ISO/IEC 27701:2025 Transition in the Philippines

ISO/IEC 27701:2025 is here: what Philippine organizations need to know first

ISO/IEC 27701:2025 was published on 14 October 2025 as the second edition of the international standard for privacy information management systems (PIMS), replacing ISO/IEC 27701:2019. Two changes matter commercially. First, the standard is now a standalone, certifiable management system standard — for the first time, an organization can pursue accredited ISO/IEC 27701 certification without holding ISO/IEC 27001. Second, organizations certified to the 2019 edition must transition: the published transition window closes on 31 October 2028, and certificates to the old edition are expected to expire or be withdrawn after that date.

Sterling helps Philippine organizations — BPO, IT-BPM and shared-services processors above all — plan and execute this transition, and prepares first-time implementers for standalone PIMS certification, always through an independent, accredited certification body. Sterling is a consultancy: we never issue certificates, and we would not want to — a certificate is only worth what the independent audit behind it verifies. Done properly, the outcome is more than a renewed certificate. It is standing, third-party-attested evidence of privacy accountability that holds up in front of GDPR-facing clients, Data Privacy Act (RA 10173) obligations, and the vendor due-diligence questionnaires that now decide outsourcing contracts. This page sets out what verifiably changed in the 2025 edition, who must act and by when, the transition path that works, and the mistakes already appearing in early transitions — with the same practitioner directness we bring to ISO/IEC 27701 PIMS consulting in the Philippines.

What actually changed in ISO/IEC 27701:2025 — and what did not

Plenty of pages are already inflating this revision into something it is not. Here is what is verifiable from the published standard and from the certification bodies’ own transition analyses — nothing more.

It is now a standalone requirements standard. The 2019 edition was, by its own title, an extension to ISO/IEC 27001 and ISO/IEC 27002. It could only be implemented and certified on top of an existing ISO/IEC 27001 information security management system, which locked privacy certification behind a security certification. The 2025 edition carries a new title — “Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance” — and is written as an independent management system standard. An organization can now build, operate and certify a PIMS in its own right.

The clause structure is complete. The 2019 edition worked by pointing at ISO/IEC 27001’s clauses and telling you how to adapt them for privacy. The 2025 edition contains its own full management-system skeleton in Clauses 4 to 10 — context, leadership, planning, support, operation, performance evaluation and improvement — written for privacy from the ground up and following the harmonized structure used across modern ISO management system standards. If you already run a management system, the shape will feel familiar; that is deliberate.

It is aligned to the 2022 information security control set. The 2019 edition was drafted against the ISO/IEC 27002:2013 control catalogue, which no longer exists in current certification practice. The 2025 edition draws on ISO/IEC 27001:2022 and ISO/IEC 27002:2022, so control references, numbering and vocabulary now match the current security editions rather than the retired 2013 ones. Organizations that completed the ISO/IEC 27001:2022 transition will recognize the control language immediately.

The annexes were consolidated. The control content now sits in a restructured Annex A that brings together the PII controller controls, the PII processor controls, and the information security control set. That last part deserves emphasis: going standalone does not mean privacy without security. The security controls travel with the PIMS, so a standalone certification still requires demonstrable information security discipline, not just privacy paperwork.

The controller/processor architecture is retained. The standard still distinguishes obligations by role — PII controller, PII processor, and organizations acting as both — and still exists to demonstrate accountable handling of personal information, including in support of regulations such as the GDPR. For Philippine service providers, that role-by-role architecture is precisely what client auditors examine.

Integration is still supported. Standalone does not mean isolated. The 2025 edition remains designed to integrate with ISO/IEC 27001 and with other management systems an organization already operates, so holders of an existing ISMS can continue to run one combined system with a single audit narrative.

What did not change is just as important. Published certification-body analyses consistently describe reorganization rather than a wave of net-new privacy controls: the substance of the 2019 controller and processor controls largely carries over, re-homed and renumbered. The transition workload is real — restructuring, remapping, evidence refresh — but it is not a second implementation. Anyone telling you to discard your PIMS and rebuild from a blank page is solving their revenue problem, not your transition.

Who must act, and by when

The transition arrangements published through the accreditation network set a three-year window from publication, ending on 31 October 2028. That single date hides several earlier ones that matter more in practice.

