Define scope and roles
Understand relevant privacy issues, interested parties, PII processing roles and PIMS boundaries.
ISO/IEC 27701:2025 · Privacy Information Management System
Run privacy as a living management system.
Connect privacy scope, records of processing, DPIAs, controller and processor responsibilities, policies, risks, evidence, audits and improvement in one governed workspace.
The supplied STORM technical description does not list ISO/IEC 27701 among its current built-in standards. STORM provides documented privacy-management building blocks; confirm 2025 requirement content and mappings before use.
PIMS operating cycleAccountability evidenced
PIMSprivacy governance
ContextScope · roles · parties
LeadPolicy · accountability
PlanRisk · objectives
OperateControls · processors
EvaluateMonitor · audit · review
ImproveCorrect · adapt · learn
2025Current ISO publication
Edition 2Replaces the 2019 extension
Standalone MSSCan operate independently
Controller + processorAccountable PII roles
The management-system requirements
Move from privacy projects to repeatable governance.
ISO/IEC 27701:2025 defines requirements for establishing, implementing, maintaining and continually improving a PIMS. It can stand alone while remaining aligned with ISO/IEC 27001.
Set direction
Establish privacy policy, accountability and responsibilities supported by management commitment.
Address privacy risk
Evaluate risks and opportunities, establish objectives and plan controlled changes.
Enable the PIMS
Manage resources, competence, awareness, communication and controlled documented information.
Apply privacy controls
Operate the processes and safeguards selected for the organisation's controller or processor activities.
Review performance
Monitor relevant measures, conduct internal audits and document management review.
Correct and adapt
Address nonconformities, corrective actions and continual improvement of privacy management.
Integrate when useful
Operate the PIMS independently or align it structurally with an existing ISO/IEC 27001 system.
Product evidence boundary
Documented privacy operations, without an unsupported framework claim.
STORM has substantial privacy and management-system workflows, but the supplied technical description does not document a ready-made ISO/IEC 27701:2025 assessment.
Documented STORM building blocks
- ROPA, data identification and GDPR data mapping
- DPIA and data-subject impact evaluation
- Risk, policy, supplier and incident workflows
- GDPR assessments, audit findings and actions
- Management-review records and evidence exports
Must be confirmed or configured
- Licensed ISO/IEC 27701:2025 requirement content
- Ready-made PIMS assessment and control mappings
- Controller and processor control taxonomy
- PIMS-specific objectives, metrics and reports
- Consent and data-subject request automation
Where STORM can support a PIMS
Connect privacy accountability to the work that proves it.
STORM links processing context, privacy impact, provider oversight, controlled documentation, risk decisions and review records in a common operating environment.
Maintain processing context
Build records of processing and data maps alongside services, systems, users, locations, information assets and external providers.
ROPA · data mapping · CartographyAssess privacy consequences
Use the documented DPIA workflow and questionnaires to evaluate impact on data subjects and retain downloadable assessment records.
DPIA · impact evidenceControl privacy documents
Manage policies and procedures through authoring, versions, approvals, reviews, acknowledgements, reminders and mappings.
Policy Center · lifecycleTreat privacy risk
Record likelihood, impact, controls, treatment decisions, mitigation actions, owners, dates and supporting attachments.
Risk Registry · treatmentAssess external parties
Maintain supplier records, apply configurable assessment criteria, request evidence and track remediation and monitoring.
TPRM · supplier evidenceAudit, review and improve
Bring assessment status, findings, risks, incidents, supplier results, policy status and actions into structured reviews.
Audit · management review
Build the privacy context
Connect processing records to the organisation around them.
STORM documents ROPA and GDPR data mapping within a connected asset model. That makes privacy scope easier to relate to services, systems, people, locations and suppliers.
- Data and processing activity records
- Flows and operational dependencies
- Reusable context for risk and assessment
Assess impact and risk
Keep privacy consequences and treatment connected.
The technical description explicitly documents DPIA and data-subject impact evaluation. Related concerns can be managed as custom risks with controls, treatment, owners and evidence.
- DPIA questionnaires and impact results
- Legal, financial and business consequences
- Risk treatment and mitigation actions
Govern documented information
Make privacy policy a maintained operating record.
Use document ownership, workflow, review schedules and acknowledgement evidence to keep policies and procedures current and auditable.
- Authors, reviewers and approvers
- Version history and scheduled review
- Acknowledgements and audit trail
Review and improve
Bring evidence, gaps and incidents into management oversight.
