PIMS Statement of Applicability Template (ISO/IEC 27701:2025)

PIMS SoA for ISO/IEC 27701:2025: controller, processor and security control matrices, decision rules, exclusions, GDPR article mapping example

ISMS 与 ISO/IEC 27001完整ISO/IEC 27701:2025 (cited only); GDPR as example mappingpims 27701 statement applicability更新于 2026年11月1日

在编辑器中打开下载 .md

使用方法: Use it after the PIMS scope and roles are approved and the privacy risk assessment is done. Fill the column rules first, then copy every control reference from the official standard. The main pitfall is excluding controller controls because the organization is mainly a processor.

预览

PIMS Statement of Applicability: [Organization name]

Statement of Applicability (SoA) for a privacy information management system (PIMS) under ISO/IEC 27701:2025. It records, for every control in the standard's control sets for PII controllers, PII processors and information security for PII, whether the control applies, why, its implementation status, its owner and its evidence, with an example mapping to GDPR articles. Control references are left as [27701 control ref] placeholders: fill them from your copy of the standard. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice.

Document control

Field	Value
Document ID	DOC-ISMS-101
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@privacy-lead]
Approvers/reviewers	[@dpo], [@isms-manager], [@legal-counsel], [@ceo]
Last updated	YYYY-MM-DD
Classification	[Internal / Confidential]
Standard and edition	ISO/IEC 27701:2025
Next scheduled review	YYYY-MM-DD (at least every 12 months and after any scope, role or risk change)
PIMS scope reference	DOC-ISMS-100, PIMS scope and roles, version [x.y]
Roles covered	[PII controller / PII processor / both]
Privacy risk assessment reference	[Risk register DOC-ISMS-016, assessment dated YYYY-MM-DD]
ISMS SoA reference (if any)	[DOC-ISMS-011, version x.y / Not applicable]

Approvals

Role	Name	Decision	Date
PIMS owner	[@privacy-lead]	[Prepared]	YYYY-MM-DD
Data protection officer	[@dpo]	[Reviewed]	YYYY-MM-DD
ISMS manager	[@isms-manager]	[Reviewed]	YYYY-MM-DD
Top management	[@ceo]	[Approved / Approved with changes]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0 (Example)	YYYY-MM-DD	[@privacy-lead]	First approved PIMS SoA for Stage 1
1.1 (Example)	YYYY-MM-DD	[@privacy-lead]	Controller row CTL-ROW-004 changed to Applicable after telemetry purpose was approved (RISK-044)
[x.y]	YYYY-MM-DD	[@author]	[Change summary]

Purpose and scope
How the ISO/IEC 27701:2025 control sets are organized
Decision rules
Columns and values
Summary
PII controller controls
PII processor controls
Information security controls for PII
Justification of exclusions
Example mapping to GDPR articles
Size tiers
Records and evidence
Review and maintenance
References

1. Purpose and scope

This SoA records the decision on every control in ISO/IEC 27701:2025 for the PIMS of [Organization name] defined in DOC-ISMS-100. For each control it gives the decision, the reason, the implementation status, the owner and where the evidence is kept. It is used to:

show the certification body which controls the organization claims to operate and why others are excluded;
give control owners one list of what they must keep running;
connect privacy risks, legal duties and customer commitments to concrete controls;
support customer and regulator questions about privacy practice.

In-scope roles: [controller for PA-002, PA-003, PA-004, PA-005; processor for PA-001] (Example, activity IDs from DOC-ISMS-100).

2. How the ISO/IEC 27701:2025 control sets are organized

The 2025 edition groups its controls by the role in which PII is processed, plus a set of information security controls that apply to all PII processing:

Control set	Applies when	Section of this SoA	Reference in the standard
PII controller controls	The organization decides purposes and means for at least one activity	6	[27701 annex ref]
PII processor controls	The organization processes PII on behalf of a customer or another controller	7	[27701 annex ref]
Information security controls for PII	Any PII processing in scope, whatever the role	8	[27701 annex ref]

Write the official control reference in the "27701 ref" column and a short label of your own in the "Label" column. Do not copy control titles or control text into this document. Where the standard gives implementation guidance for a control, read it before deciding applicability, and record in the justification column how your implementation meets the intent.

3. Decision rules

A control is applicable when at least one basis applies to a processing activity in scope. A control is not applicable only when no basis applies, and the reason is written in section 9.

