ISO 27701 Certification — Privacy Information Management System (PIMS)
ISO 27701 adds privacy to information security. It defines a Privacy Information Management System (PIMS) with specific controls for organisations acting as personal-data controllers and processors, and maps closely to UK GDPR, EU GDPR and other privacy laws.
For SaaS providers and processors, it is the most recognised way to prove privacy maturity to enterprise customers. Mutex Systems builds the PIMS alongside ISO 27001 so both can be audited together.
- Category
- Compliance Framework
- Jurisdiction
- International
- Issuing Body
- ISO / IEC
- Current Version
- ISO/IEC 27701 — the 2025 revision makes it a standalone privacy management system standard
- Who It's For
- Organisations processing personal data at scale — SaaS, healthcare, fintech, HR and marketing platforms — and processors who need to evidence GDPR Article 28 obligations.
Core Domains
A Practical Compliance Path
- 01
Privacy gap analysis
Assess current practice against ISO 27701 controls and GDPR obligations.
- 02
Data mapping
Build records of processing and identify high-risk processing needing DPIAs.
- 03
PIMS implementation
Policies, procedures and controls for your controller and processor roles.
- 04
Certification audit
Combined ISO 27001 and 27701 audit with your certification body.
One audit, two certificates
We design ISO 27001 and ISO 27701 as one management system so evidence, internal audits and management reviews serve both.
- GDPR-to-27701 mapping
- DPIA templates and processor clauses
- Joint internal audit programme
Privacy controls next to security controls
grComply holds ISO 27701 with ISO 27001 and UK GDPR, so a single DPIA, processing record or breach log satisfies all three.
- Records of processing and DPIAs tracked as evidence
- Breach log with 72-hour ICO deadline
- Cross-mapping 27701 ↔ 27001 ↔ GDPR
- Sub-processor review reminders
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About ISO 27701
Do I need ISO 27001 before ISO 27701?
Historically ISO 27701 was an extension that could only be certified together with ISO 27001. The 2025 revision allows it to stand alone, but most organisations still implement both because the security controls underpin privacy.
Does ISO 27701 make us GDPR compliant?
Certification does not equal legal compliance, but ISO 27701 controls map directly to GDPR requirements and provide strong, independently audited evidence of how you meet them.
Who should get ISO 27701?
Organisations that process personal data on behalf of others (processors), especially SaaS and outsourcing providers, and controllers that want to demonstrate privacy maturity to customers and regulators.
Ready to Start Your ISO 27701 Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.