Audit & Certification Services Pty LtdScope Your Certification

ISO management systems

ISO/IEC 27701:2025 explained: privacy certification without ISO 27001

Short answer: yes, you can now certify a privacy program on its own. The 2025 edition of ISO/IEC 27701 is a standalone management system standard. You no longer need ISO/IEC 27001 in place first, although the two still work well together.

What changed from the 2019 edition?

The 2019 edition was an extension to ISO/IEC 27001. It added privacy requirements on top of an information security management system, so it could only be certified alongside ISO/IEC 27001.

The 2025 edition, published in October 2025, stands on its own:

  • Its own management system clauses (4 to 10): context, leadership, planning, support, operation, performance evaluation and improvement, written for privacy.
  • Its own controls: Annex A sets out controls for PII controllers and PII processors, and Annex B gives implementation guidance.
  • One normative reference: ISO/IEC 29100, the privacy framework. It no longer depends on ISO/IEC 27001.
  • Mappings included: to the ISO/IEC 29100 privacy principles, the EU GDPR, ISO/IEC 27018 and ISO/IEC 29151. Annex F maps the 2025 controls back to the 2019 edition.

Who is ISO 27701:2025 for?

Any organisation that handles personal information and wants to show, not just say, how it protects it. That includes:

  • software and cloud providers processing customer data
  • health, education and community services
  • councils and government suppliers asked about privacy in tenders
  • organisations working with international partners that expect GDPR-aligned practice

It applies whether you are a PII controller (you decide why and how personal information is used), a PII processor (you handle it for someone else), or both.

Do we still need ISO 27001?

No, not for certification. If you already hold ISO/IEC 27001, the two share the same management system structure and can be covered in one combined audit, which usually takes less time than two separate audits.

How does ISO 27701 relate to the Australian Privacy Act?

ISO/IEC 27701 is a management system, not a law. It gives you a structured way to run, evidence and improve how you meet your obligations under the Privacy Act and the Australian Privacy Principles. Certification shows your privacy management system works. It does not confirm legal compliance.

What does the certification audit look like?

  1. Application review: we confirm your scope, sites and whether you act as a controller, a processor or both.
  2. Stage 1: we review the design and readiness of your privacy information management system.
  3. Stage 2: we test how your controls operate in practice, using records and interviews.
  4. Independent certification decision: made by a reviewer who did not audit you.
  5. Surveillance and recertification: a surveillance audit in each of years one and two, then recertification in year three.

Key takeaways

  • ISO/IEC 27701:2025 is a standalone privacy standard. ISO/IEC 27001 is no longer a prerequisite.
  • It covers both PII controllers and PII processors, with its own controls.
  • It maps to the GDPR and global privacy principles, which helps with international customers.
  • It can still be audited together with ISO/IEC 27001 in one combined audit.

Discuss your proposed scope

Send us your proposed scope, locations and approximate headcount. We will explain what an ISO/IEC 27701 audit would involve and what evidence to prepare.

Related information:

Sources