Code	Basis	Typical source
R	Treats an assessed privacy or security risk	Risk register ID, for example RISK-044
L	Legal or regulatory requirement	Legal register row in DOC-ISMS-014
C	Contractual requirement	Customer data processing agreement, joint controller arrangement
B	Business decision or adopted good practice	Policy decision, management review minute
ROLE	Applies because of the role determined in DOC-ISMS-100	Activity ID, for example PA-001

The PIMS owner proposes decisions. The DPO reviews every exclusion and every controller decision that affects data subjects. Top management approves the SoA as a whole.

4. Columns and values

Column	Content	Allowed values or format
Row ID	Stable ID for this SoA row	CTL-ROW-NNN (controller), PRC-ROW-NNN (processor), SEC-ROW-NNN (security)
27701 ref	Official control reference from the standard	`[27701 control ref]` until filled
Label	Short description written by you	Up to about eight words
Applicable	Decision	Yes / No
Basis	Why it applies	R, L, C, B, ROLE (one or more)
Justification	Short, testable reason for the decision and how it is met	One or two sentences
Status	Implementation status	Implemented / Partial / Planned / Not applicable
Owner	Accountable control owner	[@role]
Evidence	Record that proves operation	Record name and location, linked in DOC-ISMS-033
Links	Risks, ROPA activities, ISMS controls, external mapping	IDs

Status meanings: Implemented means operating with evidence for at least one full cycle; Partial means designed and partly operating, with the remaining work in the risk treatment plan (DOC-ISMS-013); Planned means approved but not yet operating, with a due date; Not applicable means excluded with a reason in section 9.

5. Summary

Control set	Controls in the standard	Applicable	Not applicable	Implemented	Partial	Planned
PII controller controls	[n from the standard]	[n]	[n]	[n]	[n]	[n]
PII processor controls	[n from the standard]	[n]	[n]	[n]	[n]	[n]
Information security controls for PII	[n from the standard]	[n]	[n]	[n]	[n]	[n]
Total	[n]	[n]	[n]	[n]	[n]	[n]

Check: for each set, Applicable plus Not applicable equals the controls in the standard, and Implemented plus Partial plus Planned equals Applicable.

6. PII controller controls

Row ID	27701 ref	Label	Applicable	Basis	Justification	Status	Owner	Evidence	Links
CTL-ROW-001 (Example)	[27701 control ref]	Purposes identified and documented	Yes	L, ROLE	Each controller activity in the ROPA states its purpose	Implemented	[@privacy-lead]	ROPA controller part	PA-002 to PA-005
CTL-ROW-002 (Example)	[27701 control ref]	Lawful basis determined per purpose	Yes	L	Basis recorded per activity and reviewed annually	Implemented	[@dpo]	ROPA lawful basis column	GDPR Art. 6
CTL-ROW-003 (Example)	[27701 control ref]	Consent obtained and recorded where relied on	Yes	L	Marketing consent captured with timestamp and wording version	Partial	[@head-of-marketing]	Consent log export	PA-005, RISK-041
CTL-ROW-004 (Example)	[27701 control ref]	Privacy impact assessed for high-risk processing	Yes	L, R	DPIA screening for every new purpose, full DPIA when screening says so	Implemented	[@dpo]	DPIA register, `compliance/dpia`	PA-004, RISK-044
CTL-ROW-005 (Example)	[27701 control ref]	Information provided to data subjects	Yes	L	Public notice and staff notice approved and versioned	Implemented	[@dpo]	Notice versions	GDPR Art. 13, 14
CTL-ROW-006 (Example)	[27701 control ref]	Rights requests handled within deadlines	Yes	L	Requests logged and answered within the legal period	Implemented	[@privacy-lead]	Request log	`compliance/data-subject-request-procedure`
CTL-ROW-007 (Example)	[27701 control ref]	Collection limited to what is needed	Yes	L, R	Form and schema reviews in design	Partial	[@head-of-product]	Privacy by design reviews	`compliance/privacy-by-design-review`
CTL-ROW-008 (Example)	[27701 control ref]	Cross-border transfers assessed and documented	Yes	L	Transfer mechanism and assessment per destination	Planned	[@legal-counsel]	Transfer assessments	`compliance/transfer-impact-assessment`
[CTL-ROW-NNN]	[27701 control ref]	[Label]	[Yes / No]	[Codes]	[Reason]	[Status]	[@owner]	[Record]	[IDs]