• Organizations certified to ISO/IEC 27701:2019. Your current certificate rides on the old edition. You must update the PIMS to the 2025 requirements, pass a transition audit with your accredited certification body, and have the certificate reissued before the window closes. After 31 October 2028, certificates to the 2019 edition are expected to expire or be withdrawn regardless of their printed expiry date.
• Organizations mid-implementation against the 2019 edition. Change course now and implement the 2025 edition directly. Certification bodies are expected to stop accepting new engagements against the 2019 edition as their own accreditation transitions complete — building to a retiring edition buys you a certificate with a countdown attached.
• Organizations without ISO/IEC 27001. This is the genuinely new population. Law firms, healthcare information managers, HR and payroll processors, collections agencies, market-research houses and smaller SaaS operators whose clients demand privacy assurance — but who never justified a full ISMS certification — now have a direct, accredited route to a certified PIMS.
• Philippine processors serving DPA- and GDPR-driven clients. Contact centers, healthcare information management, finance and accounting shared services, insurance back office, fintech and IT service providers process personal data belonging to American, European and Australian data subjects every day. Client procurement and data processing agreements will migrate their references to the 2025 edition well before 2028; the certificate your renewal depends on should not be the one that is visibly expiring.

On interim milestones, be precise about what is fixed and what is not. Accreditation bodies have directed certification bodies to transition their own accreditations first — ANAB, for example, has announced that its accredited certification bodies should complete that step by 31 October 2026. After that, each certification body sets its own cut-off dates for the last initial and recertification audits it will conduct against the 2019 edition. Those CB-level dates vary and several are still being announced, so treat any specific interim date you read as expected rather than fixed, and confirm your own certification body’s schedule in writing. What is fixed is the end of the window: 31 October 2028.

One honest caution on the Philippine regulatory picture: none of this is a National Privacy Commission mandate. The Data Privacy Act of 2012 and its implementing rules do not require ISO certification of any kind. What ISO/IEC 27701 provides is a disciplined, auditable structure for the accountability obligations the law does impose — a designated data protection officer, a working privacy management program, privacy impact assessments, breach preparedness and records of processing. Certification is evidence of accountability, not a substitute for legal compliance, and any consultant who blurs that line is misleading you.

The deadline itself is also the wrong scheduling anchor. Your real deadline is the last audit event in your certification cycle that can practically host the transition — usually a surveillance or recertification audit — minus the months you need to restructure documentation and generate operating evidence under the new edition. For most certified organizations that lands the decision in this planning year, not in 2028.

The transition path from ISO/IEC 27701:2019 to ISO/IEC 27701:2025

This is the sequence we run with clients through our transition and migration consulting practice. It is unglamorous by design; transitions fail on skipped fundamentals, not on missing sophistication.

1. Re-confirm roles and scope before touching documents. List every processing context and classify it: PII processor for client engagements, PII controller for your own employees, applicants, and marketing data — most Philippine service providers are both at once. The 2025 edition keeps role-specific controls, so a wrong role map corrupts everything downstream, from applicability decisions to audit sampling.
2. Run a structured gap assessment against the 2025 edition. Map your current PIMS to Clauses 4–10 and the restructured Annex A control sets. Our free ISO gap analysis tool gives you a first-pass picture; a formal assessment then converts it into a costed, sequenced workplan with owners and audit-cycle alignment.
3. Decide the architecture: integrated or standalone. If you hold ISO/IEC 27001:2022, integration is almost always right — one system, one document set, coordinated audits. If you never had 27001, the standalone route is now open, with eyes open: the information security control set is inside the 2025 PIMS, so standalone changes your certificate count, not your security obligations.
4. Restructure documentation and remap controls. Re-home policies and procedures from the 2019 extension logic into the 2025 clause structure, update applicability documentation for the consolidated Annex A, and align control language with the 2022 vocabulary your auditors now use. This is also the moment to fix the flow-downs: data processing agreements, subprocessor terms and client-facing privacy commitments should reference the current edition.
5. Refresh operational evidence. Auditors certify what you operate, not what you print. Privacy impact assessments, notices and consent records, data subject request handling, retention and disposal execution, subprocessor oversight, and breach response exercised against both NPC notification duties and client contractual clocks — all of it needs recent, dated evidence under the updated system.
6. Internal audit and management review against the 2025 edition. A full-system internal audit by someone competent in the new structure, followed by a management review that formally confirms readiness. Certification body auditors read these two artifacts first; thin ones invite deep sampling.
7. Book and pass the transition audit. Coordinate with your accredited certification body on the vehicle — surveillance, recertification or a special audit, per its transition rules — clear any findings, and receive the reissued certificate to ISO/IEC 27701:2025. First-time implementers follow the same logic minus the legacy remapping: implement to 2025 directly, then proceed through stage 1 and stage 2 initial certification.

How Sterling delivers it: Revise™ on Sterling OS™

Revise™ is the transition component of Sterling OS™, the delivery system Sterling runs every engagement on. It exists because standard revisions are a distinct discipline: the job is not building a management system but surgically updating a live one without breaking certification continuity, client commitments or the team’s daily operation.

