# ISO 27701 PIMS Standards Reference

## Primary Standards

### ISO/IEC 27701:2019
- **Title**: Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines
- **Published**: August 2019
- **Publisher**: International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC)
- **Status**: Active
- **Scope**: Specifies requirements and provides guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS) as an extension to ISO/IEC 27001 and ISO/IEC 27002

### ISO/IEC 27001:2022
- **Title**: Information security, cybersecurity and privacy protection — Information security management systems — Requirements
- **Published**: October 2022 (replaces ISO/IEC 27001:2013)
- **Prerequisite**: Organizations must have an ISO 27001 ISMS in place before extending to ISO 27701

### ISO/IEC 27002:2022
- **Title**: Information security, cybersecurity and privacy protection — Information security controls
- **Published**: February 2022 (replaces ISO/IEC 27002:2013)
- **Relationship**: ISO 27701 Clause 6 provides privacy-specific guidance extending ISO 27002 controls

## Supporting Standards

### ISO/IEC 29100:2011/Amd 1:2018
- **Title**: Information technology — Security techniques — Privacy framework
- **Relationship**: ISO 27701 Annex C maps to ISO 29100 privacy principles
- **Key Content**: Defines 11 privacy principles: consent and choice, purpose legitimacy, collection limitation, data minimization, use/retention/disclosure limitation, accuracy and quality, openness/transparency, individual participation, accountability, information security, privacy compliance

### ISO/IEC 27018:2019
- **Title**: Information technology — Security techniques — Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
- **Relationship**: ISO 27701 Annex E maps to ISO 27018 for cloud processor scenarios

### ISO/IEC 29151:2017
- **Title**: Information technology — Security techniques — Code of practice for personally identifiable information protection
- **Relationship**: ISO 27701 Annex E maps to ISO 29151 for general PII protection

### ISO/IEC 17065:2012
- **Title**: Conformity assessment — Requirements for bodies certifying products, processes and services
- **Relationship**: Certification bodies for ISO 27701 must be accredited under ISO 17065

## Regulatory Mapping References

### GDPR (Regulation (EU) 2016/679)
- ISO 27701 Annex D provides a detailed mapping between PIMS controls and GDPR articles
- Key mappings: Art. 5 (principles) to A.7.2/A.7.4, Art. 6 (lawfulness) to A.7.2.2, Art. 13-14 (information) to A.7.3.2-A.7.3.3, Art. 28 (processor) to A.7.2.6/B.8.2, Art. 30 (records) to A.7.2.8/B.8.2.6, Art. 32 (security) to Clause 6, Art. 33-34 (breach) to 6.13.1

### LGPD (Lei Geral de Proteção de Dados — Brazil)
- Brazilian ANPD recognizes ISO 27701 as a privacy governance framework
- Mapping available through ISO 27701 Annex D GDPR mapping (substantial alignment between LGPD and GDPR)

### APPI (Act on the Protection of Personal Information — Japan)
- JIPDEC (Japan Institute for Promotion of Digital Economy and Community) recognizes ISO 27701 in its PrivacyMark system
- Japanese PPC guidance references ISO 27701 as an appropriate framework

## Certification and Accreditation Bodies

| Body | Type | Region |
|------|------|--------|
| BSI (British Standards Institution) | Certification Body | Global |
| SGS | Certification Body | Global |
| TUV (multiple entities) | Certification Body | Global |
| Bureau Veritas | Certification Body | Global |
| DNV (Det Norske Veritas) | Certification Body | Global |
| LRQA (Lloyd's Register Quality Assurance) | Certification Body | Global |
| Schellman | Certification Body | Americas |
| UKAS (United Kingdom Accreditation Service) | National Accreditation Body | UK |
| ANAB (ANSI National Accreditation Board) | National Accreditation Body | US |
| DAkkS (Deutsche Akkreditierungsstelle) | National Accreditation Body | Germany |
| COFRAC (Comité français d'accréditation) | National Accreditation Body | France |

## Key Publications

- ISO/IEC 27701:2019 Implementation Guide (ISO)
- EDPB Guidelines 1/2018 on certification and identifying certification criteria under Regulation 2016/679
- CNIL Guide: ISO 27701 and GDPR compliance (CNIL, 2020)
- BSI White Paper: Implementing ISO 27701 (BSI, 2020)
- IAPP-ISACA Privacy Technical Guide: ISO/IEC 27701 (2020)