ISO/IEC 27701:2025 changed what ISO 27701 is, and it changed how it is audited. A privacy standard that used to sit on top of ISO 27001 now stands on its own, with a dedicated rulebook for the certification bodies that audit it. Insight Assurance’s ISO practice has transitioned to offer ISO/IEC 27701:2025.

At a glance

2019 edition:

  • Built on top of ISO 27001
  • Certified only alongside an ISO 27001 certificate
  • Audited under a technical specification written for privacy systems built on an ISMS

2025 edition:

  • A standalone management system standard
  • Certified on its own, or together with ISO 27001
  • Audited under its own standard, ISO/IEC 27706:2025

The 2019 edition: an add-on

The 2019 edition of ISO 27701 was an extension to ISO 27001 and ISO 27002. It added privacy-specific requirements and controls to an existing information security management system, and it could only be certified alongside an ISO 27001 certificate.

The 2025 edition: a standalone standard

ISO/IEC 27701:2025 was published on October 14, 2025. It is a standalone management system standard for privacy information management systems (PIMS), with its own requirements in clauses 4 to 10. An organization can be certified to it on its own, or integrate it with ISO 27001 if it holds both.

The audit has its own rulebook

ISO/IEC 27706:2025 replaced the 2021 technical specification and sets requirements for the certification bodies that audit and certify PIMS. It covers competence, impartiality, and how privacy risk management, leadership, and performance monitoring are evaluated.

What this means for an audit

Two things follow from the structure. Which edition an audit is scoped to is worked out between an organization and its certification body, and transition timelines are set by accreditation bodies, so they differ from one to the next. Both are confirmed with the certification body.

What stays the same

Independence. Audit findings are based on objective review of the evidence an organization provides, and certification decisions are based on that evidence. The edition changes the requirements, not the independence of the assessment.

Where Insight Assurance stands

Insight Assurance’s ISO practice has transitioned to offer ISO/IEC 27701:2025.

Same name, different audit.

Questions about ISO/IEC 27701:2025? Contact our team.