ISO 27001 vs ISO 27701: when mid-market firms should add privacy certification

This page is a buying comparison. It is for operations, IT, and compliance leads at mid-market professional-services firms and SaaS companies that process personal data for customers. One contract, a data-processing agreement, or a security questionnaire names an ISO/IEC 27001 certificate. Another line, often from an EU customer or a US customer sitting under a state privacy law, names ISO/IEC 27701. Sales conversations will offer to "cover privacy" inside the information-security quote. The useful question is a procurement question: which certificate does this cycle have to produce, for which role, and can you show the system behind it.

Those two standards are not the same product, and the privacy standard is not the same product in both editions. ISO/IEC 27001 is the information security management system (ISMS). ISO/IEC 27701 is the privacy information management system (PIMS). The 2019 edition of 27701 was written as an extension to ISO/IEC 27001 and ISO/IEC 27002, and ISO withdrew it on 14 October 2025. The 2025 edition is the published standard. ISO's public page for that edition says it can be used alone, because it is an independent management system standard. Accreditation does not move on the publication date. A certification body can audit only the edition on its live schedule.

The certificate-versus-report fork, when the other artifact is SOC 2, is ISO 27001 vs SOC 2. A NIST CSF 2.0 profile versus an information-security certificate is ISO 27001 vs NIST CSF. Information security versus an AI management certificate is ISO 27001 vs ISO 42001. After you pick the certificate, the request still uses one outbound scope pack. You still verify accreditation for the legal entity and the edition. This page does not invent prices, audit-day counts, accreditation identifiers, or claims about which firms are accredited.

The decision here is narrower: 27001 only this cycle, 27701 added to a 27001 scope you already hold, both certificates together, or a 2025 PIMS certificate without 27001. Then one honest request.

1. What each standard actually is

Skip the clause lecture. Buyers do not award work because they memorized an annex.

ISO/IEC 27001 is the management-system standard for information security. ISO's public page for ISO/IEC 27001:2022 describes requirements for establishing, implementing, maintaining, and continually improving an ISMS. The same page says certification is optional, that a certificate from an accredited body can add confidence for customers, and that you should name the edition, for example certified to ISO/IEC 27001:2022. The edition on that page was published in October 2022. A body can certify it only after its accreditation covers it.

Buyers meet the control decision as a Statement of Applicability: which Annex A controls apply, and why the others do not. The 2022 edition groups that annex into organizational, people, physical, and technological themes. The output is a certificate for a defined scope. ISO's page says conformity means a system to manage risks to the security of data the organization owns or handles, including information entrusted by third parties. Personal data can sit in that system as information. That is an information-security result. It is not a finding that you comply with the GDPR or a US state privacy law, and it is not an ISO/IEC 27701 certificate.

ISO/IEC 27701 is the PIMS standard. Read the edition before you read a blog that still describes only the 2019 model.

ISO/IEC 27701:2019 is edition 1, published in August 2019. ISO's page gives the status as withdrawn, at stage 95.99 on 14 October 2025, and names ISO/IEC 27701:2025 as the revision. The title on that page calls it an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management. The abstract says it specifies a PIMS in the form of that extension, for PII controllers and PII processors processing personally identifiable information within an ISMS. Under that edition, privacy certification was not a free-standing substitute for an information security management system. If a customer or a live accreditation schedule still names 27701:2019, that is the model you are being asked to buy. Withdrawal does not rewrite a contract clause or a schedule that still cites it.

ISO/IEC 27701:2025 is edition 2. ISO's lifecycle on that page dates publication (stage 60.60) to 14 October 2025, the same day the 2019 edition was withdrawn. ISO's page says it sets requirements for establishing, implementing, maintaining, and continually improving a PIMS, plus guidance, for PII controllers and processors who hold responsibility and accountability for processing personally identifiable information. Any organization that collects, processes, stores, or controls that information may use it. One listed benefit is alignment with existing ISO/IEC 27001 systems. Another is that it helps demonstrate compliance with privacy regulations such as the GDPR. "Helps demonstrate" is not a regulatory finding. A PIMS certificate shows that an accredited body examined the privacy management system for a defined scope.

