Privacy management

Make privacy management systematic.

ISO/IEC 27701 provides requirements for a privacy information management system. The current 2025 edition is a standalone standard. We help build the policies, responsibilities, assessments, and records that make privacy governance operational.

Our implementation focus

Make the requirements operational.

  1. 01

    Define privacy scope, roles, and data flows

  2. 02

    Assess privacy risks and obligations

  3. 03

    Design controls for collection, use, retention, and sharing

  4. 04

    Establish supplier and processor oversight

  5. 05

    Set review, audit, and improvement cycles

Independent assessment

This advisory work supports governance; legal advice and certification assessments are separate services.

The delivery path

A sequence you can operate.

Each step leaves a clear decision or working artifact behind.

01 / 04

Map the privacy context

Identify personal information, purposes, processing roles, third parties, and the jurisdictions involved. Record legal questions for qualified counsel.

Output: Data-flow and role map
02 / 04

Scope the PIMS

Define the privacy management system boundary, responsibilities, objectives, risk criteria, and how privacy decisions are escalated.

Output: PIMS scope and governance plan
03 / 04

Operate privacy controls

Put retention, access, supplier, rights-request, incident, and review processes into work that owners can demonstrate.

Output: Control records and exception workflow
04 / 04

Review and improve

Evaluate performance, test selected records, run internal review, and address findings before any independent assessment.

Output: Improvement record and readiness plan

Questions we hear

Get the distinctions right.

Is ISO/IEC 27701 a substitute for privacy law?

No. A privacy information management system helps govern personal information, but legal duties depend on processing, roles, and jurisdiction.

Does the 2025 edition require ISO/IEC 27001 certification?

The 2025 edition is a standalone privacy management system standard. Information security controls remain important, and the applicable assessment route should be confirmed with an independent certification body.

Practical guidance

Read the next decision.

Standard guide5 min read

ISO/IEC 27701

ISO/IEC 27701:2025 privacy management: a new implementation starting point

How to scope a privacy information management system under the current standalone edition and connect it with security controls.

Read resource

Work with Normstone

Build a defensible path to readiness.

Tell us the outcome you need and the markets involved. We’ll help define the work.

Start a conversation