A Revise™ engagement for ISO/IEC 27701:2025 produces a verified gap report against the new edition; a clause-and-control mapping from your 2019-structured system to the 2025 structure; restructured documentation drafted with your team rather than dumped on them; an evidence plan tied to your actual audit calendar; internal audit and management review support; and preparation for the transition audit itself, including responding to findings. Depending on how much of the work your team wants to own, delivery runs in Design™ mode (we guide, your people implement — and learn the standard properly in the process) or Drive™ mode (we do the heavy documentation and coordination work for you). Automate™ can put the PIMS documentation, controls and evidence trail onto a compliance automation platform so surveillance readiness stops depending on heroics, and Sustain™ keeps the system audit-ready after the certificate is reissued.

The 2025–2028 period is a congested revision cycle, and 27701 is only one lane of it. Organizations tracking the ISO 9001:2026 transition, or running integrated systems that include ISO 14001 or ISO 45001, should sequence all of it as one Revise™ program rather than as isolated projects — shared clauses, shared internal audits, one management review rhythm, fewer consultant-hours repurchased per standard. For digital-trust portfolios, the PIMS slots alongside ISO/IEC 27001, SOC 2 and related attestations within Sterling Trust 360™, so privacy, security and client assurance evidence stay one coherent story instead of three overlapping ones.

The mistakes we keep seeing in early 27701:2025 transitions

Scheduling against 2028 instead of against the audit calendar. The transition window looks long until you subtract your certification body’s own accreditation timeline, its cut-off for 2019-edition audits, your surveillance dates, and the evidence-generation period the new structure needs. Late movers in every ISO transition cycle discover that auditor calendars near a deadline are a seller’s market.

Treating the transition as a find-and-replace. Renaming document headers from the 2019 clause numbers to the 2025 ones, without remapping controls to the 2022 set or refreshing evidence, produces a system that reads current and audits obsolete. Transition audits sample operation, not formatting.

Buying a template pack and calling it a transition. Generic downloaded manuals describe an organization that is not yours, in a role map that is not yours. In a standard whose entire architecture turns on whether you are a controller, a processor or both per engagement, imported boilerplate is the fastest route to nonconformities — and to a privacy system your operations people quietly ignore.

Getting the role map wrong. BPO and IT-BPM providers routinely misclassify themselves as pure processors, forgetting the employee, applicant, vendor and marketing data they control outright. Auditors do not forget it, and neither do regulators investigating a breach.

Assuming standalone means security-light. The consolidated Annex A carries the information security control set into the standalone PIMS. Organizations attracted to the no-27001-prerequisite route still need functioning security controls with evidence; the prerequisite disappeared, the discipline did not.

Falling for instant-certificate mills. Every transition cycle reactivates the operators selling same-week certificates from unaccredited bodies. A privacy certificate that no client auditor recognizes fails at exactly the moment you bought it for — vendor due diligence — and can poison a bid outright. Verify accreditation, and verify that the body’s accredited scope covers the PIMS scheme and the 2025 edition, before you sign anything.

Leaving clients out of the plan. If your certificate lapses or transitions mid-contract, your clients’ vendor-management teams will notice before you tell them. Sequence the transition so renewal evidence, DPA references and questionnaire answers stay continuously current, and communicate the plan to key accounts early — a managed transition is itself a trust signal.

Why Philippine organizations run this transition with Sterling

Sterling has guided 8,100+ client organizations through ISO implementations, transitions and audits, including privacy and information security programs for the Philippine BPO and IT-BPM sector, where controller/processor scoping, client flow-down clauses and multi-jurisdiction data obligations are daily realities rather than textbook cases. Our consultants have sat through the audits that follow the paperwork, which is why our transition work is built backwards from what accredited auditors actually sample.

Two commitments frame every engagement. First, honesty about the work: we will tell you when the standalone route is wrong for you, when your existing PIMS needs remapping rather than rebuilding, and when your timeline is optimistic — before a certification body tells you less politely. Second, the accreditation line: Sterling never issues certificates. Certification decisions belong exclusively to independent certification bodies, and we prepare clients specifically for accredited certification — the kind that survives a client auditor’s verification. If a proposal anywhere promises you the certificate itself, you are not reading a consultancy’s proposal. To scope your transition or a first-time standalone PIMS, start with the gap analysis tool or reach us through the contact page.

Frequently asked questions about the ISO/IEC 27701:2025 transition

Can we achieve ISO/IEC 27701:2025 certification without ISO/IEC 27001?

Yes — this is the headline change of the 2025 edition. It is now an independent management system standard, so an organization can implement and certify a PIMS without holding an ISO/IEC 27001 certificate. Note the fine print: the restructured Annex A includes the information security control set, so a standalone PIMS still requires demonstrable security controls. Certification itself is granted by an accredited certification body after a successful audit.

