ISO/IEC 27701:2025

Alan Shipman is managing director at Group 5 Training Limited.Alan acted as project editor for the world’s first privacy information management international standard (ISO/IEC 27701:2019).He is Chair of IST/33/5, which is responsible for the UK’s contributions to the work of ISO/IEC JTC1/SC27/WG5, which deals with identity management and privacy technologies.Alan has more than 30 years’ experience managing personal information, both as a data processor for a service organisation and as a data controller. He is a regular speaker at conferences, covering all aspects of information management. Alan has been involved in the development of BS 10008 throughout its life (first published as guidance in 1996). This deals with the management of electronic information of all types, including the conversion of paper-based information to electronic forms. His experience includes advising organisations in both the public and private sector on the implementation of BS 10008.Alan can be contacted at a.shipman@group5.co.uk. Steve Watkins is a director at Kinsnall Consulting Ltd. He is a contracted technical assessor for UKAS – advising on its assessments of certification bodies offering ISO/IEC 27701/PIMS, ISO/IEC 27001/ISMS and ISO/IEC 20000-1/ITSMS accredited certification, and undertakes information security assessments of forensic science laboratories seeking accreditation to the Forensic Science Regulator’s codes of practice and conduct. Steve is a member of ISO/IEC JTC 1/SC 27, the international technical committee responsible for information security, cyber security and privacy standards, and from 2018 to 2025 chaired the UK National Standards Body’s technical committee IST/33 (information security, cyber security and privacy protection) that mirrors it. He is the ISO representative on the EU/ENISA Stakeholder Cybersecurity Certification Group (SCCG).Steve can be contacted at SteveGWatkins@Kinsnall.com.

• Contents:Chapter 1: What is privacy information management?Chapter 2: What needs to be considered?Chapter 3: ISO/IEC 27701 and the privacy information management system requirementsChapter 4: Legal, Regulatory and Contractual Requirements and Business RiskChapter 5: Privacy information management controlsChapter 6: CertificationChapter 7: Terms and definitionsFurther reading