BY NEURABYTE
FRAMEWORKS/PRIVACY/ISO 27701
27701
PRIVACY · ISO / IEC

ISO 27701

The privacy extension to ISO 27001.

ISO 27701 extends an ISO 27001 ISMS into a privacy information management system (PIMS). It adds controls for PII controllers and processors and maps to GDPR articles. You cannot certify to 27701 alone; it rides on a 27001 certificate.

AT A GLANCE
ISSUERISO / IEC REGIONInternational CATEGORYPrivacy CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01Organizations already certified or certifying to ISO 27001
02Processors that want a certifiable answer to GDPR due diligence
03Multinationals harmonizing privacy programs
02. KEY REQUIREMENTS

The parts of ISO 27701 that touch what agents do.

7.2 Conditions for collection
Purpose is identified and documented, and processing is limited to it.
7.4 Privacy by design
PII is minimized, de-identified where possible, and retained only as needed.
8.2 Processor obligations
Processors act only on documented instructions and support controller obligations.
7.3 Obligations to PII principals
Access, correction, and erasure requests are handled and evidenced.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against ISO 27701. Where there is no evidence, the report says gap.

LORE CONTROL ISO 27701 REFERENCE
Context disclosure record7.2.8, 7.4.5
Provable deletion7.4.8, 7.3.6
Signed, hash-chained receipts7.2.8 records
Blocking authorization gate6.6.2 access control
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

The PIMS documentation, privacy policy, and DPO role are organizational.
Requires a 27001 ISMS first.
05. QUESTIONS
Can we skip 27001?
No. 27701 is an extension and has no standalone certificate.
Does it satisfy GDPR?
It maps closely and regulators view it favorably, but it is not a GDPR certification under Art. 42.
When will the crosswalk ship?
After the ISO 27001 crosswalk, since it inherits from it.
← PREVIOUSUS state privacy ALL FRAMEWORKS NEXT →EU AI Act
ISO 27701 · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for ISO 27701 tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.