ISO/IEC 27701:2025 — Privacy Information Management
Certification of privacy information management systems (PIMS) against ISO/IEC 27701:2025, the international standard for managing the processing of personally identifiable information (PII). Issued By CAS under its own authority, outside the EGAC accredited scope, with no EGAC or IAF mark.
Standard
ISO/IEC 27701:2025
Service type
By CAS
Issued under
CAS — own authority
What it is
ISO/IEC 27701:2025 specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS). It addresses the processing of personally identifiable information (PII) by organisations acting as PII controllers, PII processors, or both.
Who needs it
Organisations of any size or sector that process personally identifiable information as controllers or processors — for example IT and cloud service providers, healthcare and financial organisations, and shared-service or contact centres.
Audit process
Certification follows a two-stage initial audit (Stage 1 and Stage 2) under ISO/IEC 17021-1:2015, with annual surveillance audits and recertification every three years. The certificate is issued By CAS, outside CAS's EGAC accreditation, and can be verified on CAS CertSearch.
Frequently asked questions
Common questions
Is ISO/IEC 27701 certification by CAS accredited?
No. CAS issues ISO/IEC 27701 certificates By CAS, under its own authority and outside its EGAC accreditation, which covers ISO 9001, 14001, 45001, 22000, 50001 and 22301 only. The certificate carries the CAS mark, not the EGAC or IAF marks, and can be verified on CAS CertSearch.
Does ISO/IEC 27701 certification show compliance with data protection law?
No. Certification shows that the privacy information management system conformed to the standard when it was audited. It is not a legal opinion and does not replace the organisation's own assessment of its obligations under the GDPR or other data protection laws.
Ready to certify against ISO/IEC 27701:2025?
Tell us about your organisation and scope — we’ll come back with a costed proposal, usually within two business days. No obligation.