ISO's FAQ on the 2025 page asks whether ISO/IEC 27701 can be used alone, and answers yes, because it is an independent management system standard. ISO's public information security and privacy package page says the 2025 edition is a standalone standard that enables organizations to implement and certify privacy controls independently of ISO 27001, while still allowing integration with ISO 27001. The same page says this enables independent PIMS certification without full ISMS certification, and that the PIMS stays aligned with ISO/IEC 27001:2022 and ISO/IEC 27002:2022. Those sentences describe the published standard. They do not describe any certification body's schedule, and they do not make the withdrawn 2019 edition a standalone product.

ISO/IEC 27706:2025 is for the auditor, not for you. ISO's page for ISO/IEC 27706:2025 says it specifies requirements for bodies that audit and certify a PIMS based on ISO/IEC 27701, alongside ISO/IEC 17021-1. The same page says it is not what the organization seeking certification implements. Do not put 27706 on the RFQ as a standard you want to hold. Whether an accreditation body has adopted it is a question for that body's schedule.

You can hold both certificates on one legal entity. This page is about which one this request is for, and which edition.

2. Controller, processor, and who asks

The role is part of the product. ISO's 2019 abstract and ISO's 2025 page both address PII controllers and PII processors. A certificate, or a quote, that says "privacy" and never says which role you play is not yet a scope.

The vocabulary in a European contract usually follows the GDPR. Regulation (EU) 2016/679, Article 4, uses controller for the party that determines the purposes and means of the processing, and processor for the party that processes personal data on behalf of the controller. The official text is the EUR-Lex publication of the regulation. This page is not a legal opinion on which role you hold. The data-processing agreement, the main services agreement, and the record of processing are. If those documents disagree, fix the disagreement before you ask a certification body to audit it.

A mid-market professional-services firm or SaaS company often holds both roles at once.

Processor for customer personal data. You host, support, or analyze personal data under the customer's instructions: a SaaS tenant, a payroll or claims operation, or a client file in a professional-services engagement. The customer is usually the controller. The certificate has to be able to say you are the processor for that processing, inside a named product, legal entity, and site list, with subprocessors inside the story or outside it on purpose.

Controller for your own personal data. Employees, applicants, billing contacts, and your own marketing lists are commonly your processing, for your purposes. A customer buying the SaaS product is not asking you to certify that file unless the exhibit says so. "The whole company" drags it in. A deliberate exclusion is honest. An accidental exclusion, under wording that still says the whole company, is how a later customer says the scope missed the system they bought.

US state privacy laws do not all use the GDPR nouns. Some use controller and processor. The California Consumer Privacy Act uses business and service provider. Copy the label in the contract, then map it to PII controller, PII processor, or both, because that is the split on ISO's 27701 pages. If you are a service provider for customer personal information and a business for your own marketing list, write both lines.

A customer asks for 27701 when a portal, questionnaire, data-processing exhibit, or renewal names ISO/IEC 27701, a PIMS certificate, or an accredited privacy management certificate. EU and UK buyers who already accept 27001 often add this when the deal is about personal data. Some US customers add it when a state privacy program has a privacy-certificate line distinct from information security. The sentence in the exhibit is the requirement. A logo is only a clue.

A customer asks for 27001 and does not ask for 27701 when the field names an ISMS certificate and the privacy language is a DPA or a security schedule with no certificate. Build the privacy process if the service needs it. Do not buy the certificate this cycle on a forecast.

Put 27001 only on this cycle when that certificate is the dated ask, the ISMS exists, and nobody has named a PIMS certificate. Put 27701 on this cycle when a named party will not proceed without a PIMS certificate, you can point at the processing and the role, and you can say which edition they will accept. If you already hold 27001 on a compatible boundary, section 4 is the usual design. If you hold neither and both systems exist, section 5 is the design. If the only artifact is a policy PDF, do not send.

