Resources
The ISO 27701 privacy (PIMS) toolkit
ISO 27701 extends an ISO 27001 ISMS into a privacy information management system, adding management clauses plus Annex A controls that split by whether you act as a PII controller or a PII processor. This toolkit gives you a plain-language guide and a ready-to-use Control Pack for every one, with DPDP Act context throughout, published one guide a day.
22 of 43 guides published
A new guide publishes every day.
Clause 4 · Context of the organization
4 of 4 liveClause 5 · Leadership
3 of 3 liveClause 6 · Planning
3 of 3 liveClause 7 · Support
4 of 5 live- 7.1Resources
- 7.2Competence
- 7.3Awareness
- 7.4Communication
- 7.5Documented Information11 Nov 2026
Clause 8 · Operation
0 of 3 live- 8.1Operational Planning and Control12 Nov 2026
- 8.2Privacy Risk Assessment13 Nov 2026
- 8.3Privacy Risk Treatment14 Nov 2026
Clause 9 · Performance evaluation
1 of 3 live- 9.1Monitoring, Measurement, Analysis and Evaluation15 Nov 2026
- 9.2Internal Audit
- 9.3Management Review17 Nov 2026
Clause 10 · Improvement
0 of 2 live- 10.1Continual Improvement18 Nov 2026
- 10.2Nonconformity and Corrective Action19 Nov 2026
A.1 · Annex A, PII controllers
0 of 11 live- A.1.2Conditions for Collection and Processing (Remaining)20 Nov 2026
- A.1.2.2Identify and Document Purpose21 Nov 2026
- A.1.2.3Identify Lawful Basis22 Nov 2026
- A.1.2.5Obtain and Record Consent23 Nov 2026
- A.1.2.6Privacy Impact Assessment24 Nov 2026
- A.1.3Obligations to PII Principals (Remaining)25 Nov 2026
- A.1.3.7Access, Correction or Erasure26 Nov 2026
- A.1.3.11Automated Decision Making27 Nov 2026
- A.1.4Privacy by Design and Privacy by Default28 Nov 2026
- A.1.5Sharing Transfer and Disclosure (Remaining)29 Nov 2026
- A.1.5.2Identify Basis for PII Transfer Between Jurisdictions30 Nov 2026
A.2 · Annex A, PII processors
5 of 5 liveA.3 · Annex A, 27002 control themes
2 of 4 live- A.3Organisational Controls
- A.3People Controls7 Dec 2026
- A.3Physical Controls8 Dec 2026
- A.3Technological Controls
How we can help
Working toward ISO 27701?
If a customer, a regulator or your own board is asking whether you could keep operating through a serious disruption, tell us where you are. We'll give you an honest read on the work and the timeline, with no obligation.
What happens next
Tell us the trigger
A questionnaire, an audit date or an investor ask. The short form or a call both work.
A practitioner replies
A senior practitioner, not a bot, within four business hours.
You get a scoped next step
An honest view of what the work involves. No pressure, no theatre.