PIMS Statement of Applicability Template (ISO/IEC 27701:2025)

PIMS Statement of Applicability: [Organization name]

Statement of Applicability (SoA) for a privacy information management system (PIMS) under ISO/IEC 27701:2025. It records, for every control in the standard's control sets for PII controllers, PII processors and information security for PII, whether the control applies, why, its implementation status, its owner and its evidence, with an example mapping to GDPR articles. Control references are left as [27701 control ref] placeholders: fill them from your copy of the standard. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. How the ISO/IEC 27701:2025 control sets are organized
3. Decision rules
4. Columns and values
5. Summary
6. PII controller controls
7. PII processor controls
8. Information security controls for PII
9. Justification of exclusions
10. Example mapping to GDPR articles
11. Size tiers
12. Records and evidence
13. Review and maintenance
14. References

1. Purpose and scope

This SoA records the decision on every control in ISO/IEC 27701:2025 for the PIMS of [Organization name] defined in DOC-ISMS-100. For each control it gives the decision, the reason, the implementation status, the owner and where the evidence is kept. It is used to:

• show the certification body which controls the organization claims to operate and why others are excluded;
• give control owners one list of what they must keep running;
• connect privacy risks, legal duties and customer commitments to concrete controls;
• support customer and regulator questions about privacy practice.

In-scope roles: [controller for PA-002, PA-003, PA-004, PA-005; processor for PA-001] (Example, activity IDs from DOC-ISMS-100).

2. How the ISO/IEC 27701:2025 control sets are organized

The 2025 edition groups its controls by the role in which PII is processed, plus a set of information security controls that apply to all PII processing:

Write the official control reference in the "27701 ref" column and a short label of your own in the "Label" column. Do not copy control titles or control text into this document. Where the standard gives implementation guidance for a control, read it before deciding applicability, and record in the justification column how your implementation meets the intent.

3. Decision rules

A control is applicable when at least one basis applies to a processing activity in scope. A control is not applicable only when no basis applies, and the reason is written in section 9.

The PIMS owner proposes decisions. The DPO reviews every exclusion and every controller decision that affects data subjects. Top management approves the SoA as a whole.

4. Columns and values

Status meanings: Implemented means operating with evidence for at least one full cycle; Partial means designed and partly operating, with the remaining work in the risk treatment plan (DOC-ISMS-013); Planned means approved but not yet operating, with a due date; Not applicable means excluded with a reason in section 9.

5. Summary

Check: for each set, Applicable plus Not applicable equals the controls in the standard, and Implemented plus Partial plus Planned equals Applicable.

6. PII controller controls

7. PII processor controls

8. Information security controls for PII

9. Justification of exclusions

An exclusion is not a way to accept risk. If a control applies but the organization chooses not to implement it fully, keep it Applicable with status Partial or Planned and record the risk acceptance in DOC-ISMS-019.

10. Example mapping to GDPR articles

A control can support several articles, and an article can need several controls. Mapping a control to an article does not prove compliance with that article: compliance depends on how the control is operated.

11. Size tiers

12. Records and evidence

Add every evidence record to the control evidence matrix (isms/control-evidence-matrix, DOC-ISMS-033), so internal audit and the certification body can trace each row to proof.

13. Review and maintenance

Review the SoA at least every 12 months and when:

• the PIMS scope or a role in DOC-ISMS-100 changes;
• the privacy risk assessment adds, changes or closes a risk that a control treats;
• a law, regulator guidance or customer contract adds a requirement;
• an incident, audit finding or management review decision affects a control;
• a new edition or amendment of ISO/IEC 27701 is published.

14. References

Standard and licence note

Structure aligned with ISO/IEC 27701:2025, with links to ISO/IEC 27001:2022 + Amd 1:2024 and ISO/IEC 29100:2024. The column design, decision rules, labels, example rows and GDPR mapping are original text. No control text, control titles, numbering tables or guidance from ISO/IEC standards are reproduced: control references are placeholders that you fill from the official standard, which you need to implement the requirements. Check the current edition of ISO/IEC 27701 and the consolidated GDPR text before use.

Template licence: MIT.