01 · 1980s–2018
Privacy accountability develops
Data-protection law and information-security practice increasingly required organisations to evidence how personal information is governed.
ASSURANCE DNA · PRIVACY INFORMATION MANAGEMENT
ISO/IEC 27701
A privacy information management system for making controller and processor accountability, processing purposes, risks, rights and evidence governable.
Why is each item of personal information processed, by whom, for how long and with what accountable control?
REFERENCEISO/IEC 27701:2025, edition 2CURRENT STATE · 21 AUG 2026Published October 2025 as a privacy information management system standard for controllers and processors.BID ENTRYQualify · Model · Story · Evidence · Mobilise · Measure
It does not create a lawful basis, override data-protection law or prove that a particular processing operation is fair and lawful. Source-bounded interpretation: no certification, protected text reproduction or award prediction.
LIVING EXPERIMENT · TRAIL
The Personal-Data Trail
Personal-data purposes, transfers, retention and rights form a visible journey. Unnecessary collection lengthens the trail; controlled deletion closes it.
MODEL STATESME · SENSE · APPLYDeterministic teaching model · no award prediction
ORIGIN × EVOLUTION × CURRENT PRACTICE
Why this reference exists—and what changed.
Digital, health, financial, HR, education, public-service and outsourcing organisations processing personal information.
02 · 2019
First edition as an extension
ISO/IEC 27701 extended ISO/IEC 27001 and 27002 for privacy information management.
03 · 2022–2024
Independent-system revision
Revision work responded to wider adoption and the need for a more standalone management-system structure.
04 · 2025
Second edition published
ISO/IEC 27701:2025 became a dedicated PIMS requirements-and-guidance standard for controllers and processors.
A PIMS does not itself establish a lawful basis or satisfy every jurisdiction. Contract, role, data category and applicable law still require qualified verification.
OFFICIAL SOURCE FRESHNESS MONITOR
SOURCE CHECK PENDING
Monthly official-source reachability and change review.
LAST SOURCE CHECKloading…
What this date means
The check records source reachability and a content fingerprint. It does not silently change the page or claim that an edition changed.
PUBLICLY DESCRIBABLE ANATOMY
Every domain gets a specific bid-management translation.
These are navigational interpretations, not substitute clauses. Use the official publication for normative wording.
- 01
Privacy context, scope and governance
Define the PIMS boundary around actual people, purposes, data, systems, jurisdictions and delivery parties.
- Evidence object
- Contract privacy scope and data inventory
- Decision test
- Does scope include test, migration, support, analytics and deletion?
- 02
Controller and processor role definition
State whether each party is controller, joint controller or processor for each operation.
- Evidence object
- Role and responsibility matrix
- Decision test
- Do contract terms match the real decision rights over purpose and means?
- 03
Privacy risk and impact assessment
Assess privacy impact, affected people, necessity and residual risk before solution lock-in.
- Evidence object
- DPIA and risk-treatment record
- Decision test
- Can the team explain who may be harmed and how design prevents it?
- 04
Purpose, lawful handling and minimisation
Tie every data item to purpose, authority, minimisation, transparency and retention.
- Evidence object
- Purpose–data–retention matrix
- Decision test
- What data can be removed without preventing the buyer outcome?
- 05
Supplier, transfer, retention and rights controls
Control suppliers, transfers, rights handling, disclosure, retention and deletion.
- Evidence object
- Processing schedule and supplier assurance pack
- Decision test
- Can a person’s data be found, corrected, exported or deleted across every supplier?
- 06
Incident, monitoring, audit and review
Plan incident response, monitoring, audit and management review around privacy outcomes.
- Evidence object
- Privacy operations and assurance calendar
- Decision test
- Would monitoring detect misuse and rights failure, not only security breach?
- 07
Correction and continual improvement
Correct processing and governance failures, then update design and future bids.
- Evidence object
- Privacy corrective-action and design decision
- Decision test
- Did a complaint or incident reduce recurrence at source?
BEFORE × INTERVENTION × AFTER
Worked case · employment-support analytics
A fictional service combines claimant, employer and caseworker data with automated prioritisation and two processors.
A worked accountability model, not legal advice or a claim of lawful processing.
What the team can observe
The draft says “GDPR compliant” but cannot separate controller decisions, purpose, model inputs, retention or cross-border support access.
What changes in the operating system
The team maps 23 processing operations, assigns roles, tests necessity, reduces fields, defines retention and builds rights and supplier evidence routes.
The bid replaces one compliance claim with a processing schedule, DPIA decisions and operating controls that can be accepted during mobilisation.
PROPORTIONATE IMPLEMENTATION
Scale the control—not the integrity of the decision.
It does not create a lawful basis, override data-protection law or prove that a particular processing operation is fair and lawful.
WORKED CASEISO-27701–01Teaching scenario · no claimed outcome
Keep a small processing record, DPIA decision, retention schedule and supplier checklist.
Data map, lawful-basis note, deletion proof
Resolve roles and processing purpose before pricing architecture and contracts.
Role matrix, DPIA, processing schedule
Integrate PIMS, ISMS, legal, product and supplier evidence with contract operations.
Rights logs, audit, management review
SOURCE TRAIL · REVIEWED 21 AUG 2026
Trace each interpretation to its authority.
Publication status can change. Exact conformity questions belong with the current licensed publication and competent assurance.