Data protection · 2 min read ·
ISO/IEC 27701:2025 published: how does it affect your data protection management?
The updated privacy information management standard now stands on its own. It can be adopted without a certified information security management system.
Almost every organisation processes personal data. Previously, the privacy management standard ISO/IEC 27701:2019 was tightly tied to the information security management system, but now the situation has changed.
In October 2025, the updated privacy information management system standard ISO/IEC 27701:2025 was published. The update makes it easier for organisations to develop their data protection and demonstrate that it is under control, whatever their current level.
No longer dependent on the information security standard
Previously, ISO/IEC 27701 worked as an extension to the ISO/IEC 27001 standard. Now it is an independent whole that can be adopted without an already certified information security management system.
The updated version still includes the security practices and requirements that matter for data protection. It provides a comprehensive basis for the secure processing of personal data also for organisations that do not yet have an information security management system.
Changes to structure and content too
- Clearer guidance for both controllers and processors.
- Digital environments better covered: cloud services, AI and large-scale use of data.
- The structure is more consistent with other management systems (e.g. quality, information security and AI).
What are the benefits for companies?
ISO/IEC 27701:2025 offers a clear framework for managing personal data, regardless of your current situation. It helps you:
- define the responsibilities and roles for processing personal data more clearly,
- assess privacy risks in a more up-to-date way,
- show stakeholders that data protection is taken seriously,
- combine practices easily with other management systems.
The independent structure and up-to-date content offer a practical way to ensure that the processing of personal data is controlled and transparent. Foregon is happy to help assess what the standard would mean for your company.