ISO/IEC 27701
Voluntary. ISO standards are not legislation. The Privacy Act’s duties do not depend on holding this certificate, and no certificate replaces them.
The 2025 standard for a privacy information management system, for organisations handling personal information as controllers or processors.
MaintainedLast reviewed
Key facts
- Issued by
- ISO and the International Electrotechnical Commission
- Sources listed
- 1
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
What it is
ISO’s page for ISO/IEC 27701:2025 describes it as the standard for privacy information management systems. ISO says it sets requirements for establishing, implementing, maintaining and continually improving a privacy information management system, and gives guidance on putting the requirements into practice. It is for personally identifiable information controllers and processors.
ISO’s page says the 2025 edition is an independent management-system standard, and that it aligns with an existing ISO/IEC 27001 system. ISO also says it helps organisations demonstrate compliance with privacy laws such as the GDPR. That is ISO’s description of a use. A certificate is not a decision by the OAIC or by a European supervisory authority that the Privacy Act or the GDPR has been met.
Who it applies to
ISO says it is for any organisation that collects, processes, stores or controls personally identifiable information, public or private. Certification is voluntary. A law firm that is an APP entity, or a vendor that processes personal information for the firm, may choose to use it. The Privacy Act’s duties do not depend on holding the certificate.
What it asks of a law firm using AI
- This page does not reproduce the standard. Use the public ISO page for what the standard is, and the certificate for what was actually certified.
- Check the edition. The page checked here is the 2025 edition. A certificate to an earlier edition should say so.
- Ask whether the certified organisation is named as a controller, a processor, or both, and whether the service the firm buys is inside the scope.
- Do not treat the certificate as a substitute for APP 11, APP 8, or a data-processing schedule.
How it maps to this framework
The rows are this site’s questions. Where the cell says “Not set here”, the instrument does not set that requirement. The gap is still recorded, so it is not treated as answered.
| This site’s question | What the instrument says that bears on it |
|---|---|
| Efficiency Whether the tool saves total human work at the quality the task needs. | Not set here. |
| Effectiveness Whether the output is good enough for the task. The catalogue does not score this. | Not set here. |
| Due diligence What the firm has actually read about hosting, training and assurance before it relies on the tool. | A 27701 certificate is additional evidence about how a vendor says it manages personal information. Read the scope. Pair it with the contract and with the OAIC guidance. Do not stop at the badge. |
| Confidentiality Whether client and other confidential information can go into the tool. | The standard is about personally identifiable information. Client confidential information that is not personal information can sit outside it. The conduct rules still apply. |
| Disclosure When the firm tells the client, and where required the court or another party, that AI was used. | Not set here. |
| Certifications ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | Record ISO/IEC 27701 when a source actually names it. Do not treat an ISO/IEC 27001 certificate as if it were a 27701 certificate. They are different standards. |
| Data residency Where the tool holds data, including whether that place is recorded as Australia. | ISO’s public page does not say that certification chooses a country of storage. Ask the residency question separately. |
Sources
Checked 2026-10-10. Issued by ISO and the International Electrotechnical Commission.