Markdown Editor
Open the editor

ISO/IEC 27701 PIMS Kit

Extend the ISMS into a privacy information management system: PIMS scope and roles, RoPA, 27701 SoA, DPIA, privacy by design, 27018 processor controls, data subject requests, breaches and transfers.

10 templates in 3 steps, in the order you use them. Open any template in the editor, fill it in and export it to PDF, DOCX or HTML.

Step 1

Framing

  1. PIMS Scope and Roles Template (ISO/IEC 27701:2025)

    Full

    PIMS framing for ISO/IEC 27701:2025: privacy context, role per processing activity, scope statement, policy links, ISMS relationship, certification route

    ISO/IEC 27701:2025 (cited only); ISO/IEC 27706:2025; ISO/IEC 17021-1:2015; ISO/IEC 29100:2024

  2. Management System Scope Statement Template

    Standard

    Management system scope (cl. 4.3): 4.1 issues incl. climate and AI role, 4.2 parties, scope sentence (QMS and ISO 42001 examples), interfaces, exclusions

    ISO harmonized structure cl. 4.1 to 4.3 incl. Amd 1:2024 (ISO 9001:2026, ISO/IEC 27001:2022 + Amd 1:2024, ISO/IEC 27701:2025, ISO/IEC 42001:2023)

  3. GDPR Record of Processing Activities (ROPA) Template

    Full

    GDPR Art. 30 record: controller fields (1)(a)-(g), processor fields (2)(a)-(d), lawful basis, classification, retention rule, Chapter V transfers

    GDPR Art. 30; Chapter V (Art. 44-49)
Step 2

Planning

  1. PIMS Statement of Applicability Template (ISO/IEC 27701:2025)

    Full

    PIMS SoA for ISO/IEC 27701:2025: controller, processor and security control matrices, decision rules, exclusions, GDPR article mapping example

    ISO/IEC 27701:2025 (cited only); GDPR as example mapping

  2. Data Protection Impact Assessment (DPIA) Template

    Full

    GDPR Art. 35 DPIA: WP248 screening, processing description, necessity, scored risk register, measures, DPO advice, Art. 36 prior consultation, review

    GDPR Art. 35-36; WP248 rev.01 (EDPB-endorsed); EDPB DPIA template v1.0 (2026)

  3. Privacy-by-Design Review Template (GDPR Art. 25, ISO 31700-1)

    Full

    Scope, data inventory, consumer privacy requirements, default decisions, minimisation, user controls, notice and consent, lifecycle, third parties, evidence

    GDPR Art. 25; EDPB Guidelines 4/2019 v2.0; ISO 31700-1:2023
Step 3

Operations

  1. Public Cloud PII Processor Controls Template (ISO/IEC 27018:2025)

    Full

    ISO/IEC 27018:2025 for cloud PII processors: customer commitments, transparency, sub-processors, deletion, disclosure requests, breach notice, control table

    ISO/IEC 27018:2025 (cited only); ISO/IEC 27002:2022; ISO/IEC 29100:2024

  2. Data Subject Request Procedure Template (GDPR DSAR, CCPA)

    Full

    DSAR procedure: rights by regime, intake, identity checks, search plan, GDPR and CCPA deadlines, exemptions, per-right checklists, letters, log, metrics

    GDPR Arts 12-23; EDPB Guidelines 01/2022 v2.1; CCPA Civ. Code 1798.100 ff.; CCPA Regulations (eff. 2026-01-01)

  3. Personal Data Breach Assessment Template (GDPR Art. 33 and 34)

    Full

    Breach triage, awareness and 72-hour clock, risk to individuals, Art. 33/34 notification decision, authority and data subject texts, breach log entry

    GDPR Arts 33-34; EDPB Guidelines 9/2022 v2.0

  4. Transfer Impact Assessment (TIA) Template, GDPR Chapter V

    Standard

    EDPB six-step TIA for one Art. 46 transfer: transfer facts, tool, destination law, supplementary measures, procedural steps, re-evaluation, UK and US notes

    EDPB Recommendations 01/2020 v2.0; SCCs (EU) 2021/914