ISO/IEC 27701 Privacy Information Management System

This release is the first international privacy standard that specifies the requirements for a Privacy Information Management System (“PIMS”), a management system for protecting personal data.

ISO/IEC 27701 expands on the requirements and guidance provided by ISO 27001 and its code of practice (ISO 27002), which set out the principles for an Information Security Management System (“ISMS”), a risk-based approach that includes people, processes and technology. 

Organizations which have implemented ISO 27001 will be able to use ISO 27701 to extend their security efforts to cover privacy management, which will help them to demonstrate compliance with data protection laws, such as the GDPR. Instead, organizations without an ISMS can implement ISO 27001 and ISO 27701 together as a single implementation project.