Privacy management that works as a system.

ISO/IEC 27701 is an international management-system standard for Privacy Information Management Systems (PIMS). It structures the establishment, operation, maintenance and continual improvement of a privacy management system.

ISO/IEC 27001 addresses information-security management through an ISMS. ISO/IEC 27701 addresses privacy management through a PIMS. The systems can work closely together but have different management objectives and evidence requirements.

A Privacy Information Management System connects privacy requirements with roles, responsibilities, documented rules, operational processes, evidence, review and continual improvement.

ISO/IEC 27701:2025 is structured as a standalone management-system standard. An organization can therefore establish its PIMS independently while still using interfaces to an existing ISMS.

ISO/IEC 27701 provides a management-system framework for organizing privacy obligations, responsibilities and evidence. The specific legal assessment under the GDPR and other privacy laws remains a separate responsibility.

No. A PIMS supports systematic privacy management and accountability, but it does not replace legal assessment or the organization’s responsibility to comply with applicable law.

A controller determines the purposes and essential means of processing personal data. A processor processes personal data on behalf of and under the instructions of the controller. The role affects obligations, contracts and evidence in the PIMS.

The required documentation depends on the organization, roles, processing activities, risks and governance. TCP Privacy connects structured inputs with versioned PIMS documents instead of assuming one universal document list.

A management system has to operate effectively. Responsibilities, decisions, workflows, registers, evidence, controls and improvements must work together in day-to-day operations and remain traceable.

Registers keep structured privacy facts and current states traceable. Evidence supports statements, decisions, controls and process steps. TCP Privacy connects both to operational work.

Readiness means that privacy management is not merely documented but actually works and can be reviewed through roles, processes, evidence, reviews and improvement mechanisms.

TCP Privacy supports establishment, operation, evidence and continual improvement of the PIMS and preparation for reviews and audits. Certification decisions are made solely by the independent certification body.

Internal audits assess defined criteria using traceable evidence. Management reviews evaluate the state and effectiveness of the management system. Results can trigger findings, actions and further improvement.

Corrective and Preventive Actions structure the handling of identified or potential deviations. The action itself is only one part; ownership, deadline, evidence and effectiveness review are equally important.

Changes to organization, processing, providers or governance can require reassessment and potentially a new PIMS version. TCP Privacy retains prior states and governs changes through versioning.

Relevant cases can be handled through structured workflows with inputs, decisions, evidence and governance steps. The required assessment depends on the specific process and the organization’s applicable requirements.

Provider information, reviews, decisions and evidence can be recorded in a structured way and maintained through operational workflows, keeping governance and execution connected.

TCP Privacy can govern concrete privacy cases through defined workflows. Steps, responsibilities, evidence and decisions remain bound to the applicable workflow and PIMS state.

AI can support structured content, drafts, translations and analysis. Authoritative sources, governance, roles, approvals and binding decisions remain controlled and are not replaced by unconstrained AI output.

Tenant administrators can download the tenant’s customer data as a verifiable ZIP backup. A controlled restore process can return consistent functional areas to the backup state; a safety backup is created before every destructive restore.

Tenant roles and permissions restrict access within the organization. Administrative and functional responsibilities are separated and governed according to required access.

TCP Privacy uses a tenant-based organization and permission structure. How multiple companies or units are represented depends on the chosen organizational model and edition.

The Essential edition can be evaluated for one month through the public trial process. The trial starts through registration on tcpops.com.