On 14 October 2025, ISO published the second edition of ISO/IEC 27701 and withdrew the first edition the same day. This was not a refresh. The standard that existed on 13 October could only be used by an organisation already running an ISO 27001 ISMS. The standard that replaced it can be certified on its own.
Most published advice still describes the withdrawn edition. If you have been told that privacy certification means building an information security management system first, that advice is a year out of date.
What ISO actually changed
The current standard is ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection - Privacy information management systems - Requirements and guidance. Edition 2, 64 pages.
ISO's Foreword states the change without ambiguity:
This second edition cancels and replaces the first edition (ISO/IEC 27701:2019), which has been technically revised. The main changes are as follows: - the document has been redrafted as a stand-alone management system standard.
The first edition was titled Security techniques - Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management - Requirements and guidelines. Its title said exactly what it was. It reached withdrawn status on 14 October 2025.
Why this is decisive rather than cosmetic
"Stand-alone" in a foreword could be read as positioning. It is not, and the structure of the document proves it.
Clause 2 of any management system standard lists its normative references: the documents you cannot conform to the standard without. In ISO/IEC 27701:2025, Clause 2 lists exactly one, ISO/IEC 29100. ISO 27001 is not there. Neither is ISO 27002. The two standards the previous edition was built on top of are not normatively referenced at all.
That single fact settles the question. A normative reference is the mechanism by which one standard makes another mandatory. Remove it and the dependency is gone.
The clause structure confirms it. The 2019 edition carried clauses headed "PIMS-specific requirements related to ISO/IEC 27001" - the machinery that grafted privacy onto someone else's management system. Those clauses are gone. Clauses 5 and 6 are now Leadership and Planning. The document carries its own Harmonized Structure clauses 4 to 10, Context through Improvement, plus a Clause 11. That is the anatomy of a management system standard in its own right, not a bolt-on.
ISO's own catalogue FAQ puts it plainly: "Can ISO/IEC 27701 be used alone? Yes, as it is an independent management system standard (MSS)."
And where the document does discuss ISO 27001, read the verb. Introduction 0.2 says the standard "enables an organization to align or integrate" its PIMS with other management system standards "and in particular with the information security management system specified in ISO/IEC 27001." Align or integrate. Enables. That is an option offered to you, not a condition imposed on you.
What this means commercially
You can now certify a privacy management system without holding ISO 27001.
For a lot of organisations that is the whole story. Privacy used to be gated behind a security programme. If a customer, a regulator or a board wanted demonstrable privacy governance, the honest answer under the old edition was that you had to build and certify an ISMS first, then extend it. For an organisation whose exposure is genuinely about personal data - a marketing business, a health data platform, an HR or payroll provider - that meant funding a security certification to reach a privacy objective.
That gate is gone. A PIMS is now something you scope, build and certify against the risk you actually have.
This cuts the other way too, and it is worth being straight about it. If your ISMS was the thing carrying your privacy story, the PIMS no longer inherits from it automatically. It is its own management system, with its own clause 4 to 10 obligations: its own scope, leadership commitment, objectives, competence, internal audit and management review. They can be run alongside the ones you have. They still have to exist.
What did not change
Annex D still maps the standard to the GDPR. It is informative rather than normative, and it did not survive by accident - that mapping is why a great many organisations opened the document in the first place.
Because certificates get oversold, one thing is worth stating flatly: a mapping is a mapping. ISO 27701 confers no presumption of conformity with the GDPR and no legal safe harbour. It gives you a management system and an argued correspondence to the regulation. Your lawful basis remains a legal position, not a certified one.
The full annex set is worth knowing. A and B are normative - A carries the PIMS reference control objectives and controls for PII controllers and processors, B the implementation guidance. C maps to ISO/IEC 29100, D to the GDPR, E to ISO/IEC 27018 and ISO/IEC 29151, and F gives correspondence with the 2019 edition. If you are moving off the old edition, F is where to start.
One structural change sits inside that list. The 2019 split of Annex A for controllers and Annex B for processors is gone, merged into a single Annex A: table A.1 for controller controls, A.2 for processor controls, A.3 for shared security controls. Most SaaS companies are both, depending on the data flow, and one annex reflects that better than two you had to read and reconcile.
If you already hold ISO 27001
None of this makes ISO 27001 less useful. It makes the relationship voluntary rather than structural.
Both standards are built on the Harmonized Structure, so their clauses 4 to 10 line up: context, leadership, planning, support, operation, performance evaluation, improvement. That is why the two can be run as one governance cycle and audited together - one management review, one internal audit programme, one set of objectives covering both systems, if you scope it that way.
The distinction to hold onto is overlap, not prerequisite. A mature ISMS makes a PIMS cheaper to build. It does not make it a precondition, and an organisation without one is no longer locked out.
The transition, and who moves when
Organisations certified against ISO/IEC 27701:2019 converge on 31 October 2028.
Certification bodies are on a different clock, and there is no single global date - the deadline depends on the accreditation body. ANAB-accredited bodies work to 31 October 2026. UKAS-accredited bodies work to 31 October 2027. So if you hold a 2019 certificate, the question for your CB is not "when is the deadline" but "who accredits you, and what is your date". That answer determines how long your auditor can still work against the old edition.
Certification is real, not theoretical
A management system standard only becomes certifiable once there is a standard governing the bodies that certify against it. ISO/IEC 27706:2025, "Requirements for bodies providing audit and certification of privacy information management systems", was published the same month as the new edition. The accreditation apparatus exists.
So do the certification bodies. SGS and Schellman both hold ANAB accreditation for it. This is not a standard waiting on infrastructure to catch up.
Where Kellwick fits
Kellwick builds and evidences management systems. We help you scope a PIMS, decide honestly whether to run it on its own or integrate it with an ISMS you already have, and get it to a state a certification body will pass. We do not give legal advice - whether a lawful basis holds, or a transfer mechanism is valid for a specific data flow, is a question for a data protection lawyer rather than an auditor.
If privacy is your real exposure, you are no longer required to buy a security certification to get to it. See GDPR and privacy support, or ISO 27001 certification if the two belong together in your case.
Not sure what applies to you?
Applicability first: DORA, NIS2, NIST CSF 2.0, SOC 2 or CMMC, read against your sector and jurisdiction.