Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance

The updated version of the Privacy Information Management System, which will replace ISO/IEC 27701:2019, is now in the approval phase. The final version is expected to be published in Q1 of 2025.

The standard specifies requirements for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS), and is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations

In anticipation of the updated version being released, privacy practitioners — including all controllers and processors responsible and accountable for PII processing — would be prudent to review the draft and use it to review and update existing policies, roles and responsibility descriptions, and risk management approaches.