Start for free Start for free

ISO 27701

ISO 27701 is an international standard for managing privacy: how a company handles personal data as a controller or processor. It began as a privacy extension to ISO 27001, and its 2025 edition became a standalone standard.

What is ISO 27701?

ISO/IEC 27701 sets requirements for a privacy information management system. That is the set of policies, roles and routines a company uses to handle personal data responsibly.

It is written for both sides of data handling. In ISO's words it is designed for "PII controllers and processors," PII being personally identifiable information. A controller decides why data is used; a processor handles it on the controller's behalf.

How it relates to ISO 27001

The first edition, from 2019, was an extension to ISO 27001 and its companion ISO 27002. It added privacy on top of an existing security program (ANSI).

The second edition, published in October 2025, is an independent management system standard, according to ISO. It still aligns with ISO 27001. ANSI notes it maps to the GDPR and other privacy frameworks.

As of October 2026, some vendors may still hold certificates under the 2019 edition while others move to 2025.

Why it matters to you

ISO 27701 is one of the few outside checks on a vendor's privacy program, not just its security. If a vendor processes your customers' personal data, it gives you something firmer than a privacy policy.

It can also help you answer your own customers. When an enterprise buyer asks how your vendors handle personal data, a certificate with the right scope is a short, credible answer.

It is still not a contract. What the vendor may do with your data is set by the DPA and privacy policy, and those can change.

What to check

  • Ask for the certificate and check whether it names the 2019 or 2025 edition.
  • Read the scope: which products, entities and roles (controller, processor or both).
  • Check the expiry date and the certification body.
  • Confirm the DPA promises match what the certificate implies.
  • If the vendor also holds ISO 27001, check that both certificates cover the same products, since scopes can differ.

How Venpo helps

Venpo monitors your vendors' privacy policies, DPAs and subprocessor lists, and emails you in plain English when they change. The Fine Print Scan also answers how long each vendor keeps data and whether it sells data or uses it for ads.

Start for free

Frequently asked questions

Do I need ISO 27001 to get ISO 27701?

Under the 2019 edition it was built as an extension of ISO 27001. The 2025 edition is a standalone standard, so check the current certification rules with an accredited certification body.

Does ISO 27701 mean a vendor is GDPR compliant?

No. It maps to the GDPR and shows a structured privacy program, but compliance depends on what the vendor actually does and what your DPA says.

Related terms

Security and Compliance ISO 27001 ISO 27001 is an international standard for running an information security management system: the policies, people and processes a company uses to manage security risk. A vendor certified to it has passed an audit by an independent certification body. Laws and Regulations GDPR for US SaaS Companies The GDPR is the EU law on personal data. It can apply to a US SaaS company with no EU office if it offers services to people in the EU or tracks their behavior there, and it sets rules for every vendor that handles that data for you. Vendor Documents Data Processing Agreement (DPA) A data processing agreement (DPA) is a contract that sets the rules for how a vendor handles personal data on your behalf, including security, subprocessors, breach notice and deletion. The GDPR requires one whenever it applies. Comparisons SOC 2 vs ISO 27001 SOC 2 is a US audit report, written by a CPA firm, on how well a vendor's security controls are designed and run. ISO 27001 is an international certification that a vendor runs a managed security program. Both are useful, and SOC 2 gives you more detail to read. AI and Your Data ISO 42001 ISO 42001 is an international standard for managing how a company builds and uses AI. A certificate shows an outside auditor checked the company's AI governance process, not that any AI product is safe. Vendor Documents Privacy Policy A privacy policy is a public page that explains how a company collects, uses, shares and keeps personal data. For a software vendor, it shows what happens to information about you and your team, including AI use, ads and retention.

Sources

Last reviewed