In short
ISO/IEC 27701:2025, published in October 2025, makes the privacy information management system (PIMS) a standalone management system. ISO/IEC 27001 certification is no longer a prerequisite. Certificates against the 2019 edition must transition: published guidance points to October 2028 as the end of their validity, with transition audits due before then.
What changed in the 2025 edition?
The 2019 edition was an extension. Its requirements were written as additions to ISO/IEC 27001 and ISO/IEC 27002, so certification depended on an information security management system (ISMS).
The 2025 edition carries its own management system clauses, in the same structure as other ISO management system standards, so a PIMS can be certified on its own. The controls for PII controllers and PII processors are retained. ISO/IEC 27706, published alongside it, sets requirements for the bodies that certify a PIMS.
Do you still need ISO 27001?
Not for certification. If you already hold ISO/IEC 27001, an integrated system is usually the shorter path: risk assessment, internal audit, management review and corrective action can serve both standards, and the auditor can assess them in one visit.
What are the transition dates?
The 2025 edition was published on 14 October 2025. Guidance from certification bodies consistently points to 31 October 2028 as the date 2019-edition certificates stop being valid. Some certification bodies ask for transition audits to finish months earlier: A-LIGN, for example, asks clients to complete them by 30 June 2028.
Certification bodies must first be accredited to the new edition, and the published dates for that step differ. Confirm the timetable with your own certification body.
How to plan the move
- Run a gap assessment against the 2025 clauses, especially context, leadership and planning for the PIMS in its own right.
- Decide whether the PIMS stays integrated with the ISMS or is certified on its own, and set its scope.
- Update the PIMS Statement of Applicability to the 2025 controls.
- Book the transition audit, ideally at a planned surveillance or recertification visit.
- In Indonesia, map PIMS records to UU PDP and PP 33/2026 at the same time.
Where Whitesec One fits
The ISO 27701 workspace in Whitesec One follows the 2025 edition: PIMS governance, a privacy risk assessment, a PIMS Statement of Applicability, a DPIA register, and the registers controllers and processors keep. Its PII processor register is the same supplier register ISO 27001 uses, so a supplier is assessed once.
Sources
- ISO 27701:2025 FAQs, Schellman
- What You Need to Know: ISO 27701:2025 Updates, A-LIGN
- ISO 27701:2025 Standalone Certification Guide, ISMS.online
- Transition to ISO 27701:2025. Here's the plan!, Assent Risk Management
Regulation moves. Check the official text before relying on a date or an obligation.