ISO 27701:2025 Transition

Transitioning to the updated Standard

Do we need to transition to 27701:2025?

In October 2025, ISO released the updated ISO 27701:2025 standard, replacing the 2019 edition and introducing substantial updates to the Privacy Information Management System (PIMS) framework. Organisations currently certified to ISO 27701:2019 will need to transition to the 2025 version within the official three‑year transition period, after which all 2019 certificates will expire. Certification bodies will continue offering audits to the 2019 version for a limited time, but all organisations must complete the transition no later than three years (October 2028) from the publication date to maintain valid certification. Some accredited certification bodies may advise organisations to transition earlier by aligning the process with upcoming surveillance or recertification audits, helping ensure smooth continuity and avoiding last‑minute capacity constraints.

What are the key changes to ISO 27701:2025?

Now a stand-alone Standard

No longer requires ISO 27001 as a prerequisite, allowing organisations to certify a Privacy Management System (PIMS) independently

Revised structure aligned with modern ISO frameworks

The Standard now follows a full management system structure (Clauses 4–10), making it clearer, more coherent and easier to integrate with other ISO standards

Consolidated and updated controls

Controller and processor requirements have been merged into a single annex, with updated guidance and a set of 29 core privacy‑related controls

Our ISO 27701:2025 Transition Lifecycle

Awareness Training

We will provide awareness training in relation to the key changes in the Standard

Find out more

Implementation

We help you update your PIMS documentation and provide guidance to support the implementation of new or changed controls

Find out more

Pre-Audit Review

We will carry out an independent audit, to provide assurance of your readiness for transition and where required by the certification body, support external readiness reviews

Find out more

Assessment

We will prepare, attend and support your UKAS accredited assessment body transition assessment

Find out more

Why choose Teamwork IMS?

Experienced Professionals

Teamwork IMS is a leading provider of Compliance and Sustainability solutions to a wide range of business sectors worldwide. Our solutions support compliance, expedite ISO certification, promote sustainability and drive improvement initiatives. Our team of professionals includes MBCI, GDPR, ISEP, ESOS and ISO Lead Assessor, CMIOSH, CISSP, PCI Security Standards Council QSA qualified consultants.

Multi-disciplinary team

Our knowledge and experience across a broad base of management and technical Standards make us uniquely equipped to help organisations to develop an information security management system and integrate with existing management systems to achieve significant savings and efficiencies.

Part of your business

The continued success of both the project delivery and maintenance phases of our Compliance and Sustainability programmes is built on two key principles:

– The exceptional insight of our consultants, who consistently go beyond the Standards and services to identify, define, and align with the core business drivers that truly matter to our clients

– Our unique ability to integrate effortlessly with our clients’ teams, fostering collaboration and trust, and becoming a valued extension of their operations.

Global credentials

We have developed and led IAF National accredited ISO as well as other Standard and compliance-based service improvement programmes for private and public-sector organisations across an international client base.

Related Standards

Frequently asked questions

What is the deadline for transition to ISO 27701:2025?

All organisations wishing to maintain their ISO 27701 certification must transition from the 2019 edition to the 2025 version of the Standard within the three‑year transition period that began upon its publication in October 2025. Some accredited certification bodies may require organisations to transition earlier by aligning the update with their next scheduled surveillance or recertification audit.

How are certification bodies approaching transition audits?

The UKAS accredited certification bodies we frequently deal with have indicated that typically 1 day would be added onto an existing surveillance visit or recertification assessment. However, for larger complex and/or multi-site clients there may be additional days.

Some certification bodies will also require the completion of a gap analysis document or readiness review in advance of the assessment.