The 2025 standard
ISO/IEC 27701:2025 sets requirements for a Privacy Information Management System (PIMS) for controllers and processors. It supersedes the 2019 edition and can be applied independently.
GDPR is law
EU Regulation 2016/679 imposes duties according to processing context: lawful basis, transparency, rights, security, governance, transfers and evidence. A management certificate does not ensure every processing activity is legal.
How they fit together
A PIMS helps structure roles, policies, risks, vendors, incidents and improvement. Legal grounds and country-specific provisions still require contextual validation.
Useful deliverables
Data inventories, controller/processor mapping, processing records, access/deletion evidence, retention policies and request-handling processes.
At a glance
| Question | ISO 27701 | GDPR |
|---|---|---|
| Nature | Management standard | EU Regulation |
| Evidence | System / possible certification | Lawful processing in practice |
How SFERE can support
SFERE can prepare data flows and controls evidence in collaboration with the client’s DPO or legal counsel.
Official laws, standards & publisher resources
This is an editorial explanation. Verify consolidated laws, applicable standards and interpretations for your activity, country and date. Full standards may require a licence.