SIST EN ISO/IEC 27701:2025
(Main)Information security, cybersecurity and privacy protection - Privacy information management systems - Requirements and guidance (ISO/IEC 27701:2025)
Information security, cybersecurity and privacy protection - Privacy information management systems - Requirements and guidance (ISO/IEC 27701:2025)
This document specifies requirements for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS).
Guidance is also provided to assist in the implementation of the requirements in this document.
This document is intended for personally identifiable information (PII) controllers and PII processors holding responsibility and accountability for PII processing.
This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations.
Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre - Datenschutz-Informationsmanagementsysteme - Anforderungen und Leitlinien (ISO/IEC 27701:2025)
Dieses Dokument legt Anforderungen für die Einrichtung, Umsetzung, Aufrechterhaltung und fortlaufende Verbesserung eines Managementsystems für Datenschutzinformationen (PIMS) fest.
Es wird eine Anleitung bereitgestellt, um die Umsetzung der Anforderungen in diesem Dokument zu unterstützen.
Dieses Dokument ist für verantwortliche Stellen und Auftragsverarbeiter gedacht, die für die Verarbeitung von personenbezogenen Daten verantwortlich und rechenschaftspflichtig sind.
Dieses Dokument ist für alle Arten und Größen von Organisationen, einschließlich öffentlicher und privater Unternehmen, öffentlicher Stellen und gemeinnütziger Organisationen anwendbar.
Sécurité de l'information, cybersécurité et protection de la vie privée - Systèmes de management de la protection de la vie privée - Exigences et recommandations (ISO/IEC 27701:2025)
Le présent document spécifie les exigences relatives à la création, la mise en œuvre, le maintien et l'amélioration continue d'un système de management de la protection de la vie privée (PIMS).
Des recommandations sont également fournies pour faciliter la mise en œuvre des exigences du présent document.
Le présent document s'adresse aux responsables de traitement de données à caractère personnel (DCP) et aux sous-traitants de DCP chargés et responsables du traitement des DCP.
Le présent document s'applique aux organismes de tous types et de toutes tailles, y compris les entreprises publiques et privées, les entités gouvernementales et les organismes à but non lucratif.
Informacijska varnost, kibernetska varnost in varstvo zasebnosti - Sistem vodenja informacij o zasebnosti - Zahteve in smernice (ISO/IEC 27701:2025)
General Information
Relations
Standards Content (Sample)
SLOVENSKI STANDARD
01-december-2025
Nadomešča:
SIST EN ISO/IEC 27701:2021
Informacijska varnost, kibernetska varnost in varstvo zasebnosti - Sistem vodenja
informacij o zasebnosti - Zahteve in smernice (ISO/IEC 27701:2025)
Information security, cybersecurity and privacy protection - Privacy information
management systems - Requirements and guidance (ISO/IEC 27701:2025)
Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre - Datenschutz-
Informationsmanagementsysteme - Anforderungen und Leitlinien (ISO/IEC 27701:2025)
Sécurité de l'information, cybersécurité et protection de la vie privée - Systèmes de
management de la protection de la vie privée - Exigences et recommandations (ISO/IEC
27701:2025)
Ta slovenski standard je istoveten z: EN ISO/IEC 27701:2025
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EUROPEAN STANDARD EN ISO/IEC 27701
NORME EUROPÉENNE
EUROPÄISCHE NORM
October 2025
ICS 35.030
Supersedes EN ISO/IEC 27701:2021
English version
Information security, cybersecurity and privacy protection
- Privacy information management systems -
Requirements and guidance (ISO/IEC 27701:2025)
Sécurité de l'information, cybersécurité et protection Informationssicherheit, Cybersicherheit und Schutz
de la vie privée - Systèmes de management de la der Privatsphäre - Datenschutz-
protection de la vie privée - Exigences et Informationsmanagementsysteme - Anforderungen
recommandations (ISO/IEC 27701:2025) und Leitlinien (ISO/IEC 27701:2025)
This European Standard was approved by CEN on 4 August 2025.
CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for
giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.
CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2025 CEN/CENELEC All rights of exploitation in any form and by any means
Ref. No. EN ISO/IEC 27701:2025 E
reserved worldwide for CEN national Members and for
CENELEC Members.
Contents Page
European foreword . 3
European foreword
This document (EN ISO/IEC 27701:2025) has been prepared by Technical Committee ISO/IEC JTC 1
"Information technology" in collaboration with Technical Committee CEN-CENELEC/ JTC 13
“Cybersecurity and Data Protection” the secretariat of which is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by April 2026, and conflicting national standards shall be
withdrawn at the latest by April 2026.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN-CENELEC shall not be held responsible for identifying any or all such patent rights.
This document supersedes EN ISO/IEC 27701:2021.
Any feedback and questions on this document should be directed to the users’ national standards
body/national committee. A complete listing of these bodies can be found on the CEN and CENELEC
websites.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of
North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the
United Kingdom.
Endorsement notice
The text of ISO/IEC 27701:2025 has been approved by CEN-CENELEC as EN ISO/IEC 27701:2025
without any modification.
International
Standard
ISO/IEC 27701
Second edition
Information security, cybersecurity
2025-10
and privacy protection — Privacy
information management systems
— Requirements and guidance
Sécurité de l'information, cybersécurité et protection de la vie
privée — Systèmes de management de la protection de la vie
privée — Exigences et recommandations
Reference number
ISO/IEC 27701:2025(en) © ISO/IEC 2025
ISO/IEC 27701:2025(en)
© ISO/IEC 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2025 – All rights reserved
ii
ISO/IEC 27701:2025(en)
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms, definitions and abbreviations . 1
4 Context of the organization . 4
4.1 Understanding the organization and its context .4
4.2 Understanding the needs and expectations of interested parties .5
4.3 Determining the scope of the privacy information management system .5
4.4 Privacy information management system .6
5 Leadership . 6
5.1 Leadership and commitment .6
5.2 Privacy policy .6
5.3 Roles, responsibilities and authorities .7
6 Planning . 7
6.1 Actions to address risks and opportunities .7
6.1.1 General .7
6.1.2 Privacy risk assessment.7
6.1.3 Privacy risk treatment .8
6.2 Privacy objectives and planning to achieve them .9
6.3 Planning of changes .10
7 Support .10
7.1 Resources .10
7.2 Competence .10
7.3 Awareness .10
7.4 Communication .10
7.5 Documented information .11
7.5.1 General .11
7.5.2 Creating and updating documented information .11
7.5.3 Control of documented information .11
8 Operation .12
8.1 Operational planning and control . 12
8.2 Privacy risk assessment . 12
8.3 Privacy risk treatment. 12
9 Performance evaluation .12
9.1 Monitoring, measurement, analysis and evaluation . . 12
9.2 Internal audit . 13
9.2.1 General . 13
9.2.2 Internal audit programme . 13
9.3 Management review .
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.