ISO 27701 (PIMS)

ISO/IEC 27701 defines a privacy information management system, or PIMS. It requires an organisation to know which personal data it processes, in what capacity, for what purpose and for how long, and to organise the exercise of individuals' rights. It distinguishes the requirements applicable to the controller from those applicable to the processor. Major change: since the version published on 14 October 2025, it is no longer an extension of ISO 27001 but an independent management system standard, certifiable on its own. Note, however, that the CNIL, the French data protection authority, points out that it does not in itself constitute a certification within the meaning of article 42 of the GDPR.