Privacy Information Management Systems
Shows that you manage personal data and privacy risks with a dedicated privacy system.
A complete documentation kit written to ISO/IEC 27701:2025: manual, policies, procedures, SOPs, forms, registers, process maps, indicator and risk frameworks, audit and management review packs, an implementation roadmap, sector guides and commercial templates, with every clause and control area mapped to the document that meets it, and control of the PII inventory, privacy risk, lawful basis, rights requests, privacy by design, retention, transfers, processors and breaches built into the system.
- Edition 2025
- 147 Word + 32 Excel files
- One organization
- Downloads open 7 days after payment
You need this if
- You collect or process personal data as a controller or processor.
- Clients ask for privacy evidence alongside or instead of security evidence.
- You need records of processing, impact assessments and rights requests.
Look here instead if clients are asking about information security overall: access, suppliers, incidents and Annex A controls. ISO/IEC 27001:2022 Information Security Management →
What you get, in numbers
Counted from the files in the pack. Every file title is listed further down.
What this toolkit is not
Worth knowing before you buy.
Not the certificate
Certification is decided by an independent certification body after it audits a system you have run for some months, with records. No toolkit can guarantee it.
Not the ISO text
The standard is copyrighted and sold by ISO and national standards bodies. Buy your own copy. The toolkit describes requirements in its own words.
Not a consultant
We do not assess your organization. You review, adapt and approve every document before you use it.
What’s inside
15 numbered folders. Open any folder to see the title of every file in it. Titles only: the files themselves are delivered after payment.
00Start Here
Six guides: read-me, how to implement with an initial review checklist, documentation structure, quick start, an ISO/IEC 27701:2025 clause mapping guide, and a certification preparation guide.
6 files
- WordSH-001 Read Me Guide
- WordSH-002 How to Implement Guide
- WordSH-003 Documentation Structure Guide
- WordSH-004 Quick Start Guide
- WordSH-005 ISO-IEC 27701-2025 Clause Mapping Guide
- WordSH-006 Certification Preparation Guide
01Master Index
One Excel register of every controlled document: number, title, type, owner, department, retention and clause, with review dates and overdue flags.
1 file
- ExcelREG-01 Master Document Register
02Manual
The Privacy Information Management System Manual, section-numbered to match clauses 4 to 10: context including the controller or processor role, requirements, leadership, planning with privacy risk and the statement of applicability, support, operation including the PII inventory, impact assessment and the controls for controllers and processors, performance evaluation and improvement.
1 file
- WordPIMS-001 Privacy Information Management System Manual
03Procedures (P-001 to P-024)
Document and record control, context and roles, leadership, privacy risks, objectives, resources and competence, awareness, operational control, PII inventory and records of processing, risk and impact assessment, treatment and statement of applicability, lawful basis and consent, rights requests, privacy by design, retention and disposal, sharing and transfers, processors, the processor role, incidents and breaches, monitoring, internal audit, management review and improvement. Each has a flowchart, responsibility table, controls, risk and indicator matrices.
24 files
- WordP-001 Document Control Procedure
- WordP-002 Record Control Procedure
- WordP-003 Context, Roles, Interested Parties and Scope Procedure
- WordP-004 Leadership, Policy and Roles Procedure
- WordP-005 Privacy Risks and Opportunities Procedure
- WordP-006 Privacy Objectives and Planning of Changes Procedure
- WordP-007 Resources and Competence Procedure
- WordP-008 Awareness and Communication Procedure
- WordP-009 Operational Planning and Control Procedure
- WordP-010 PII Inventory and Records of Processing Procedure
- WordP-011 Privacy Risk Assessment and Impact Assessment Procedure
- WordP-012 Privacy Risk Treatment and Statement of Applicability Procedure
- WordP-013 Lawful Basis, Purposes and Consent Procedure
- WordP-014 PII Principal Rights Requests Procedure
- WordP-015 Privacy by Design and by Default Procedure
- WordP-016 Retention and Disposal of PII Procedure
- WordP-017 PII Sharing, Transfer and Disclosure Procedure
- WordP-018 Processor and Third-Party Management Procedure
- WordP-019 Acting as a PII Processor Procedure
- WordP-020 Privacy Incident and Breach Management Procedure
- WordP-021 Monitoring, Measurement and Evaluation Procedure
- WordP-022 Internal Audit Procedure
- WordP-023 Management Review Procedure
- WordP-024 Nonconformity, Corrective Action and Improvement Procedure
04Policies (POL-001 to POL-012)
Privacy policy, document control, records and confidentiality, privacy risk management, lawful basis and consent, PII principal rights, privacy by design and default, sharing and transfers, processors, incidents and breaches, competence and communication, and audit, review and improvement.
