Define scope and roles
Understand relevant privacy issues, interested parties, PII processing roles and PIMS boundaries.
ISO/IEC 27701:2025 · Privacy Information Management System
Run privacy as a living management system.
Connect privacy scope, records of processing, DPIAs, controller and processor responsibilities, policies, risks, evidence, audits and improvement in one governed workspace.
STORM currently supports ISO/IEC 27701 privacy information management alongside ISO/IEC 27001 and GDPR.
PIMS operating cycleAccountability evidenced
PIMSprivacy governance
ContextScope · roles · parties
LeadPolicy · accountability
PlanRisk · objectives
OperateControls · processors
EvaluateMonitor · audit · review
ImproveCorrect · adapt · learn
2025Current ISO publication
Edition 2Replaces the 2019 extension
Standalone MSSCan operate independently
Controller + processorAccountable PII roles
The management-system requirements
Move from privacy projects to repeatable governance.
ISO/IEC 27701:2025 defines requirements for establishing, implementing, maintaining and continually improving a PIMS. It can stand alone while remaining aligned with ISO/IEC 27001.
Set direction
Establish privacy policy, accountability and responsibilities supported by management commitment.
Address privacy risk
Evaluate risks and opportunities, establish objectives and plan controlled changes.
Enable the PIMS
Manage resources, competence, awareness, communication and controlled documented information.
Apply privacy controls
Operate the processes and safeguards selected for the organisation's controller or processor activities.
Review performance
Monitor relevant measures, conduct internal audits and document management review.
Correct and adapt
Address nonconformities, corrective actions and continual improvement of privacy management.
Integrate when useful
Operate the PIMS independently or align it structurally with an existing ISO/IEC 27001 system.
Scope and delivery
What STORM includes for ISO/IEC 27701.
Built-in ISO/IEC 27701 assessments connect your PIMS to ROPA, DPIA, risks, policies and evidence.
Included in STORM
- Built-in ISO/IEC 27701 assessments and mappings
- ROPA, data identification and GDPR data mapping
- DPIA and data-subject impact evaluation
- Risk, policy, supplier and incident workflows
- GDPR assessments, audit findings and actions
- Management-review records and evidence exports
Agreed during onboarding
- Controller and processor roles in scope
- Your PIMS objectives, metrics and reports
- Consent and data-subject requests (handled in your existing tools)
Where STORM can support a PIMS
Connect privacy accountability to the work that proves it.
STORM links processing context, privacy impact, provider oversight, controlled documentation, risk decisions and review records in a common operating environment.
Maintain processing context
Build records of processing and data maps alongside services, systems, users, locations, information assets and external providers.
ROPA · data mapping · CartographyAssess privacy consequences
Use the DPIA workflow and questionnaires to evaluate impact on data subjects and retain downloadable assessment records.
DPIA · impact evidenceControl privacy documents
Manage policies and procedures through authoring, versions, approvals, reviews, acknowledgements, reminders and mappings.
Policy Center · lifecycleTreat privacy risk
Record likelihood, impact, controls, treatment decisions, mitigation actions, owners, dates and supporting attachments.
Risk Registry · treatmentAssess external parties
Maintain supplier records, apply configurable assessment criteria, request evidence and track remediation and monitoring.
TPRM · supplier evidenceAudit, review and improve
Bring assessment status, findings, risks, incidents, supplier results, policy status and actions into structured reviews.
Audit · management review
Build the privacy context
Connect processing records to the organisation around them.
STORM supports ROPA and GDPR data mapping within a connected asset model. That makes privacy scope easier to relate to services, systems, people, locations and suppliers.
- Data and processing activity records
- Flows and operational dependencies
- Reusable context for risk and assessment
Assess impact and risk
Keep privacy consequences and treatment connected.
STORM includes DPIA and data-subject impact evaluation. Related concerns can be managed as custom risks with controls, treatment, owners and evidence.
- DPIA questionnaires and impact results
- Legal, financial and business consequences
- Risk treatment and mitigation actions
Govern documented information
Make privacy policy a maintained operating record.
Use document ownership, workflow, review schedules and acknowledgement evidence to keep policies and procedures current and auditable.
- Authors, reviewers and approvers
- Version history and scheduled review
- Acknowledgements and audit trail
Review and improve
Bring evidence, gaps and incidents into management oversight.
