ISO has confirmed that the second edition of ISO/IEC 27701, the international standard for Privacy Information Management Systems (PIMS) is set for publication in October 2025. 

This long-awaited update represents a major shift in how organizations can demonstrate compliance and accountability in data protection. 

Direct Certification: A Game-Changer for Privacy-Focused Organisations 

Since its first release in 2019, ISO/IEC 27701 has functioned as an extension to ISO/IEC 27001 (Information Security Management Systems). This meant companies needed to achieve 27001 certification before pursuing 27701—an extra step that limited accessibility for privacy-first organizations. 

That’s about to change.

The upcoming ISO/IEC 27701:2025 edition will allow organizations to be certified independently, without the need for ISO/IEC 27001. 

This independence is expected to broaden participation, enabling privacy-driven firms especially startups, SaaS providers, and data processors to achieve global recognition for their privacy practices. 

Alignment with the Latest Security Standards 

The 2025 revision also aligns ISO/IEC 27701 with the updated 2022 editions of ISO/IEC 27001 and ISO/IEC 27002, ensuring that privacy and information security frameworks work hand-in-hand. 

This alignment simplifies integration for organizations maintaining both privacy and security certifications, helping reduce audit duplication and compliance costs. 

What This Means for Businesses 

• More accessible certification path: Privacy programs no longer need to depend on a full information security system certification. 

• Stronger interoperability: Better alignment with ISO’s latest frameworks and GDPR-style data protection principles. 

• Future-ready compliance: Ideal for organizations operating in AI, cloud, health, and fintech sectors where privacy management is now a core requirement. 

 Industry Impact 

Experts expect the change to trigger a wave of new certifications among mid-sized and digital-native organizations that prioritize privacy governance but may not need a full ISMS. 

Certification bodies are now preparing updated audit methodologies and transition guidance for existing ISO 27701:2019 certificate holders. 

Key Takeaway 

The evolution of ISO/IEC 27701 marks a strategic move toward making privacy certification more accessible, scalable, and globally consistent. 

For privacy officers and compliance leaders, this is a signal to start preparing their frameworks, risk assessments, and documentation to align with the forthcoming 2025 edition.