A SOC 2 report that includes Privacy is still a CPA attestation, not an ISO/IEC 27701 certificate. Use the SOC 2 comparison when that is the fork. A CSF profile is not a PIMS certificate. Use the NIST comparison. An AI management certificate is not a privacy certificate. Use the 42001 comparison. Leave those products off this request unless their own gate is real.

3. What changed in the 2025 edition, and what did not

People still repeat a single rule: 27701 cannot be certified on its own, because it is only an extension of 27001. That rule matches the 2019 abstract. It does not match what ISO's public pages say about the 2025 edition. Use the edition in the request. Do not average them.

Question	ISO/IEC 27701:2019	ISO/IEC 27701:2025
Status on iso.org	Withdrawn, 14 October 2025	Published, edition 2, October 2025
How ISO describes it	An extension to ISO/IEC 27001 and ISO/IEC 27002	An independent management system standard for a PIMS
Standalone use	The abstract applies it to controllers and processors processing PII within an ISMS	ISO's FAQ says it can be used alone. The package page says it can be certified independently of ISO 27001
Fit with 27001	The extension assumes the ISMS	ISO says it aligns with existing 27001 systems and can still be integrated
Who it is for	PII controllers and PII processors	PII controllers and processors

If the artifact says 2019, or it says "27701" with no year and the only accredited line you can show is 2019, you are in the extension model. Do not ask for a 2019 certificate where no ISMS exists. Do not call that edition the current independent standard. A customer may still accept the withdrawn edition during a transition. Say which edition in the first paragraph so a body does not move you to 2025 without a 2025 line, or stay on 2019 after the customer has named 2025.

If the artifact says 2025, or the customer has confirmed that edition in writing, ISO's pages allow a PIMS that is not an extension certificate. You may still integrate it with 27001. That is the path section 4 uses when you already hold an ISMS certificate. Independence is a permission, not a waiver of a portal that still says ISO/IEC 27001. A 2025 PIMS certificate does not clear a 27001 field. A 27001 certificate does not clear a 27701:2025 field.

Publication is not accreditation. ISO withdrew one edition and published the next on the same date. Schedules do not flip because a lifecycle page moved. Until you open the schedule, you do not know whether a body can audit 2019, 2025, both, or neither. Section 7 is that check.

4. Adding 27701 to an existing 27001 scope

This is the common mid-market case. You already hold ISO/IEC 27001 for the legal entity that runs the service. A customer now wants a privacy certificate because that service processes personal data. Use this design when the PIMS can sit on that certificate's boundary, or on a subset you can draw on purpose (the product and the teams who touch that data, not an unrelated practice). Sites match, or the subset is written down. More than one location still follows multi-site certification scope. Someone can walk the role and the processing. Subprocessors that touch the in-scope personal data are inside the story or outside it on purpose. Internal audit and management review can reach the privacy records, or you are not pretending they have. The customer has named 27701, and you know which edition they will accept.

Then write the request as an addition to the certificate you hold. Name the issuer, the 27001 edition, the scope statement, and the expiry. Ask the body to confirm the 27701 edition on its accreditation before it quotes, and ask whether the addition is an extension of the current certificate, an integrated audit, or a separate PIMS audit. This page does not pick a design and does not set a day count. Read the reply against what a quote includes. Once the scope is frozen, days, sites, and travel are what drives cost.

Three mismatches should stop the send.

The privacy boundary is a different company from the ISMS. A 27001 certificate on the parent, and a PIMS on the subsidiary that signs the DPA, are two legal entities. Put the entity the customer contracts with on the page.

The edition does not match. The customer wants 27701:2025 and the schedule lists only the 2019 extension, or the reverse. Wait for the schedule, or take the privacy certificate to a body whose schedule lists the edition, and write that split on purpose. A body that wrote the system should not audit it. That split is consultant vs certification body.

