GDPR and ISO/IEC 29100:

PII controller: an organisation that, alone or jointly with others, determines the purposes and means of processing personal data. Where several organisations are joint controllers, an agreement allocating responsibilities is needed.
PII processor: an organisation that processes personal data on behalf of the controller and only on the controller's instructions.

One organisation may hold both roles for different activities. For controllers, the standard standardises ways of working and brings transparency to responsibilities; for processors, certification is independent evidence that can give customers greater confidence in how data is handled.

Who it is for and prerequisites

ISO 27701 certification suits any organisation that processes personal data, regardless of size: private companies, state-owned enterprises, public authorities and non-profits. It is particularly valuable for organisations seeking to reduce the financial and legal risks of data breaches, or wishing to show the technical and organisational measures they apply in the context of the GDPR and Vietnam's Law on Personal Data Protection No. 91/2025/QH15 (in force since 1 January 2026).

Under the 2019 edition, the prerequisite is an operating ISMS that meets ISO 27001 – either already certified or in the process of certification. Under the 2025 edition, ISO 27701 can be audited on its own or together with ISO 27001. According to TÜV NORD GROUP, the group's certification body has been accredited for ISO 27701 since 2022.

Benefits for your organisation

Lower breach risk

Control risks to individuals' privacy and strengthen your ability to prevent data leaks.

Evidence of privacy management

Demonstrate commitment, understanding and control over personal data processing to regulators and customers.

Fewer repeat audits

A widely recognised certificate can reduce the need for separate data protection audits by each customer.

Trust across the value chain

Create certainty between parties exchanging data and protect your reputation and competitiveness.

How it works

Enquiry, information on the certification process and quotation
Contract signing and audit scheduling
Understanding your organisation, processing roles and readiness
Audit of the PIMS and reporting of findings
Four-eyes review and certification decision
Issue of the ISO/IEC 27701 certificate
Regular surveillance audits, which can be synchronised with ISO 27001 audits

Frequently asked questions

Do we need ISO 27001 certification before ISO 27701?

Under the 2019 edition, ISO 27701 is an extension of ISO 27001, so an ISMS meeting ISO 27001, certified or being certified, is required. ISO/IEC 27701:2025 is a standalone management system standard, so ISO 27001 certification is no longer a prerequisite. Organisations with an ISMS can still have both standards audited together to avoid duplication.

We hold ISO 27001 from another body. How is ISO 27701 audited?

A separate ISO 27701 audit can be carried out. Under the approach used for the 2019 edition, the ISO 27701 certificate has the same validity as your existing ISO 27001 certificate and the two programmes are synchronised at recertification. With the standalone 2025 edition, the specific certification cycle is agreed during audit planning.

Does ISO 27701 replace compliance with data protection law?

No. ISO 27701 is a management framework that helps you implement and demonstrate data protection measures systematically. Specific obligations under the GDPR or Vietnam's 2025 Law on Personal Data Protection and its implementing regulations still need to be identified and met separately, ideally with the support of legal or data protection specialists.

What is PII?

PII (Personally Identifiable Information) is any information that can identify an individual directly or indirectly, such as name, ID number, phone number, email address or location data. The standard also distinguishes sensitive PII, such as health or financial data, which requires a higher level of protection.

Related services

ISO/IEC 27001 CertificationISO 27001:2022 certification for your information security management system (ISMS) to protect the confidentiality, integrity and availability of data.ISO/IEC 20000-1 CertificationISO 20000-1 certification for your IT service management system (SMS) helps IT service providers demonstrate service quality, reliability and control.ISO 22301 CertificationISO 22301:2019 certification for your business continuity management system (BCMS), confirming that your ability to continue and recover is managed.TISAX® AssessmentTISAX assessment against the VDA ISA catalogue for automotive suppliers: results are TISAX labels exchanged via the ENX platform at carmakers' request.

Talk to our experts

Contact TÜV NORD Vietnam in Hanoi, Ho Chi Minh City or Vung Tau for detailed information on ISO 27701 and a quotation for your organisation.