Configurable assessments, internal audits, incident records and management-review inputs support an evidence-led improvement cycle. PIMS-specific content still needs confirmation and configuration.
- Implementation status and gap visibility
- Findings, corrective actions and target dates
- Review decisions retained for follow-through
Practical PIMS themes01 02 03 04 05 06 07 08
Make privacy accountability visible from scope to improvement.
These implementation themes do not reproduce or replace the licensed ISO/IEC 27701:2025 requirements.
Privacy context
Define processing roles, relevant interested parties, legal context and PIMS boundaries.
Scope · roles · requirementsProcessing records
Maintain structured information about PII, activities, purposes, systems, flows and providers.
ROPA · mapping · inventoryImpact & risk
Evaluate consequences for individuals and manage privacy risks through accountable decisions.
DPIA · risk · treatmentController duties
Organise the policies, decisions and evidence relevant when determining processing purposes and means.
Purpose · accountability · evidenceProcessor duties
Define and assess the responsibilities that apply when PII is processed for another organisation.
Instruction · service · assuranceSupplier governance
Evaluate external parties, collect evidence and monitor remediation around processing dependencies.
Due diligence · evidence · actionIncident response
Connect privacy-relevant events to investigation, ownership, corrective action and review.
Incident · escalation · learningPerformance & review
Use defined measures, audits and management decisions to drive continual improvement.
Monitor · audit · improveThe exact controller, processor and shared requirements must be determined from the licensed standard and the organisation's privacy context. STORM supports governance records; it does not replace qualified privacy or legal analysis.
Build the PIMS operating cycle01 02 03 04 05
From processing context to continual improvement.
A practical PIMS links requirements to records, accountable owners, evidence and management decisions.
Scope
Define roles, processing activities, PII, systems, suppliers and requirements.
Context · ROPA · mappingAssess
Evaluate privacy impacts, risks, provider posture and existing safeguards.
DPIA · risk · evidenceGovern
Approve policies, responsibilities, controls, procedures and action plans.
Policy · owners · controlsEvaluate
Monitor defined measures, assess implementation, audit and review performance.
Measures · audit · reviewImprove
Correct gaps, respond to incidents and retain learning and decisions.
Actions · change · improvementPractical questions
Separate PIMS support from unsupported product claims.
The 2025 standard, platform workflows, legal obligations and independent certification each have a distinct role.
Does STORM currently include a built-in ISO/IEC 27701:2025 assessment?
The supplied technical description does not list ISO/IEC 27701 among the currently supported standards and does not document a ready-made PIMS template. STORM provides strong privacy-management records and configurable assessments, while licensed 2025 requirements and mappings must be confirmed with ICT PROTECT.
Is ISO/IEC 27701:2025 still only an extension to ISO/IEC 27001?
No. ISO states that the 2025 edition is an independent management system standard. It can be implemented on its own and can also be aligned with an existing ISO/IEC 27001 system.
Can STORM support ROPA and DPIA activities?
Yes. The supplied technical description explicitly documents records of processing activities, GDPR data mapping, data-flow diagrams, DPIA questionnaires, evaluation of impacts on data subjects and downloadable impact reports.
Does STORM automate consent or data-subject requests?
Dedicated consent-management and data-subject request workflows are not documented. STORM should not be presented as providing those capabilities without further confirmed product evidence.
Does ISO/IEC 27701 certification guarantee GDPR compliance?
No. A PIMS can support accountability and evidence, but GDPR compliance depends on actual processing, roles, lawful obligations, controls and ongoing operations. Certification does not replace regulatory or legal assessment.
Can STORM issue ISO/IEC 27701 certification?
No. STORM can organise governance records and evidence. ISO confirms that the 2025 standalone PIMS can be independently certified, but the audit and certification decision must be made through an appropriate independent certification process.
How does ISO/IEC 27701 differ from ISO/IEC 27018?
ISO/IEC 27701:2025 establishes a broad, standalone PIMS for PII controllers and processors. ISO/IEC 27018:2025 provides cloud-specific guidance for public-cloud providers acting as PII processors.
Bring your privacy operating model
Book a STORM demo Test STORM against the PIMS evidence you must actually maintain.
Review your ROPA, data maps, DPIAs, controller and processor roles, privacy risks, policies, suppliers, incidents and audits—and identify which ISO/IEC 27701:2025 content still needs configuration.