ISO 27701 no longer depends on ISO 27001.
The privacy information management system. Since October 2025 it is certified independently: you no longer need a prior ISMS.
this is new- Your role for each data flow: controller, processor or both
- Processing inventory: flows, legal bases, retention
- Privacy controls over a built-in security baseline
- Meets Law 1581: 10 and 15 business-day deadlines, RNBD before the SIC
Clauses 4 to 10 are the same across the four standards; this is what goes on top.
Where the standard stands today.
Status of the standard · October 2026
| Document | Status | What it means |
|---|---|---|
| ISO/IEC 27701:2025 | Current since 14 Oct 2025 | Second edition. For the first time it is certifiable independently, without ISO 27001. |
| ISO/IEC 27701:2019 | In transition | It was an ISMS extension. Certificates migrate before October 2028. |
| ISO/IEC 27706:2025 | Guidance | Requirements for bodies that audit and certify a PIMS. |
The change almost nobody has explained
Field noteUntil 2025, ISO 27701 did not exist on its own: it was a privacy annex you could only certify if you already had ISO 27001. That left out many organizations that handle personal data every day and never built an information security system: healthcare, education, BPO, marketing, collections.
The 2025 edition breaks that dependency. You can certify your privacy management system without an ISMS. If your company lives on processing personal data and information security was not your conversation, this is the door that just opened.
Define your role first, or everything else goes wrong
Before looking at a single control you must answer, for each data flow, whether you act as a controller (you decide why and how data is processed) or as a processor (you process it on someone else's behalf). The applicable controls change completely.
And you are usually both: controller of your employees' and customers' data, processor of the data a customer hands you to process. Confusing the two is the most frequent mistake and the costliest to fix later.
How it meets Colombia's Law 1581
Certifying and complying with the law are two different planes. The PIMS shows you manage privacy; the lawfulness of each processing (legal basis, prior, express and informed authorization) remains a legal analysis.
Two Colombian details that get mixed up all the time: the deadlines to answer data subjects are 10 business days for queries and 15 for complaints, not the GDPR's one month. And the database registry before the SIC (RNBD) is not the PIMS processing inventory: the latter is far richer, with flows, roles, legal bases and retention.
What this work looks like inside.
Map your context
Processes, scope and whatever you already have written. Half-finished documents are reused, not discarded.
Measure the gap
Requirement by requirement of ISO/IEC 27701, with four states: compliant, in progress, gap, observation.
Draft and approve
Every document is born as a draft. A person approves it and the approval is recorded, as clause 7.5 requires.
Rehearse the audit
Stage 1 and Stage 2 rehearsals with findings written with criterion, evidence and statement, the way an auditor writes them.
The Ark of ISO's requirement catalogue uses its own curated interpretation of each clause. It never reproduces the literal text of the standard, which belongs to ISO and ICONTEC: to implement you need your licensed copy.
Frequently asked questions
Do I really no longer need ISO 27001?
I hold a 27701:2019 certificate, what do I do?
Does this replace my data processing policy?
Does it apply if I only handle company data, not personal data?
Same base, different catalogue.
All four share clauses 4 to 10. You document the base once and each standard's catalogue goes on top.
Next on the route, on the same base: ISO 14001, ISO 45001, ISO 37001 and ISO 22301. Adding them does not mean rebuilding the system.
Ready to set sail?
The 2026 pilot onboards one company at a time. Leave your email and we will write when your seat opens.