7. PII processor controls

Row ID	27701 ref	Label	Applicable	Basis	Justification	Status	Owner	Evidence	Links
PRC-ROW-001 (Example)	[27701 control ref]	Processing agreement with each customer	Yes	C, L, ROLE	Standard DPA signed before production data is accepted	Implemented	[@legal-counsel]	Contract register	`legal-lite/dpa`, GDPR Art. 28
PRC-ROW-002 (Example)	[27701 control ref]	Processing only on documented instructions	Yes	C, ROLE	Service terms and DPA define instructions; new uses need customer agreement	Implemented	[@cto]	DPA, change records	PA-001
PRC-ROW-003 (Example)	[27701 control ref]	Customer assisted with rights and DPIAs	Yes	C	Support runbook for rights requests forwarded by customers	Implemented	[@head-of-support]	Ticket records	GDPR Art. 28(3)
PRC-ROW-004 (Example)	[27701 control ref]	Sub-processors disclosed and changes notified	Yes	C	Public sub-processor list, 30 days notice (Example) before changes	Implemented	[@legal-counsel]	Sub-processor list history	DOC-ISMS-066
PRC-ROW-005 (Example)	[27701 control ref]	Return or deletion at end of service	Yes	C, L	Export on request, deletion within the period stated in the DPA	Partial	[@cto]	Deletion certificates	RISK-047
PRC-ROW-006 (Example)	[27701 control ref]	Customer informed of legally binding disclosure requests	Yes	C	Requests reviewed by legal, customer told unless prohibited	Implemented	[@legal-counsel]	Disclosure request log	`isms/cloud-pii-27018-processor`
[PRC-ROW-NNN]	[27701 control ref]	[Label]	[Yes / No]	[Codes]	[Reason]	[Status]	[@owner]	[Record]	[IDs]

8. Information security controls for PII

Row ID	27701 ref	Label	Applicable	Basis	Justification	Status	Owner	Evidence	Links
SEC-ROW-001 (Example)	[27701 control ref]	Access to PII restricted by role	Yes	R	Role-based access with quarterly reviews	Implemented	[@isms-manager]	Access review records	ISMS A.5.15, DOC-ISMS-041
SEC-ROW-002 (Example)	[27701 control ref]	PII encrypted in transit and at rest	Yes	R, C	Cryptography standard applied to all PII stores	Implemented	[@cto]	Configuration evidence	ISMS A.8.24, `security/cryptography-standard`
SEC-ROW-003 (Example)	[27701 control ref]	Logging of access to PII	Yes	R	Access logs kept and reviewed	Partial	[@security-lead]	Log review records	ISMS A.8.15
SEC-ROW-004 (Example)	[27701 control ref]	Personal data breaches managed	Yes	L, C	Incident process includes breach assessment and notification	Implemented	[@dpo]	Incident register DOC-ISMS-021	ISMS A.5.24 to A.5.28
SEC-ROW-005 (Example)	[27701 control ref]	Test data does not use live PII without approval	Yes	R	Masked data sets for test environments	Planned	[@head-of-engineering]	Test data approvals	ISMS A.8.33, DOC-ISMS-062
[SEC-ROW-NNN]	[27701 control ref]	[Label]	[Yes / No]	[Codes]	[Reason]	[Status]	[@owner]	[Record]	[IDs]

9. Justification of exclusions

Row ID	Reason for exclusion	Fact that supports it	Approved by	Date	Revisit trigger
PRC-ROW-0NN (Example, controller-only organization)	Processor role not performed	DOC-ISMS-100 lists no processor activity	[@dpo]	YYYY-MM-DD	Any new service for customers
CTL-ROW-0NN (Example)	No processing of children's data	Terms restrict users to adults; product does not target children	[@dpo]	YYYY-MM-DD	New consumer product
[Row ID]	[Reason]	[Fact]	[@approver]	YYYY-MM-DD	[Trigger]

An exclusion is not a way to accept risk. If a control applies but the organization chooses not to implement it fully, keep it Applicable with status Partial or Planned and record the risk acceptance in DOC-ISMS-019.

10. Example mapping to GDPR articles

Privacy topic	SoA rows	GDPR articles (example)	Supporting template
Principles and accountability	CTL-ROW-001, CTL-ROW-007	Art. 5, Art. 24	`compliance/gdpr-ropa`
Lawful basis and consent	CTL-ROW-002, CTL-ROW-003	Art. 6, Art. 7, Art. 9	`compliance/gdpr-ropa`
Transparency	CTL-ROW-005	Art. 12, Art. 13, Art. 14	`legal-lite/privacy-policy`
Data subject rights	CTL-ROW-006, PRC-ROW-003	Art. 15 to Art. 22	`compliance/data-subject-request-procedure`
Privacy by design and by default	CTL-ROW-007	Art. 25	`compliance/privacy-by-design-review`
Processor contracts and instructions	PRC-ROW-001, PRC-ROW-002, PRC-ROW-004	Art. 28, Art. 29	`legal-lite/dpa`
Records of processing	CTL-ROW-001	Art. 30	`compliance/gdpr-ropa`
Security of processing	SEC-ROW-001 to SEC-ROW-005	Art. 32	`compliance/statement-of-applicability`
Breach notification	SEC-ROW-004	Art. 33, Art. 34	`compliance/personal-data-breach-assessment`
Impact assessment	CTL-ROW-004	Art. 35, Art. 36	`compliance/dpia`
International transfers	CTL-ROW-008	Art. 44 to Art. 49	`compliance/transfer-impact-assessment`
Return and deletion	PRC-ROW-005	Art. 28(3)(g)	`data/data-retention-deletion-standard`

A control can support several articles, and an article can need several controls. Mapping a control to an article does not prove compliance with that article: compliance depends on how the control is operated.