Configurable assessments, internal audits, incident records and management-review inputs support an evidence-led improvement cycle. PIMS-specific content still needs confirmation and configuration.
- Implementation status and gap visibility
- Findings, corrective actions and target dates
- Review decisions retained for follow-through
Practical PIMS themes01 02 03 04 05 06 07 08
Make privacy accountability visible from scope to improvement.
These implementation themes do not reproduce or replace the licensed ISO/IEC 27701:2025 requirements.
Privacy context
Define processing roles, relevant interested parties, legal context and PIMS boundaries.
Scope · roles · requirementsProcessing records
Maintain structured information about PII, activities, purposes, systems, flows and providers.
ROPA · mapping · inventoryImpact & risk
Evaluate consequences for individuals and manage privacy risks through accountable decisions.
DPIA · risk · treatmentController duties
Organise the policies, decisions and evidence relevant when determining processing purposes and means.
Purpose · accountability · evidenceProcessor duties
Define and assess the responsibilities that apply when PII is processed for another organisation.
Instruction · service · assuranceSupplier governance
Evaluate external parties, collect evidence and monitor remediation around processing dependencies.
Due diligence · evidence · actionIncident response
Connect privacy-relevant events to investigation, ownership, corrective action and review.
Incident · escalation · learningPerformance & review
Use defined measures, audits and management decisions to drive continual improvement.
Monitor · audit · improveThe exact controller, processor and shared requirements must be determined from the licensed standard and the organisation's privacy context. STORM supports governance records; it does not replace qualified privacy or legal analysis.
Build the PIMS operating cycle01 02 03 04 05
From processing context to continual improvement.
A practical PIMS links requirements to records, accountable owners, evidence and management decisions.
Scope
Define roles, processing activities, PII, systems, suppliers and requirements.
Context · ROPA · mappingAssess
Evaluate privacy impacts, risks, provider posture and existing safeguards.
DPIA · risk · evidenceGovern
Approve policies, responsibilities, controls, procedures and action plans.
Policy · owners · controlsEvaluate
Monitor defined measures, assess implementation, audit and review performance.
Measures · audit · reviewImprove
Correct gaps, respond to incidents and retain learning and decisions.
Actions · change · improvementPractical questions
Questions privacy teams ask.
The 2025 standard, platform workflows, legal obligations and independent certification each have a distinct role.
Does STORM include a built-in ISO/IEC 27701 assessment?
Yes. STORM includes a built-in ISO/IEC 27701 assessment, connected to ROPA, data mapping, DPIA, risks, policies and evidence.
Is ISO/IEC 27701:2025 still only an extension to ISO/IEC 27001?
No. ISO states that the 2025 edition is an independent management system standard. It can be implemented on its own and can also be aligned with an existing ISO/IEC 27001 system.
Can STORM support ROPA and DPIA activities?
Yes. STORM includes records of processing activities, GDPR data mapping, data-flow diagrams, DPIA questionnaires, evaluation of impacts on data subjects and downloadable impact reports.
Does STORM automate consent or data-subject requests?
No. Consent management and data-subject requests stay in your dedicated tools; STORM keeps the governance, assessment and evidence records around them.
Does ISO/IEC 27701 certification guarantee GDPR compliance?
No. A PIMS can support accountability and evidence, but GDPR compliance depends on actual processing, roles, lawful obligations, controls and ongoing operations. Certification does not replace regulatory or legal assessment.
Can STORM issue ISO/IEC 27701 certification?
No. STORM can organise governance records and evidence. ISO confirms that the 2025 standalone PIMS can be independently certified, but the audit and certification decision must be made through an appropriate independent certification process.
How does ISO/IEC 27701 differ from ISO/IEC 27018?
ISO/IEC 27701:2025 establishes a broad, standalone PIMS for PII controllers and processors. ISO/IEC 27018:2025 provides cloud-specific guidance for public-cloud providers acting as PII processors.
Bring your privacy operating model
Book a STORM demo Test STORM against the PIMS evidence you must actually maintain.
Review your ROPA, data maps, DPIAs, controller and processor roles, privacy risks, policies, suppliers, incidents and audits—and identify which ISO/IEC 27701:2025 content still needs configuration.