Sessions
Date, delivery mode, trainer and fee are specific to each session. Fees are per person.
Request a quote for a date for your organisation or for the next run.
Application formNo membership required
Get a quote
Training content
Overview
ISO/IEC 27701 Privacy Information Management System Transition Training has been developed to provide an understanding of the new and revised requirements of the standard, update existing Privacy Information Management Systems and effectively prepare organisations for the new version as part of the transition from ISO/IEC 27701:2019 to ISO/IEC 27701:2025.
The language of the training is Turkish. The training is delivered online.
About the Training
The training covers the new structure of the ISO/IEC 27701:2025 standard, key changes compared with ISO/IEC 27701:2019, the standalone PIMS approach, the context of the organisation, leadership, privacy risk management, the obligations of PII controllers and processors, operational controls, performance evaluation, continual improvement, the Annex A control structure and transition planning.
Who Should Attend?
- Information security and privacy managers
- Data protection and KVKK/GDPR officers
- PIMS managers and team members
- ISO/IEC 27701 internal auditors
- ISO/IEC 27001 auditors and lead auditors
- Information security managers
- Data controllers and representatives of data processing organisations
- Risk and compliance managers
- Legal and compliance personnel
- Personnel responsible for the transition to ISO/IEC 27701:2025
Objectives and Outcomes
The aim is to enable participants to correctly interpret the changes introduced by ISO/IEC 27701:2025, assess their existing ISO/IEC 27701:2019 systems against the new requirements, conduct a gap analysis and develop an effective transition plan.
By the End of the Training
Participants will be able to:
- Explain the structure and scope of the ISO/IEC 27701:2025 standard.
- Assess the key differences between ISO/IEC 27701:2019 and ISO/IEC 27701:2025.
- Identify the impact of the standalone PIMS approach on the organisation.
- Assess privacy risks systematically.
- Assess controls for PII controllers and PII processors.
- Interpret the new Annex A control structure.
- Assess the requirements for integration with ISO/IEC 27001.
- Conduct a gap analysis of the existing PIMS.
- Plan transition activities and responsibilities.
- Update the system in accordance with the requirements of ISO/IEC 27701:2025.
Programme and Method
Overview of ISO/IEC 27701:2025
- Purpose and scope of the standard
- Development of ISO/IEC 27701
- 2019 and 2025 versions
- New management system structure
- Standalone PIMS approach
- Integration with ISO/IEC 27001
Comparison of ISO/IEC 27701:2019 and 2025
- Structural changes
- New and revised requirements
- Standalone certification approach
- Changes to the control structure
- Updates to PII responsibilities
- Impacts on the existing PIMS
Context of the Organisation
- Internal and external issues
- Interested parties
- Privacy expectations
- Legal and regulatory requirements
- Determining the scope of the PIMS
- Privacy management system processes
Leadership and Responsibilities
- Top management commitment
- Privacy policy
- Roles and responsibilities
- Accountability
- PII management responsibilities
- Internal organisational communication
Privacy Risk Management
- Identification of privacy risks
- Assessment of risk sources
- PII processing activities
- Likelihood and impact assessment
- Prioritisation of risks
- Risk treatment activities
PII Life Cycle
- PII collection
- Processing
- Use
- Sharing and transfer
- Retention
- Archiving
- Deletion and destruction
- Control throughout the life cycle
PII Controller Requirements
- Determination of processing purposes
- Legal basis
- Data minimisation
- Privacy notices
- Management of data subject rights
- PII sharing and transfer
- Retention and destruction
PII Processor Requirements
- Management of processing instructions
- Records of PII processing
- Control of sub-processors
- Privacy and security obligations
- Support for the controller
- PII return and destruction processes
Management of Data Subject Rights
- Provision of information
- Access requests
- Rectification
- Erasure
- Restriction of processing
- Data portability
- Objection and other privacy rights
Privacy Controls
- Access control
- PII classification
- Data minimisation
- Retention periods
- PII transfer
- Third-party controls
- Technical and organisational measures
Annex A Control Structure
- Controller controls
- Processor controls
- Common controls
- Applicability of controls
- Control selection and justification
- Relationship between privacy risks and controls
Annexes and Mappings
- Annex A – PIMS controls
