ISO/IEC 27701 used to be an add-on: you could only certify it on top of an ISO 27001 information security management system. The 2025 edition changes that. For organizations that need to demonstrate privacy compliance, including under Quebec’s Law 25, it opens a cleaner path.
What changed
ISO published the second edition, ISO/IEC 27701:2025, on 2025-10-14, titled Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance. Asked whether it can be used alone, ISO answers: “Yes, as it is an independent management system standard” (ISO).
In practice, an organization can now implement and certify a privacy information management system (PIMS) without first holding ISO 27001. Assessors and certification firms have been publishing guidance on the transition (Schellman; Coalfire).
Who benefits
- Organizations whose main risk is privacy, not security: marketing, HR and research services, healthcare and education providers, and SaaS vendors that process personal information on behalf of clients.
- Controllers and processors: the standard covers both roles, which suits service providers whose clients ask for evidence of compliant processing.
- Organizations already certified to ISO 27001: they can still integrate the two, and gain a privacy certificate that clients and regulators recognize.
How it maps to Law 25
A certificate is not legal compliance, but a PIMS gives structure to many of Law 25’s duties under the private sector act (LégisQuébec):
- governance and a person in charge of the protection of personal information;
- policies and practices for the governance of personal information;
- privacy impact assessments, including before transfers outside Quebec;
- a confidentiality incident register and response process;
- retention and destruction rules, and handling of individuals’ requests.
Already certified to the 2019 edition?
Certificates against ISO/IEC 27701:2019 will need to move to the 2025 edition. Ask your certification body for its transition timeline and plan the update into your next surveillance or recertification audit.
Where to start
- Map your personal information: what, where, why, who has access and how long you keep it.
- Decide your role for each processing activity: controller, processor or both.
- Gap-assess against ISO/IEC 27701:2025 and Law 25 together.
- Decide whether to certify 27701 alone or integrated with ISO 27001.
Accel GRC maps Law 25, ISO 27701 and ISO 27001 controls together, and KW Consulting supports certification readiness. Contact us.
Sources
Does this apply to you? A free 30-minute consult maps the requirement to your systems and tells you what to do next.
Book a free consult