Information Security, Privacy & IT
ISO/IEC 27701:2025 Privacy Information Management – Lead Auditor
Overview
A professional programme for those who plan, lead and report management-system audits against ISO/IEC 27701:2025. It follows the audit principles of ISO 19011 and covers the full audit cycle — from planning and opening meeting to findings, nonconformity grading, reporting and follow-up — through realistic case work and role play.
The standard
About the standard
ISO/IEC 27701:2025
Privacy Information Management System
The 2025 edition turns privacy information management into its own stand-alone, certifiable management-system standard rather than a bolt-on to ISO/IEC 27001. It sets out requirements and supporting guidance for building and continually improving a Privacy Information Management System covering both organizations that control personal data and those that process it on others' behalf. Because certification no longer requires first holding an ISO/IEC 27001 certificate, the standard broadens its reach while still allowing integration with ISO/IEC 27001 for organizations that want it.
Key objectives
- Define requirements for a stand-alone Privacy Information Management System
- Allow independent PIMS certification without a prerequisite ISMS certificate
- Distinguish obligations for PII controllers versus PII processors
- Enable integration with ISO/IEC 27001 and other management-system standards
- Help organizations evidence compliance with global data-protection laws
Who uses it
Organizations that process personal data as controllers or processors.
Contribution to the SDGs
Per ISO, ISO/IEC 27701 contributes to the following UN Sustainable Development Goals:
Learning outcomes
What you will be able to do
- Interpret the requirements of ISO/IEC 27701:2025 in an audit context
- Plan an audit programme and an individual audit, including scope, criteria and sampling
- Lead an audit team and conduct opening and closing meetings
- Collect and evaluate objective evidence through interview, observation and document review
- Grade nonconformities and write clear, defensible audit findings
- Prepare the audit report and follow up corrective actions
Who should attend
Auditors, consultants, management representatives and professionals who want to lead first-, second- or third-party audits.
More in Information Security, Privacy & IT
All Information Security, Privacy & IT
Internal AuditorISMS-01Information Security, Privacy & IT
ISO/IEC 27001:2022 Information Security – Internal Auditor
Lead AuditorISMS-02Information Security, Privacy & IT
ISO/IEC 27001:2022 Information Security – Lead Auditor
Lead ImplementerISMS-03Information Security, Privacy & IT
ISO/IEC 27001:2022 Information Security – Lead Implementer
AXIOS · Certification body
Looking for management-system certification?
AXIOS certification is a separate, impartial certification body: audits, certification decisions and the public register of ISO certificates.