- Annex B – Guidance on implementing controls
- Annex C – Mapping to ISO/IEC 29100
- Annex D – Mapping to GDPR
- Annex E – Relationship with ISO/IEC 27018 and ISO/IEC 29151
- Annex F – ISO/IEC 27701:2019 transition mapping
Operational Privacy Controls
- Management of PII processing activities
- Privacy by design
- Supplier and third-party management
- Data transfers
- PII retention and deletion
- Management of privacy events
- Operational records
Management of Privacy Breaches
- Identification of privacy events
- Event assessment
- Breach management
- Notification requirements
- Corrective action
- Post-event assessment
Performance Evaluation
- Monitoring and measurement
- PIMS performance indicators
- Internal audits
- Compliance evaluation
- Management review
- Analysis of privacy performance
Improvement
- Management of nonconformities
- Root cause analysis
- Corrective actions
- Verification of action effectiveness
- Continual improvement
- Improvement of PIMS performance
Integration with ISO/IEC 27001
- Relationship between ISMS and PIMS
- Common management system processes
- Integration of risk management
- Documentation
- Internal audit
- Management review
- Integrated management system approach
Gap Analysis for Transition
- Assessment of the existing ISO/IEC 27701:2019 system
- Identification of new requirements
- Mapping of controls
- Identification of implementation gaps
- Prioritisation
- Development of transition actions
Development of the Transition Plan
- Determination of the transition scope
- Assignment of responsibilities
- Updating documentation
- Revision of risk assessments
- Updating the control structure
- Staff awareness
- Internal audit and management review
Audit Preparation
- Verification of new requirements
- Preparation of PIMS records
- Assessment of objective evidence
- Review of PII processing records
- Review of risk and control records
- Preparation for the transition audit
Case Studies
- Comparison of ISO/IEC 27701:2019–2025
- PII controller scenarios
- PII processor scenarios
- Privacy risk assessment
- Control selection exercise
- Gap analysis
- Development of a sample transition plan
Training Method
The training is delivered through subject presentations, comparison of the requirements of ISO/IEC 27701:2019 and ISO/IEC 27701:2025, case studies, privacy risk assessments, control mapping exercises, gap analysis and transition plan development exercises.
Attendance and Certificate
Certification Rule
A certificate of attendance is issued to all participants whose attendance has been confirmed. To receive a certificate of achievement, participants must obtain a passing grade in the examination at the end of the training; participants who use all their examination attempts but do not pass will be issued a certificate of attendance.
FAQ and Resources
Who is the ISO/IEC 27701 Privacy Information Management System Transition Training suitable for?
It is intended for information security, privacy, data protection, risk, compliance and management system personnel, as well as internal auditors and auditors from organisations wishing to transition from ISO/IEC 27701:2019 to ISO/IEC 27701:2025.
What is the main objective of the training?
To enable participants to understand the changes introduced by ISO/IEC 27701:2025, assess the compliance of their existing PIMS with the new requirements and develop an effective transition plan.
What is one of the most significant changes in ISO/IEC 27701:2025?
ISO/IEC 27701:2025 can be implemented as a standalone Privacy Information Management System standard and can also be used in integration with ISO/IEC 27001.
Is the training practical?
Yes. The training includes version comparisons, privacy risk assessments, control mapping, gap analysis, PII controller/processor scenarios and transition planning exercises.
Is there an examination at the end of the training?
Yes. An assessment examination is conducted at the end of the training.
References
- ISO/IEC 27701:2025 Privacy Information Management Systems – Requirements and Guidance
- ISO/IEC 27701:2019 Privacy Information Management
- ISO/IEC 27001:2022 Information Security Management Systems
- ISO/IEC 27002:2022 Information Security Controls
- ISO/IEC 29100 Privacy Framework
- ISO/IEC 27018 Privacy Protection in Public Cloud
GDPR and relevant data protection legislation
Similar trainings
EXEMPLAR011ISO/IEC 27011 Information Security, Cybersecurity and Privacy Protection Awareness Training8 hours · No session plannedEXEMPLAR012ISO/IEC 27011 Information Security, Cybersecurity and Privacy Protection Internal Auditor Training16 hours · No session plannedEXEMPLAR015ISO/IEC 27017 Information Technology — Security Techniques Awareness Training8 hours · No session planned