12 files
- WordPOL-001 Privacy Policy
- WordPOL-002 Document Control Policy
- WordPOL-003 Records and Confidentiality Policy
- WordPOL-004 Privacy Risk Management Policy
- WordPOL-005 Lawful Basis, Purposes and Consent Policy
- WordPOL-006 PII Principal Rights Policy
- WordPOL-007 Privacy by Design and Default Policy
- WordPOL-008 PII Sharing, Transfer and Disclosure Policy
- WordPOL-009 Processor and Third-Party Management Policy
- WordPOL-010 Privacy Incident and Breach Management Policy
- WordPOL-011 Competence, Awareness and Communication Policy
- WordPOL-012 Audit, Review and Improvement Policy
05SOP Library (SOP-001 to SOP-022)
Step-by-step task instructions with flowcharts and acceptance criteria: risk workshops, PII inventory and data mapping, records of processing, impact assessments, consent, notices, access requests, correction and erasure, design review, retention and disposal, transfers, processor due diligence, customer instructions, breach response and notification, training, reporting, audit and corrective action.
22 files
- WordSOP-001 Document Issue and Withdrawal
- WordSOP-002 Records Filing and Archiving
- WordSOP-003 Context Review Workshop
- WordSOP-004 Privacy Risk Workshop
- WordSOP-005 PII Inventory and Data Mapping
- WordSOP-006 Record of Processing Update
- WordSOP-007 Privacy Impact Assessment
- WordSOP-008 Obtaining and Recording Consent
- WordSOP-009 Privacy Notice Maintenance
- WordSOP-010 Handling an Access Request
- WordSOP-011 Handling Correction, Erasure and Objection Requests
- WordSOP-012 Privacy by Design Review
- WordSOP-013 Retention Review and PII Disposal
- WordSOP-014 International Transfer Assessment
- WordSOP-015 Processor Due Diligence
- WordSOP-016 Acting on Customer Instructions
- WordSOP-017 Personal Data Breach Response
- WordSOP-018 Breach Notification
- WordSOP-019 Privacy Training Delivery
- WordSOP-020 Privacy Performance Reporting
- WordSOP-021 Internal Audit Conduct
- WordSOP-022 Corrective Action Tracking
06Forms (FR-001 to FR-051)
Fifty-one forms. Each comes with field descriptions, a blank form that prints on its own, and a completed example record.
51 files
- WordFR-001 Document Change Request
- WordFR-002 Document Review Record
- WordFR-003 Record Disposal Authorization
- WordFR-004 Context and Climate Review
- WordFR-005 Interested Party and Requirements Review
- WordFR-006 PIMS Scope Statement
- WordFR-007 Roles, Responsibilities and Authorities Record
- WordFR-008 Policy Communication Record
- WordFR-009 Privacy Risk and Opportunity Assessment
- WordFR-010 Privacy Objectives Plan
- WordFR-011 PIMS Change Record
- WordFR-012 Resource Request
- WordFR-013 Competence Assessment
- WordFR-014 Training Record
- WordFR-015 Communication Plan
- WordFR-016 Operational Control Plan
- WordFR-017 PII Inventory Record
- WordFR-018 Record of Processing Activity Entry
- WordFR-019 Privacy Risk Assessment
- WordFR-020 Privacy Impact Assessment
- WordFR-021 Privacy Risk Treatment Plan
- WordFR-022 Statement of Applicability
- WordFR-023 Lawful Basis and Purpose Record
- WordFR-024 Consent and Notice Review
- WordFR-025 PII Principal Request Record
- WordFR-026 Identity Verification Record
- WordFR-027 Privacy by Design Checklist
- WordFR-028 Retention Schedule Review
- WordFR-029 PII Disposal Record
- WordFR-030 International Transfer Assessment
- WordFR-031 PII Disclosure Record
- WordFR-032 Processor Due Diligence Record
- WordFR-033 Data Processing Agreement Checklist
- WordFR-034 Processor Review Record
- WordFR-035 Customer Instruction Record
- WordFR-036 Sub-processor Authorization Record
- WordFR-037 Privacy Incident Report
- WordFR-038 Breach Assessment and Notification Record
- WordFR-039 Privacy Incident Investigation Report
- WordFR-040 Privacy Indicator Definition Sheet
- WordFR-041 Privacy Performance Report
- WordFR-042 Annual Audit Programme
- WordFR-043 Audit Plan
- WordFR-044 Internal Audit Checklist
- WordFR-045 Audit Report
- WordFR-046 Auditor Competence Record
- WordFR-047 Management Review Agenda
- WordFR-048 Management Review Minutes
- WordFR-049 Management Review Action Plan
- WordFR-050 Nonconformity and Corrective Action Record
- WordFR-051 Improvement Suggestion and Effectiveness Review
07Registers (REG-01 to REG-18)
Eighteen Excel registers with examples, drop-down lists, automatic calculations, due dates and flags: PII inventory (impact assessment missing), records of processing (basis, consent, notice and agreement checks), controls and applicability, impact assessments (before launch), requests (deadlines), processors (agreements and notice time), transfers, disclosures, retention (past retention), incidents (time to assess and notify), training, objectives, corrective actions and audits.
