Skip to content
Audit-Checklist

PIMS · ISO Standards

ISO 27701 PIMS: how to extend ISO 27001 without a second fake ISMS

How privacy teams add ISO/IEC 27701 to an existing ISO 27001 ISMS — PII roles, processors vs controllers, and what certification audits sample.

6 min read

ISO/IEC 27701 extends ISO/IEC 27001 and 27002 with privacy information management controls. It is strongest when an organization already has an ISMS and wants privacy governance, PII processing roles, and control evidence to sit inside the same management-system rhythm.

The checklist helps execution, but the guide handles classification and judgment: whether the organization is a PII controller, processor, or both; which annexes apply; how privacy notices connect to actual processing; and how analytics, support, and subprocessors are governed.

In 2026, buyers often ask for 27701 because privacy assurance is easier to review when it is tied to a familiar ISO audit. That commercial value does not turn 27701 into a privacy-law substitute, and it does not work well when bolted onto an absent or weak 27001 program. For 27701, the guide should force privacy and security teams to reconcile their views of the same processing. The ISMS may know assets and risks, while privacy knows purposes, roles, notices, rights, and retention. The PIMS is where those facts need to meet. A controller activity needs evidence for purpose, transparency, lawful handling, rights, and retention; a processor activity needs evidence for customer instructions, subprocessor controls, confidentiality, return, deletion, and assistance. Analytics is a useful stress test because it often blurs product improvement, customer instructions, user notice, and data minimization. The paired checklist should turn those blurred areas into explicit decisions and records. A useful way to read the rest of this guide is to separate evidence from judgment. Evidence shows that an activity happened: a review, record, test, approval, training, scan, exercise, assessment, or decision. Judgment explains why the activity was scoped that way, why the risk treatment is proportionate, why an exception is acceptable, and what would cause the decision to change. The paired checklist should collect evidence and owners, while the guide should help teams avoid false certainty. For each topic, ask what a knowledgeable reviewer would challenge after seeing the first answer. They may ask whether the scope matches production, whether suppliers are included, whether recurring work is current, whether leadership approved trade-offs, and whether public or customer-facing claims match operations. That second layer is where preparation becomes credible. It also keeps teams from overclaiming, because a documented limitation with a plan is usually stronger than a broad statement no one can support.

What ISO 27701 actually is

ISO 27701 is a privacy extension to an ISO 27001 information security management system. It adds PIMS requirements and guidance for managing PII, including role-specific controls for controllers and processors. The certification context usually depends on the underlying 27001 certification scope.

The controller and processor distinction is central. A SaaS provider may be a processor for customer content, a controller for employee and marketing data, and sometimes a separate controller for product analytics. The annex selection and evidence need to reflect those real roles.

A PIMS should connect inventories, risk assessments, privacy notices, contracts, data-subject request handling, retention, supplier oversight, and security controls. If those artifacts live in separate teams with different assumptions, the audit will expose the split.

Decisions the checklist will not make for you

The checklist cannot decide your PII role for every processing activity. Legal, privacy, product, sales, HR, and security teams need to classify processing based on purpose, instructions, customer agreements, and local law.

It also cannot decide whether a planned 27701 project is viable without 27001. If the ISMS is not implemented, scoped, audited, and maintained, the privacy extension has no stable management-system base to extend.

The checklist cannot determine whether notices match behavior. Privacy teams must compare public statements to analytics tools, training data use, subprocessors, support access, retention, and customer configuration options.

Where privacy teams actually fail

The first failure is pursuing 27701 without a functioning 27001 ISMS. Teams write privacy procedures, but management review, internal audit, risk treatment, objectives, competence, and corrective action are weak. The PIMS then floats outside the system it is supposed to extend.

The second failure is choosing the wrong annex or applying only the easier one. A company may act as both controller and processor, but prepare evidence for only one role. Auditors sample contracts and processing records to test that claim.

A third failure is treating notices as proof. A notice can say analytics is limited, but product telemetry, experimentation tools, support access, and retention settings must match. Notices do not govern data by themselves.

How to use the paired checklist

Begin by confirming the ISO 27001 scope and the PIMS scope. Then map processing activities, PII categories, purposes, roles, systems, subprocessors, retention rules, transfer mechanisms, and request workflows before scoring controls.

Use the checklist to link every privacy control to an owner and artifact. Examples include ROPA entries, DPAs, subprocessor reviews, data-subject request logs, retention schedules, privacy risk assessments, notices, training, and management-review inputs.

Before the certification audit, test a few real processing flows from collection through deletion. The paired checklist should help you prove that policy, contract, product behavior, and security controls agree.

What teams get wrong

ISO 27701 can stand alone without ISO 27001.
27701 is designed as an extension to an ISMS. Without a functioning 27001 base, the privacy management system lacks the structure auditors expect.
One privacy role applies to the whole company.
Organizations can be controllers for some processing and processors for other processing. Annex selection and evidence should follow each activity.
A privacy notice proves the PIMS is implemented.
Notices must match actual analytics, support access, retention, subprocessors, and request handling. Auditors look beyond published language.

When the checklist is enough — and when it is not

  • Use the checklist to organize PIMS scope, role mapping, processing records, and audit evidence.
  • Ask a certification body or ISO advisor when 27001 dependency, scope, annex selection, or audit sequencing is unclear.
  • Ask counsel when controller or processor status, notices, DPAs, transfers, data-subject rights, or regulatory duties are involved.
  • Treat this guide as practical orientation, not official ISO text; use the licensed standards and certification-body instructions for authoritative wording.

Related checklists

Related field notes

The checklists and field notes provided on this website are for educational and informational purposes only. They do not constitute legal, financial, or professional advice. Completing a checklist does not guarantee compliance, certification, or immunity from audits. Always consult with a certified auditor or legal counsel for your specific organizational needs. Full disclaimer