What is the deadline to transition from ISO/IEC 27701:2019?

The transition window ends on 31 October 2028, three years from the 2025 edition’s publication in October 2025. Certificates to the 2019 edition are expected to expire or be withdrawn after that date. Practical deadlines arrive earlier: accreditation bodies have directed certification bodies to complete their own transitions first — ANAB has announced 31 October 2026 for its certification bodies — and each body then sets cut-offs for the last audits it conducts against the old edition.

What happens if we miss the 31 October 2028 deadline?

Your ISO/IEC 27701:2019 certificate is expected to lose validity, and returning later means a full initial certification — stage 1 and stage 2 — rather than a transition audit. The commercial damage usually lands sooner: client due-diligence teams flag certificates on retiring editions during renewals and bids well before the certificates formally lapse.

Is ISO/IEC 27701 certification mandatory under the Data Privacy Act?

No. RA 10173 and its implementing rules do not mandate ISO certification, and certification does not by itself make you legally compliant. What ISO/IEC 27701 provides is an auditable structure for the accountability duties the law does impose — a functioning privacy management program, privacy impact assessments, breach preparedness, records of processing — plus independent third-party evidence that the structure operates. Treat it as strong supporting evidence, never as a legal substitute.

We are a BPO processing EU and US customer data. Why does the 2025 edition matter to us?

Because your clients’ obligations flow down to you through data processing agreements, and their vendor-assurance programs verify how you honor them. A certified PIMS gives GDPR-facing and privacy-mature clients standing evidence of processor accountability, answers large parts of recurring due-diligence questionnaires, and differentiates bids. As procurement references migrate to the 2025 edition, holding a visibly current certificate becomes part of staying renewable.

Should we keep the PIMS integrated with ISO/IEC 27001 or go standalone?

If you already hold ISO/IEC 27001:2022, integration is almost always the efficient answer: one system, shared clauses, coordinated audits. Standalone suits organizations without an ISMS whose demand driver is specifically privacy assurance. It is a scoping decision with audit-economics and client-perception consequences, so make it deliberately at the start of the transition — it shapes documentation architecture, audit planning and cost.

How different are the 2025 controls from the 2019 controls?

Published certification-body analyses describe consolidation and realignment rather than a wave of new privacy controls. The controller and processor control sets carry forward into a restructured Annex A, now aligned with the ISO/IEC 27002:2022 control vocabulary, with the information security controls consolidated alongside them. The real work is remapping, renumbering and refreshing evidence under the new structure — substantial, but not a rebuild.

How long does a 27701:2025 transition take?

It depends on variables no honest consultant will guess blind: whether you run integrated or standalone, single-site or multi-site scope, how cleanly your roles are mapped, how current your evidence is, and where your next surveillance or recertification audit sits. A structured gap assessment converts those variables into a dated plan. Be wary of anyone quoting a fixed duration before seeing your system.

Can the transition be done during a surveillance audit?

Commonly yes — certification bodies typically offer the transition through a surveillance audit, a recertification audit, or a separately arranged special audit, usually with added audit time for the new-edition review. Each body publishes its own transition rules and cut-off dates, so confirm the vehicle, the added time and the fees with your certification body early, and book the slot before calendars tighten toward the deadline.

We started implementing ISO/IEC 27701:2019 but are not yet certified. Should we switch now?

Yes. Redirect the implementation to the 2025 edition immediately — the management-system fundamentals you have built remain usable, and remapping now is far cheaper than certifying against a retiring edition and transitioning within your first cycle. Certification bodies are expected to phase out new 2019-edition engagements as their accreditation transitions complete, so confirm with your intended body before committing audit dates.

Does Sterling issue the ISO/IEC 27701:2025 certificate?

No, and no consultancy legitimately can. Sterling designs, remediates and prepares your PIMS; the certificate is issued by an independent certification body after its own audit, and we prepare clients specifically for accredited certification bodies — those accredited for the PIMS scheme by IAF-member accreditation bodies. That separation protects the value of your certificate. Anyone offering to sell you the certificate and the consulting together is describing a conflict of interest, not a service.

Where should we start this week?

Three moves. Inventory your processing contexts and classify each as controller, processor or both — that map drives everything. Run the free ISO gap analysis tool to get a first-pass view against the 2025 edition. And write to your certification body asking for its 27701:2025 transition rules, its 2019-edition cut-off dates and its earliest transition-audit windows. With those three answers in hand, the rest becomes a plan rather than a deadline.

Last updated: July 2026 · Reviewed by Ann Reyes, Lead Auditor (Davao), Sterling International Consulting.