The PIMS is a slide. A privacy policy and a 27001 Statement of Applicability are not a PIMS. If nobody owns the record of processing, the role map, and the subprocessors, build that before you book. Readiness still has the first-certificate shape. The existing certificate can make evidence easier to find. It does not remove the need to show the PIMS.

5. Buying them together, or buying 27701 without 27001

Both this cycle is the right call when a customer has named 27001 on a date you can point at, a named party has also named 27701 (or you can defend why the personal-data deal will not close on 27001 alone), and both the ISMS and the PIMS exist on one legal entity and one site list. The personal-data story has to match the Statement of Applicability. At least one certification-body legal entity must be accredited for every edition on the page. If no single body covers both, use two bodies and say so. Each still receives the same facts.

Do not stack 27701 onto a first 27001 quote because a homepage said privacy is included. A PIMS you cannot walk will fail on its own and will muddy the ISMS. Mark 27701 as a later add, with a recheck date, until the role map exists.

27701 without 27001 is a real product only on the terms in section 3. All of these have to be true together. The edition is ISO/IEC 27701:2025, not the withdrawn 2019 extension. The customer has accepted a PIMS certificate and has not required ISO/IEC 27001 on this deal. The PIMS exists, and an owner can walk the purpose, the role, and the processing. The live schedule lists ISO/IEC 27701:2025. A 2019 line, a 27001 line, or a group brochure does not substitute.

ISO's package page describes privacy certification without a full ISMS certificate. It does not say a portal will waive 27001. If the portal still says 27001, this path is the wrong buy. If the shortlist is accredited only for 27701:2019, this path is also the wrong buy, because that edition's abstract places the PIMS within an ISMS.

Neither this cycle is the honest call when the requirement is real and the system is not. A website privacy policy is not a PIMS. A 27001 project that has not reached internal audit is not an ISMS you can extend by adding a paragraph.

6. How the RFQ changes

One narrative, so the facts do not drift. The ISO request uses the scope pack. Privacy certification changes specific rows. It does not replace the pack with a letter that says "please include 27701."

Fact	If ISO/IEC 27001 is this cycle	If ISO/IEC 27701 is this cycle
What you are buying	An accredited ISMS certificate for the edition you will claim	An accredited PIMS certificate for 27701:2019 or 27701:2025, named on purpose
How it relates to the other standard	Say whether 27701 is a later add, already held, or out of scope	Add to an existing 27001 scope, buy both, or 2025 only without a 27001 certificate
Who may issue it	A certification-body legal entity accredited for that 27001 edition	A legal entity accredited for that 27701 edition. A 27001 line is not enough. A 2019 line is not a 2025 line
Role	The information the ISMS protects	PII controller, PII processor, or both, mapped from the contract (including business or service provider where that is the label)
Boundary	Information, activities, legal entity, sites, and what sits outside	The processing activities and personal data in scope. Same boundary as the ISMS, or a subset written down
Out of scope on purpose	Name it	Employee or marketing data, if excluded. Subprocessors outside the certificate. A product the customer is not buying
Existing certificate	Issuer, edition, scope, expiry, if any	The 27001 certificate you would extend: issuer, edition, scope, expiry. Say if there is none
The other artifact	SOC 2, a CSF profile, or 42001 only if a separate field names it	The same rule. A PIMS certificate does not produce those artifacts
Where you check	IAF CertSearch and the accreditation-body directory	The same directories, read for 27701 and the edition, not only for 27001

Headcount is a band per location. Name the same locations in both scopes when they are truly in both. Ask the questions in what a quote includes. This page does not publish a fee or a day count.

You may say that customers also speak GDPR or a named US state privacy law, so the body understands the contract. Do not ask the body to certify that you comply with the GDPR, the CCPA, or any other statute. Do not add "GDPR certification" as a standard. Do not add ISO/IEC 27706 as a standard you implement. Do not ask for a 2019 certificate and a 2025 certificate together unless you have two written requirements and two accreditation lines.

