ISO/IEC 27701 — Privacy information management
The stand-alone PIMS standard (October 2025 edition), no longer dependent on ISO/IEC 27001.
- Issued by
- ISO/IEC
- Applies in
- Global standards
- Edition
- 2025
- Area
- Data protection & privacy
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- 5Leadership and privacy policyLeadership
- 6Privacy risk assessment and treatmentPlanning
- 8.2Controller obligations: purpose, consent, rightsOperation
- 8.3Processor obligationsOperation
- 8.4PII transfers and sharingOperation
How Amoreg keeps you on it.
Enable the ISO/IEC 27701 — Privacy information management and add ISO/IEC’s pages as a monitor of your own. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 5 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read ISO/IEC’s pages
- Check the library against 5 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: leadership and privacy policy
- Rule
- ISO/IEC 27701 — Privacy information management, 5
- Area
- Leadership
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- EU General Data Protection RegulationThe data protection regime for controllers and processors established in, or targeting, the EU.European Union · 9 controls
- UK GDPR & Data Protection Act 2018The UK data protection regime after Brexit, with the ICO as supervisory authority.United Kingdom · 9 controls
- Data Protection (Bailiwick of Guernsey) Law, 2017The Bailiwick's GDPR-equivalent law, with EU adequacy.Guernsey · 9 controls
- Data Protection (Jersey) Law 2018Jersey's GDPR-equivalent law and the Data Protection Authority (Jersey) Law 2018 registration regime.Jersey · 9 controls
- Isle of Man GDPR & LED Implementing Regulations 2018The applied GDPR under the Data Protection Act 2018 (Isle of Man).Isle of Man · 9 controls
- Cayman Islands Data Protection ActEight data protection principles modelled on the UK Data Protection Act 1998, in force since 2019.Cayman Islands · 6 controls
Also in Global standards
- FATF RecommendationsThe 40 Recommendations — the international standard every national AML/CFT/CPF regime is measured against.Global · 8 controls
- Wolfsberg Group StandardsIndustry standards for correspondent banking, the CBDDQ/FCCQ questionnaires and effectiveness-based AML programmes.Global · 4 controls
- ISO 37001 — Anti-bribery management systemsRequirements for establishing, implementing and improving an anti-bribery management system.Global · 6 controls
- ISO 37301 — Compliance management systemsThe certifiable standard for a compliance management system across all obligations.Global · 6 controls
- ISO/IEC 27001 — Information security managementThe certifiable ISMS standard; Annex A controls per ISO/IEC 27002:2022.Global · 9 controls
- ISO/IEC 27017 & 27018 — Cloud security and PII in the cloudCloud-specific control guidance and the code of practice for protecting PII in public clouds.Global · 4 controls
Questions
Does Amoreg watch for changes to the ISO/IEC 27701 — Privacy information management?
Enable it and add the issuer’s pages as a monitor of your own. Every publication the Monitor records keeps its source, stage and date.
Can Amoreg check our policies against the ISO/IEC 27701 — Privacy information management?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records 2025. Editions were last verified in August 2026, and the Monitor records new publications as they appear.