ISO 27701:2025 transition

What has changed in ISO 27701:2025?

The previous edition, ISO 27701:2019, was structured as an extension to ISO 27001 and ISO 27002. ISO/IEC 27701:2025 has been rewritten as a standalone management system standard for privacy information management.

The revised standard contains its own management system requirements and follows the harmonized structure used by other ISO management system standards. Organizations must therefore assess the differences between the 2019 and 2025 editions and determine which changes are required within their PIMS.

ISO 27701:2025 transition deadline

A transition period of three years applies from the publication of ISO 27701:2025. The transition period ends on 1 October 2028.

Until this date, existing certificates based on ISO 27701:2019 remain valid, provided that the regular certification requirements continue to be met.

After 1 October 2028, certificates based on ISO 27701:2019 will no longer be valid. Organizations must therefore successfully complete the transition audit before the end of the transition period.

What does the ISO 27701 update mean for your organization?

A transition audit is required to transfer your existing certification to ISO 27701:2025.

Brand Compliance will contact its certificate holders to schedule the transition audit. Where possible, the transition audit will be combined with a regular surveillance or recertification audit within the current certification cycle.

We recommend starting your preparations in good time. Your organization should analyze the changes to the standard, assess their impact on the PIMS and implement any necessary adjustments before the transition audit.

How to prepare for the ISO 27701 transition

Before the transition audit, your organization should be able to demonstrate that it has:

• Ensured that the people responsible for implementing, maintaining and auditing the PIMS understand the requirements of ISO/IEC 27701:2025;
• Analyzed the differences between ISO 27701:2019 and ISO 27701:2025;
• Assessed whether changes to the PIMS are necessary;
• Updated the Statement of Applicability;
• Updated the risk treatment plan;
• Implemented new or modified PIMS processes where required;
• Conducted an internal audit against the new requirements;
• Evaluated the transition and the effectiveness of the PIMS during the management review.

These activities provide the evidence required to demonstrate that your organization has addressed the ISO 27701:2025 requirements.

Your ISO 27701 transition audit

During the transition audit, Brand Compliance assesses the application of ISO 27701:2025.

The transition audit includes an assessment of:

• Your organization’s approach to the transition;
• An analysis of the changes to the standard;
• The gap analysis used to determine the necessary changes to the PIMS;
• The updated Statement of Applicability;
• The updated risk treatment plan;
• The implementation and effectiveness of new or modified PIMS processes;
• The internal audit and management review demonstrating that the management system complies with the new standard.

How long does the transition audit take?

For the transition audit described here, Brand Compliance allocates six hours for the audit and an additional two hours for reporting and administrative processing. We will confirm the applicable audit arrangements when scheduling your transition.

Where possible, these activities will be combined with a regular surveillance or recertification audit.

Nonconformities during the transition audit

Nonconformities may be identified during the transition audit. They are handled as follows:

Minor nonconformities: your organization must submit an action plan for approval by Brand Compliance.

Major nonconformities: the corrective actions must be fully verified before the new certificate can be issued.

Completion of the ISO 27701:2025 transition

Once the transition audit has been successfully completed and any nonconformities have been adequately addressed, your organization will receive a new certificate based on ISO 27701:2025.

The expiry date of your current certification cycle remains unchanged. So completing the transition does not start a new certification cycle.

Frequently asked questions

When is the ISO 27701:2025 transition deadline?

The transition period ends on 1 October 2028. After this date, certificates based on ISO 27701:2019 will no longer be valid.

Does my ISO 27701:2019 certificate remain valid?

Yes. Your existing certificate remains valid during the transition period, provided that the regular certification requirements continue to be met. You must complete the transition before 1 October 2028.

Is a transition audit mandatory?

Yes. Organizations currently certified against ISO 27701:2019 must complete a transition audit to receive a certificate based on ISO 27701:2025.

Can the transition audit be combined with a regular audit?

Where possible, Brand Compliance will combine the transition audit with a regular surveillance or recertification audit.

Will the transition start a new certification cycle?

No. After successful completion of the transition, the expiry date of your current certification cycle remains unchanged.

What happens if nonconformities are identified?

For minor nonconformities, your organization must submit an action plan for approval. Major nonconformities must be fully verified before Brand Compliance can issue the new certificate.

Discuss your ISO 27701 transition audit

Would you like to discuss the planning of your transition audit or whether it can be combined with your next scheduled audit? Contact Brand Compliance to discuss the arrangements for your organization.

Discuss your transition audit