If only 27001 is this cycle, one sentence is enough: 27701 is a later add, processing you already run inside the ISMS, or out of scope. That sentence stops a body from quoting a PIMS you will not staff.

7. Accreditation scope varies, then the neighboring artifacts

A published standard is not an accreditation. The method is how to verify accreditation. Use it for 27701 with a tighter reading of the line.

Ask, in writing, for the legal entity that will sign, the accreditation body, the standard, and the edition. IAF CertSearch is where you trace accredited certificates and certification-body identities. The accreditation-body directory is where that body's own scope lives. For the marks buyers most often see on a proposal here, start with ANAB or UKAS. Other IAF MLA accreditation bodies can be legitimate. The test is the mark your customer accepts and the legal entity on that body's current schedule.

Read for ISO/IEC 27701 and the edition. Only a match should proceed.

The schedule lists 27001 and does not list 27701. That body is not your PIMS certification body until the schedule changes.

The schedule lists ISO/IEC 27701:2019, or lists 27701 without a year you can tie to 2025. Treat it as the extension edition until the accreditation body says otherwise. You can discuss a 2019 audit if the customer will still accept that withdrawn edition. You cannot call it accreditation for ISO/IEC 27701:2025.

The schedule lists ISO/IEC 27701:2025. That is the independent PIMS edition ISO's pages describe. Confirm whether the customer wants it with a 27001 certificate or accepts it alone, and confirm the scope wording covers the activities you will claim.

The schedule lists both editions, or shows a transition note you can read. Quote the edition the customer named. Ask which edition will be printed on the certificate. Keep that sentence in the proposal.

A logo, a sister company's schedule, and a directory tag are not the check. This site's directory tags ISO/IEC 27001. It does not tag ISO/IEC 27701, and a 27001 tag is not accreditation for either edition. How to choose a registrar still applies after the schedule matches: sector experience, the mark the customer will accept, and independence from anyone who wrote the system.

SOC 2 stays a CPA attestation. A Privacy category in that report does not become ISO/IEC 27701. NIST CSF 2.0 stays a profile, not a certificate. ISO/IEC 42001 stays an AI management system. Processing personal data with a model does not put 42001 on this request. A 27001 schedule implies neither 27701 nor 42001. A 27701 schedule does not imply 42001.

8. Send one request

Make the call in one sitting. Put one sentence at the top of the request.

1. Write the requirement in their words, including the edition if they named one. If one field says ISO/IEC 27001 and another says ISO/IEC 27701, note which deal is blocked this cycle. Mark SOC 2, a CSF profile, or 42001 as a different product.
2. Name the role and the processing. Controller, processor, or both. Customer personal data, the firm's own personal data, or both. If the contract says business or service provider, keep that label and map it.
3. Match it to a system you can show. A 27001 request needs an ISMS and a used Statement of Applicability. A 27701 request needs a PIMS an owner can walk. A 2019 request also needs the ISMS. If that system does not exist, do not send.
4. Pick one design. 27001 only, 27701 added to the certificate you hold, both together, or 2025 without 27001. The last design needs the customer's acceptance and a live 2025 accreditation line.
5. Check the signer before you invite them. Use how to verify accreditation for the legal entity, the mark, and the edition.

If the room is still split after step 4, do the work that unblocks the deal and park the other certificate until its evidence and its accreditation line exist.

When a certificate is the artifact, send one registrar RFQ / scope pack. The Get quotes form does not list ISO/IEC 27701. In Scope notes, name the edition, the role, and whether this cycle adds 27701 to an existing 27001 scope, buys both, or seeks a 2025 PIMS certificate without 27001. Tick ISO/IEC 27001 only when that certificate is part of the request. Do not let a ticked 27001 box stand in for a 27701-only request. Put any certificate you already hold in Existing certificates. Submit once.