ISO 27701:2025 Transition Guide

The ISO/IEC 27701:2025 standard (Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidelines) was published on October 14, 2025, replacing ISO/IEC 27701:2019.

A transition period of approximately three years from the publication date has been established for organizations certified by Proks within this scope to align their operations and processes with the new standard requirements. All certified organizations must complete their transition to the new standard by October 31, 2028.

Key Changes and Updates in ISO/IEC 27701:2025

Standalone Management System: The standard has been restructured into an independent management system standard.
Climate Change: Climate change considerations have been integrated into relevant clauses of the standard.
Annex A Controls: Control sets have been aligned with the ISO/IEC 27001:2022 standard.
Clarification of Roles: Controls for Data Controllers and Data Processors have been restructured for greater clarity.

Transition Timeline

Date	Activity / Implementation
October 14, 2025	Publication of ISO/IEC 27701:2025
March 31, 2028	Cut-off date for applications under ISO/IEC 27701:2019 (no further applications accepted after this date)
October 31, 2028	Final deadline for all certified clients to complete the transition (prior accreditations/certificates will no longer be valid after this date)