IngSafeISO 27701
Who it's for
Controllers and processors of personally identifiable information (PII) who must comply with the GDPR or Taiwan's Personal Data Protection Act.
Problems we solve
Insufficient privacy-protection systems and difficulty demonstrating privacy compliance.
Benefits
Establish a PIMS, demonstrate privacy compliance, and build trust with partners, customers and regulators.
Introduction
ISO officially published ISO 27701:2025 on 14 October 2025. It specifies the requirements for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS), designed for controllers and processors of personally identifiable information (PII). Benefits include:
- Strengthening data-privacy and protection capabilities
- Helping demonstrate compliance with global privacy regulations such as the GDPR
- Building trust with partners, customers and regulators
- Aligning with the existing ISO/IEC 27001 system to simplify implementation and operation
- Promoting accountability and evidence-based privacy management
What changed in the revision
The biggest change in ISO 27701:2025 is that it becomes a standalone standard, no longer an extension of ISO 27001/27002. Organizations no longer need ISO 27001 certification first in order to implement or be certified. This lowers the barrier and cost for SMEs, simplifies the certification process, and enables organizations of all sizes to obtain data-privacy certification.
Implementation in practice
Depending on your current status — already certified to both ISO 27001 and 27701 (transition), certified to ISO 27001 only, or neither — IngSafe tailors the path from gap/context analysis, training, PII inventory and risk assessment through the Statement of Applicability, controls, internal audit, third-party certification and continual improvement.
Our consultants have compiled detailed ISO 27701 materials — contact us for details.
Interested in adoption and consulting? Contact us and a specialist will assist you.