11. Size tiers

Topic	Small: Quillmere Analytics Ltd	Medium: Quillmere Health Systems	Large: Quillmere Group
Roles covered	Processor for customer data, controller for 46 staff (38 employees, 8 contractors) and customer contacts	Processor for hospitals, controller for 320 staff and marketing data	Mainly controller across 6 sites in 4 countries, processor for some group services
SoA format	One spreadsheet or Markdown file, rows grouped by set	One SoA with a sheet per control set, linked to the ISMS SoA prepared for the 27001 audit	Group SoA plus site annexes listing local variations and owners
Typical exclusions	Few: controller set mostly applies to HR and contacts	Children's data in its own controller activities (staff and marketing), with patient data handled under the processor set (Example)	Rare; each site justifies local differences
Approval	Head of Engineering Operations (0.5 FTE ISMS manager) and CEO, external DPO reviews	ISMS manager, DPO, executive committee	CISO, group DPO, group executive with site sign-off
Timing	With the ISMS SoA, 6-month ISO/IEC 27001 target	In the year after the 27001 certificate (27001 target 10 months)	Phased by site after the group ISMS (27001 target 15 months) (Example)

12. Records and evidence

Record	Proves	Owner	Location	Retention
Approved SoA versions	Decisions controlled and approved	[@privacy-lead]	[Document system]	Current plus [3] years (Example)
Exclusion approvals	Each exclusion reviewed by the DPO	[@dpo]	Section 9, approval records	Same as SoA
Evidence listed per row	Controls operate	Control owners	Linked in DOC-ISMS-033	Per `data/data-retention-deletion-standard`
Risk treatment plan entries	Partial and Planned rows are tracked	[@isms-manager]	DOC-ISMS-013	[3] years (Example)
Internal audit results on SoA rows	Rows tested independently	[@internal-auditor]	DOC-ISMS-084	[3] years (Example)

Add every evidence record to the control evidence matrix (isms/control-evidence-matrix, DOC-ISMS-033), so internal audit and the certification body can trace each row to proof.

13. Review and maintenance

Review the SoA at least every 12 months and when:

the PIMS scope or a role in DOC-ISMS-100 changes;
the privacy risk assessment adds, changes or closes a risk that a control treats;
a law, regulator guidance or customer contract adds a requirement;
an incident, audit finding or management review decision affects a control;
a new edition or amendment of ISO/IEC 27701 is published.

14. References

Reference	Edition	Use
ISO/IEC 27701:2025, https://www.iso.org/standard/85819.html	Second edition, 2025	PIMS control sets and SoA requirement
ISO/IEC 27706:2025, https://www.iso.org/standard/82894.html	2025	PIMS certification bodies
ISO/IEC 29100:2024, https://www.iso.org/standard/85938.html	2024	Privacy principles
ISO/IEC 27001:2022 + Amd 1:2024, https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html	Current	ISMS SoA linkage
ISO/IEC 27018:2025, https://www.iso.org/standard/88150.html	2025	Public cloud PII processors
GDPR, Regulation (EU) 2016/679	As amended; check the consolidated text	Example mapping in section 10
Related templates		`isms/pims-27701-scope-roles`, `compliance/statement-of-applicability`, `compliance/gdpr-ropa`, `compliance/dpia`, `compliance/data-subject-request-procedure`, `compliance/personal-data-breach-assessment`, `compliance/transfer-impact-assessment`, `isms/cloud-pii-27018-processor`, `isms/control-evidence-matrix`

Standard and licence note

Structure aligned with ISO/IEC 27701:2025, with links to ISO/IEC 27001:2022 + Amd 1:2024 and ISO/IEC 29100:2024. The column design, decision rules, labels, example rows and GDPR mapping are original text. No control text, control titles, numbering tables or guidance from ISO/IEC standards are reproduced: control references are placeholders that you fill from the official standard, which you need to implement the requirements. Check the current edition of ISO/IEC 27701 and the consolidated GDPR text before use.

Template licence: MIT.