PIMS Scope and Roles Template (ISO/IEC 27701:2025)

PIMS Scope and Roles: [Organization name]

Defines the context, the PII controller and PII processor roles, the scope and the governance of a privacy information management system (PIMS) under ISO/IEC 27701:2025, the second edition, which is a stand-alone management system standard that can be certified without ISO/IEC 27001. It also records how the PIMS relates to an ISMS under ISO/IEC 27001:2022 + Amd 1:2024 when both are run, and the route to certification by a body that meets ISO/IEC 27706:2025. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice.

Document control

Approvals

Revision history

Contents

1. Purpose and use of this document
2. ISO/IEC 27701:2025 at a glance
3. Context of the organization for privacy
4. Processing inventory and role determination
5. PIMS scope statement
6. Privacy policy framework
7. Relationship with the ISMS
8. Leadership, roles and responsibilities
9. Certification route
10. Size tiers
11. Records and evidence
12. Review and maintenance
13. References

1. Purpose and use of this document

This document records the decisions that frame the PIMS of [Organization name]: the internal and external issues that affect privacy, the interested parties and their privacy requirements, the role the organization plays for each processing activity, the boundaries of the PIMS and the people accountable for it. It is the reference point for the PIMS Statement of Applicability (DOC-ISMS-101), the privacy risk assessment, the record of processing activities and the certification application.

Use it in three situations:

• Design: when the PIMS is first planned, to agree scope and roles before controls are selected.
• Change: when a new service, a new customer type, a new country or an acquisition changes the processing landscape.
• Audit: as the first document shown to internal auditors and to the certification body at Stage 1.

2. ISO/IEC 27701:2025 at a glance

ISO/IEC 27701:2025 is the second edition of the PIMS standard. The first edition (2019) was written as an extension to ISO/IEC 27001 and ISO/IEC 27002, so an organization could only certify its PIMS together with an ISMS. The 2025 edition is a stand-alone management system standard: it contains its own requirements for establishing, implementing, maintaining and continually improving a PIMS, and an organization can be certified to it without holding an ISO/IEC 27001 certificate.

What you can rely on when planning, subject to checking your copy:

Record here the clause and annex references you confirmed in your copy, so later documents cite them consistently:

Organizations certified to the 2019 edition should agree a transition plan with their certification body. Published summaries report a transition period of about three years, ending in October 2028, but the exact dates come from the accreditation framework and your body: ask it for its transition deadline and audit approach rather than assuming one.

3. Context of the organization for privacy

3.1 Internal and external issues

3.2 Interested parties and their privacy requirements

Keep the legal and contractual obligations themselves in the legal register (DOC-ISMS-014), with one row per law or contract type, and reference those rows here instead of repeating them.

4. Processing inventory and role determination

The role decides which control set applies. Use the decision flow below for each processing activity in the record of processing activities (compliance/gdpr-ropa), then record the result in the table.

PA-004 shows the typical trap: analytics on customer data for the provider's own purposes turns a processor into a controller for that activity. Decide it consciously, document the lawful basis and tell customers, or stop the processing.

5. PIMS scope statement

Scope statement (Example): "The privacy information management system of [Organization name] covering the processing of personally identifiable information as PII processor in the provision of the [service name] SaaS platform, and as PII controller for customer account, employee and marketing data, operated from [office location] and remote locations, with production hosted in [cloud regions]."

An exclusion is acceptable only when it does not affect the ability to protect PII that is in scope. Record the effect of each interface in the supplier register (DOC-ISMS-066).

6. Privacy policy framework

Manage all of them under the documented information rules in DOC-ISMS-028 so versions, approvals and distribution are consistent.

7. Relationship with the ISMS

Choose the model that fits:

When the PIMS and ISMS both run:

• Keep one risk process (DOC-ISMS-010) with two lenses: risks to the organization and risks to data subjects. Privacy risks score impact on individuals, not only on the business.
• Keep one internal audit programme (DOC-ISMS-082) with PIMS topics planned explicitly, and one management review (DOC-ISMS-085) with a standing privacy agenda item.
• Map the security controls for PII in the PIMS SoA to the ISMS SoA (DOC-ISMS-011) so evidence is collected once.
• Align scopes or explain the difference. A PIMS that covers a service the ISMS excludes needs its own security evidence for that service.

8. Leadership, roles and responsibilities

Record the full RACI in DOC-ISMS-006 and the competence requirements in DOC-ISMS-026.

9. Certification route

Certification bodies for PIMS work to ISO/IEC 17021-1:2015 together with ISO/IEC 27706:2025, which replaced ISO/IEC TS 27006-2:2021. When you select a body (DOC-ISMS-090):

1. Confirm it is accredited for ISO/IEC 27701:2025 by an accreditation body that is a signatory of the Global ACI MRA (formerly the IAF MLA). Global ACI replaced IAF and ILAC on 2026-01-01 and existing recognition continues. Check the certificate scope in the IAF CertSearch database (still operating at the time of writing; check).
2. Ask whether it can run combined or integrated audits with your ISO/IEC 27001 certification and how it calculates audit time for each.
3. Ask how it handles a scope that differs between the ISMS and the PIMS.

The cycle follows ISO/IEC 17021-1: a two-stage initial audit, a three-year certificate, surveillance audits at least once each calendar year outside recertification years (the first no later than 12 months after the certification decision), and recertification before expiry. Audit time is set by the certification body; any figure in your plan is an Example.

10. Size tiers

11. Records and evidence

Add each record to the control evidence matrix (isms/control-evidence-matrix, DOC-ISMS-033) so internal audit and the certification body find it in one place. Set retention periods in line with data/data-retention-deletion-standard.

12. Review and maintenance

Review this document at least every 12 months and when any of these happens:

• a new product, feature or customer segment that processes PII;
• entry into a new country or a change of hosting region;
• a merger, acquisition or divestment;
• a change in a privacy law that applies to the organization;
• a significant personal data breach or an audit finding about scope or roles;
• a new edition or amendment of ISO/IEC 27701.

Record the review outcome in the revision history, even when nothing changes.

13. References

Standard and licence note

Structure aligned with ISO/IEC 27701:2025, ISO/IEC 27706:2025 and ISO/IEC 17021-1:2015, with links to ISO/IEC 27001:2022 + Amd 1:2024 and ISO/IEC 29100:2024. The tables, decision flow, scope wording and examples are original text; no text, control wording or tables from ISO/IEC standards are reproduced, and clause and annex references are left for you to confirm in the official standard, which you need to implement the requirements. Check the current edition of each standard and any transition rules of your certification body before use. GDPR is cited as an example only.

Template licence: MIT.