ISO 27701:2025 explained: how it supports PDPA work and where to start ISO/IEC 27701 is the standard for privacy information management systems (PIMS). The 2025 edition was redrafted as a stand-alone management system standard, so it no longer has to sit on top of ISO 27001. It has controls for both controllers and processors. PDPA work you already do, such as the processing register, rights requests, breach handling and processor contracts, counts heavily as evidence. Start by mapping that work to the standard, then add internal audit and management review.
A Thai software company was asked by a foreign client whether it had ISO 27701. The team assumed it had to start from scratch, when its PDPA register, rights requests and processor contracts were already a large share of the evidence.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- ISO 27701:2025 is a stand-alone management system standard
- It has separate controls for controllers and processors
- Existing PDPA work counts heavily as evidence
- What is usually missing is the management system: internal audit and management review
- It is a standard, not law; certification is done by a certification body
How to do it in 6 steps
Work through these 6 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Set the scopeChoose which companies, products or services are in, and whether you act as controller, processor or both.
- Map your PDPA workMatch the register, rights requests, breaches and processor contracts to the standard's controls.
- Write the Statement of ApplicabilityState which controls apply, which do not, and why.
- Assess privacy riskKeep a risk register and treatment plan, linked to your existing DPIAs.
- Run an internal auditPlan by risk, sample real evidence and follow up on corrections.
- Hold a management reviewPresent audit results, metrics and risks so management decides and the decision is recorded.
How is the 2025 edition different?
The 2025 edition was redrafted as a stand-alone management system standard, so you can run a PIMS without an ISO 27001 system first. If you already have one, the two can share the same machinery.
Which PDPA work counts as ISO 27701 evidence?
Work that is recorded systematically and can be checked later counts the most.
- Records of processing under section 39
- Receiving and answering rights requests
- Breach handling and notification
- Contracts with processors
- Impact assessments (DPIA)
Does ISO 27701 mean full PDPA compliance?
Not always. The standard organises the work, but Thai law has specific duties such as breach notification timing and minors' consent rules, which must be checked against the PDPA directly.
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ Starting a separate set of ISO documents apart from PDPA work | ✓ Use your existing PDPA registers and evidence as the base and fill only the gaps. |
| ✗ No internal audit or management review | ✓ Plan a risk-based internal audit at least yearly and hold a recorded review meeting. |
| ✗ Controller and processor roles not separated | ✓ Set the role per service, because the controls differ. |
See how much of ISO 27701 your PDPA work already covers
AIPDPA has all 78 ISO 27701 controls on the same evidence board as the PDPA, with status calculated live from real work. The ENTERPRISE plan adds the full management system, from risk register, internal audit and management review to a mock audit.
Included in the GROWTH, PRO and ENTERPRISE plans, from 4,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
Do we need ISO 27001 before ISO 27701?
Not for the 2025 edition, which is stand-alone. If you already have ISO 27001, run them together.
Is ISO 27701 required by Thai law?
No. It is voluntary, but foreign clients and partners often ask for it as proof of readiness.
How long does it take?
It depends on size and the PDPA work in place. With a complete register, what remains is mostly the management-system part.
Who certifies it?
An accredited certification body, which audits in two stages: documents, then evidence of real practice.
Sources
This guide relies on 3 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- ISO/IEC 27701:2025 — Privacy information management systems, requirements and guidance (standard, not law)
- Alan Shipman & Steve Watkins — ISO/IEC 27701:2025 An introduction to privacy information management systems (ITGP 2025)
- Personal Data Protection Act B.E. 2562 (2019), s. 39 — records of processing
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
ISO 27001 · ISO 27701 · ISO 42001 · NIST AI RMF · PDPC guidance: work done once counts across standards, with status calculated live.
Get started →A 5×5 risk register, objectives, internal audit, management review, an SoA exported to Word and a two-stage mock audit like a certification body.
Get started →The register fills itself from your org chart, picks the lawful basis with its section, and prints a Section 39 report in one click.
Get started →PDPC, ETDA and NCSA requirements in one place — do the work once, evidence several standards.
Get started →A lawyer-led team checks your readiness and sets up PDPA end to end — ideal for SMEs without the time.
See the service →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.