Last updated: 10 July 2026 · Part of our ISO Standards Revision Tracker
ISO/IEC 27701:2025, published 14 October 2025, turned privacy management into a standalone certifiable standard. Organizations can now certify a privacy information management system (PIMS) directly — without holding ISO 27001 first. Existing ISO 27701:2019 certificates must transition by 31 October 2028. For Philippine companies processing personal data, this is the most significant privacy-certification change in years.
The standalone shift — why it matters
The 2019 edition was an extension bolted onto ISO 27001: no ISMS certificate, no PIMS certificate. The 2025 edition stands alone as a full management system standard, and the companion ISO/IEC 27706:2025 gives certification bodies the accreditation basis to certify it independently. Practical effect: a BPO or fintech that never implemented ISO 27001 can now pursue an internationally recognized privacy certification directly. Source: ISO/IEC 27701:2025 on ISO.org.
What’s inside the 2025 edition
The PIMS framework moved from extension clauses into the full harmonized structure (clauses 4–10), aligning with ISO 27001:2022 and ISO 42001. Security controls are embedded via Annex A.3, so privacy protection does not float free of information security. Role-specific requirements for PII controllers and PII processors remain, letting the certificate reflect what your organization actually does with personal data. Governance and privacy risk management are strengthened throughout.
Why Philippine BPOs and IT-BPM companies should care
The sector runs on other people’s personal data — US healthcare records, EU customer files, financial data — under the Data Privacy Act (RA 10173) and NPC oversight at home, and GDPR-driven client scrutiny abroad. Client due-diligence questionnaires that once asked only about ISO 27001 now probe privacy programs specifically. A standalone ISO 27701:2025 certificate answers that question with third-party evidence, and differentiates in bids where competitors offer only self-declared compliance.
Already certified to ISO 27701:2019?
Work with your certification body to transition before 31 October 2028: gap analysis against the restructured requirements, updated privacy risk assessment and documentation, then the transition audit — typically at a scheduled surveillance visit. Accreditation bodies began transitioning certification bodies in 2026, so audit slots against the new edition are opening through this year.
Starting fresh?
Two routes: standalone PIMS certification (fastest to a privacy credential), or ISO 27001 + 27701 together (one integrated system covering security and privacy — usually the stronger long-term play for data-heavy operations). Which fits depends on client demands and your existing security posture. See ISO 27701 certification in the Philippines.
What standalone certification changes strategically for Philippine organizations
The standalone shift in ISO 27701:2025 redraws the strategic map in ways the technical summary undersells. Before, privacy certification was gated behind ISO 27001 — a sequencing that put an internationally recognized privacy credential out of reach for organizations whose clients asked privacy questions first and security questions second. Now the paths have multiplied: a BPO facing privacy-led due-diligence can certify its PIMS directly and answer the questionnaire this year; a company with mature security but scattered privacy practice can extend its existing ISMS with 27701 at surveillance-cycle cost; and a data-heavy operation starting fresh can build security and privacy as one integrated system with combined audits — usually the strongest three-year economics of the three. The choice is genuinely strategic, driven by which questions your clients ask, which regulator scrutiny you face, and what governance already exists. What no longer exists is the excuse: the prerequisite that kept mid-market Philippine processors out of privacy certification is gone, and early certificates are landing in bids where competitors still offer self-declared compliance.
The transition clock certified organizations should respect
For the organizations already holding ISO 27701:2019 certificates, the 31 October 2028 deadline deserves more respect than distant dates usually earn — because this transition is structural, not cosmetic. The move from extension clauses to the full harmonized structure, with security controls embedded through Annex A.3, means documentation mapping, gap analysis and genuine implementation work, not a re-badged certificate. The arithmetic that catches organizations out: transition at a scheduled surveillance audit and the work rides an existing visit; wait until 2028 and you compete for certification-body capacity with everyone else who waited, at exactly the moment ISO 9001:2026 transitions crowd the same calendars. Accreditation bodies began moving CBs onto the 2025 edition through 2026, so audit slots against the new edition are open now. The gap analysis takes a week; the comfortable version of this transition starts with it. Schedule yours.
Talk to a Sterling consultant, not a call centre: our lead auditors Mark Santos (Metro Manila), Zia Bautista (Cebu) and Ann Reyes (Davao) deliver every project on-site across the Philippines. Book a free consultation →
ISO 27701:2025 — frequently asked questions
Do we need ISO 27001 before getting ISO 27701 certified?
Not anymore. Since the 2025 edition, ISO 27701 is a standalone management system standard — organizations can certify their privacy program directly. Pairing it with ISO 27001 remains a strong option for combined security-and-privacy coverage, but it is no longer a prerequisite.
What is the deadline for ISO 27701:2019 certificates?
31 October 2028. Certification bodies must transition all certified clients to the 2025 edition by that date; miss it and the certificate lapses. Plan the upgrade at a scheduled surveillance audit well before the deadline.
How does ISO 27701 relate to the Philippine Data Privacy Act?
The DPA (RA 10173) and NPC issuances define your legal obligations; ISO 27701:2025 provides the certifiable management system to run them — privacy risk assessment, roles, records of processing, breach handling, and continuous improvement — with third-party audit evidence clients and regulators recognize.
Does the certificate distinguish controllers and processors?
Yes. The standard keeps role-specific requirements, so a BPO acting as a PII processor certifies against processor requirements, while a company deciding how personal data is used certifies as a controller — or both, where both roles apply.
How long does ISO 27701 certification take in the Philippines?
For an SME with reasonable existing controls, typically three to six months from gap assessment to certification audit; faster where ISO 27001 discipline already exists, longer where privacy processes are being built from scratch.
Is ISO 27701 equivalent to GDPR compliance?
No standard makes you automatically GDPR-compliant. ISO 27701:2025 operationalizes privacy obligations — including GDPR-aligned ones — into an auditable system, which is strong supporting evidence of accountability, not a legal compliance guarantee.
Weigh your route with us — contact us — or follow every privacy-standard date on the revision tracker.