Management system
Context and scope, leadership and privacy policy, risks and objectives, resources and documentation, operation, evaluation and improvement.
ISO/IEC 27701:2025 · PIMS
Manage privacy as a controller or processor, with a method.
A guided 73-control questionnaire to prepare your privacy information management system: management system requirements, the controls for your role in processing and the security of personal data. Tell us whether you are a controller, a processor or both, and you only see what applies to you.
- 73 controls in 13 sections
- Profile: controller, processor or both
- Mappings to the GDPR, ISO 27001 and ISO 27018
What role does your organization play?Profile question
- PII controllerYou decide why and how data is processed
- PII processorYou process data on behalf of a client
- Management system requirementsCommon to both roles
- Security of personal dataCommon to both roles
73 controls with guidance on how to assess and meet them
13 sections, from PIMS context to privacy incidents
92 mappings to the GDPR
5 languages: English, Spanish, French, Italian and German
What ISO 27701:2025 is
The 2025 edition is a standalone standard: ISO 27001 is no longer a prerequisite.
ISO/IEC 27701 defines a privacy information management system (PIMS). It used to be an extension of ISO 27001. With the 2025 edition it can be implemented on its own, although it still combines well with an ISMS.
Controls for controllers
Purposes and lawful basis, records, information and rights of data subjects, privacy by design and by default, and sharing or transferring data.
Controls for processors
Process according to the client's instructions, help the client meet its obligations, and control sub-processors, transfers and the return of data.
Security of personal data
Security controls applied to personal data and the handling of privacy incidents.
Sources: Regulation (EU) 2016/679 (EUR-Lex)
How Audexa helps
From your role in processing to a plan you can follow.
Assess, fix and keep the evidence in the same place where you manage your other standards.
Assess
Only the controls for your role.
Profile question
Choose controller, processor or both before you start and see how many questions your questionnaire will have.
Guided questionnaire
Yes, Partial, No or Not applicable, with an explanation of how to assess each control.
Applicability with a reason
Record what does not apply and why.
Fix
Findings turned into work.
How to meet each control
Steps, expected evidence, suggested owner, closure criterion and when to review it.
Task plan
Tasks with subtasks, owners and dates, built from your findings.
Risk matrix and policies
Record privacy risks and start from the 8 templates linked to ISO 27701, out of 67 in the library: “Privacy and Data Protection Policy”, “Personal Data Protection Policy for Cloud Services”, “Data Subject Rights Handling Procedure”, “Data Protection Impact Assessment (DPIA) Procedure”, “Personal Data Breach Management and Notification Procedure”, “Procedure for Processors, Sub-processors and Joint Controllers”, “Procedure for Handling Authority Requests and Data Disclosure” and “Data Retention Policy”.
Prove
Evidence organized for the auditor.
Evidence vault
Processing inventory, processing agreements, privacy notices and incident records.
PDF and Excel report
Score, findings and plan for management or to prepare for the external audit.
Re-audit
Assess again and compare progress before the certification body's visit.
Some features depend on your plan and active modules.
Controller, processor or both
Each organization sees the controls for its role.
Management system and security requirements apply to everyone. Controller and processor controls only appear if you tick that role. A SaaS provider that processes its clients' data and also its own staff's data ticks both.
- Controller: purposes, lawful basis, records and rights
- Controller: privacy by design and transfers
- Processor: instructions, client assistance and sub-processors
- Processor: transfers, return of data and transparency
ISO 27701 auditController and processor
61%
Self-assessmentSample data
- Privacy information management system68%
- Controller: purposes and records64%
- Controller: data subject rights57%
- Processor: instructions and sub-processors49%
- Security and privacy incidents72%
Mappings
Reuse what you already have for the GDPR, ISO 27001 or ISO 27018.
ISO 27701 connects with three Audexa frameworks. When coverage is high, the answer arrives as a proposal ("Review it") and a person confirms it. When you create the audit, you see how much your existing work already covers.
- 92 mappings to the GDPR
- 58 mappings to ISO/IEC 27001:2022
- 70 mappings to ISO/IEC 27018
- Not legal equivalences: each one has its rationale and source
ISO 27701 mappings220 pairs
- GDPR92 pairs
- ISO/IEC 2701870 pairs
- ISO/IEC 27001:202258 pairs
How it works
Four steps to prepare your PIMS.
Pick ISO 27701
In New audit, see how much your GDPR, ISO 27001 or ISO 27018 audits already cover.
State your role
Controller, processor or both. The questionnaire adapts to your choice.
Answer with guidance
Decide what applies, answer control by control and get your score and findings.
Fix and re-audit
Assign tasks, gather evidence and measure again before the external audit.
Plans
ISO 27701 is included from the Premium plan.
The Free and Core plans do not include this framework. Pricing depends on your organization's size: we give you a fixed quote in the demo.
Premium
RecommendedFor teams that want the full cycle.
- 10 audits a month
- ISO 27701 plus the other new frameworks
- Policies, evidence, risks and tasks
- The Aude assistant
- 3 users and 200 assets per section
Diamond
For compliance operations without limits.
- Unlimited audits and users
- Everything in Premium
Frequently asked questions
What people usually ask us about ISO 27701.
Do I need ISO 27001 to implement ISO 27701:2025?
No. Since the 2025 edition, ISO/IEC 27701 is a standalone standard. If you already have ISO 27001 you can combine them, and Audexa uses 58 mappings between the two.
What is the difference between a PII controller and a PII processor?
The controller decides why and how data is processed. The processor handles it on behalf of a client and following its instructions. The standard has different controls for each role. In Audexa you choose yours, or both, before you start.
Does Audexa certify us for ISO 27701 or issue the audit report?
No. Certification is issued by an accredited certification body. Audexa helps you prepare with a guided self-assessment, an action plan, evidence and an internal PDF and Excel report.
Does meeting ISO 27701 mean meeting the GDPR?
Not exactly. They are different things, although they overlap a lot. Audexa includes 92 mappings between them to reuse answers, but they are not legal equivalences.
Does the questionnaire reproduce the text of the standard?
No. The text of ISO/IEC 27701 belongs to ISO. Audexa writes its own questions and guidance. For the official text, buy the standard from ISO or your national standards body.
Which languages is it available in?
English, Spanish, French, Italian and German, like every other Audexa framework.
Request a demo
See how you would prepare for ISO 27701 with Audexa.
In a 30-minute demo we walk through the controller and processor profile, the questionnaire, the mappings and the task plan.
- We look at your organization's role in processing.
- We show you how your GDPR and ISO 27001 audits are reused.
- We explain which plan fits your team.