18 files
- ExcelREG-01 Document Register
- ExcelREG-02 Record Register
- ExcelREG-03 Privacy Requirements Register
- ExcelREG-04 Privacy Risk and Opportunity Register
- ExcelREG-05 PII Inventory Register
- ExcelREG-06 Record of Processing Activities
- ExcelREG-07 Privacy Controls and Applicability Register
- ExcelREG-08 Privacy Impact Assessment Register
- ExcelREG-09 PII Principal Requests Register
- ExcelREG-10 Processor and Third-Party Register
- ExcelREG-11 International Transfer Register
- ExcelREG-12 PII Disclosure Register
- ExcelREG-13 Retention and Disposal Register
- ExcelREG-14 Privacy Incident and Breach Register
- ExcelREG-15 Privacy Objectives and Plans Register
- ExcelREG-16 Training and Competence Register
- ExcelREG-17 Nonconformity and Corrective Action Register
- ExcelREG-18 Audit Register
08Process Maps
Eight swimlane maps with inputs, outputs, owners and indicator links: context and risk, leadership, inventory and operational control, lawful basis and consent, rights requests, design and retention, sharing and processors, and incidents and improvement.
8 files
- WordPM-01 Context, Roles, Scope and Privacy Risk Process Map
- WordPM-02 Leadership, Objectives, Resources and Communication Process Map
- WordPM-03 PII Inventory, Records of Processing and Operational Control Process Map
- WordPM-04 Lawful Basis, Consent and Notices Process Map
- WordPM-05 PII Principal Rights Requests Process Map
- WordPM-06 Privacy by Design, Retention and Disposal Process Map
- WordPM-07 Sharing, Transfers, Processors and Processor Role Process Map
- WordPM-08 Incidents, Monitoring, Audit and Improvement Process Map
09Indicators & Risk
91 indicators with formulas and targets in a filterable matrix, corporate and department frameworks, a balanced scorecard, a 5 x 5 risk matrix with 38 example risks, and an improvement opportunity matrix with 25 examples.
6 files
- WordKPI-01 Corporate Indicator Framework
- WordKPI-02 Department Indicator Framework
- ExcelKPI-03 Balanced Scorecard
- ExcelKPI-04 Process Indicator Matrix
- ExcelRSK-01 Risk Management Matrix
- ExcelRSK-02 Opportunity Matrix
10Audit
Annual audit programme covering every clause, control area and system, audit plan with sampling, notification, auditor competence matrix, a 34-question checklist by clause, a complete audit report and a findings tracker.
7 files
- WordAUD-01 Annual Audit Programme
- WordAUD-02 Audit Plan
- WordAUD-03 Audit Notification
- ExcelAUD-04 Auditor Competence Matrix
- ExcelAUD-05 Audit Checklist by Clause
- WordAUD-06 Audit Report
- ExcelAUD-07 Follow-up Tracker
11Management Review
Agenda, inputs checklist covering every input of clause 9.3 including incidents, requests and processors, completed sample minutes with the required outputs, action plan and a dashboard.
5 files
- WordMRV-01 Management Review Agenda
- WordMRV-02 Management Review Inputs Checklist
- WordMRV-03 Management Review Minutes Template
- ExcelMRV-04 Management Review Action Plan
- ExcelMRV-05 Management Review Dashboard
12Implementation
An eight-month roadmap with activities, milestones, deliverables and responsibilities, and a task tracker.
2 files
- WordIMP-01 Implementation Roadmap
- ExcelIMP-02 Implementation Tracker
13Customization
Guides with risks, controls and indicators for cloud and software providers, payroll and outsourcing, banks and fintech, healthcare, retail and e-commerce, telecom, education, public sector, marketing and analytics, and non-profits.
10 files
- WordCUS-01 Cloud, SaaS and Software Providers Customization Guide
- WordCUS-02 Payroll, HR and Business Process Outsourcing Providers Customization Guide
- WordCUS-03 Banks, Insurers and Fintech Customization Guide
- WordCUS-04 Healthcare and Life Sciences Customization Guide
- WordCUS-05 Retail and E-commerce Customization Guide
- WordCUS-06 Telecom and Data Centre Operators Customization Guide
- WordCUS-07 Education and EdTech Customization Guide
- WordCUS-08 Public Sector and Government Services Customization Guide
- WordCUS-09 Marketing, Advertising and Data Analytics Firms Customization Guide
- WordCUS-10 Non-Profit Organizations and Membership Bodies Customization Guide
14Commercial
Gap assessment checklist, certification readiness checklist, implementation and training proposal templates, consultancy agreement template and audit preparation checklist.
6 files
- ExcelCOM-01 Gap Assessment Checklist
- ExcelCOM-02 Certification Readiness Checklist
- WordCOM-03 Implementation Proposal Template
- WordCOM-04 Training Proposal Template
- WordCOM-05 Consultancy Agreement
- ExcelCOM-06 Audit Preparation Checklist
Sample pages
Pages from the delivered files, before your company details are applied.
After you download
The order most organizations follow.
Before you buy
Is the text of ISO/IEC 27701 included?
No. The standard is copyrighted by ISO and IEC and sold by them and national standards bodies. Buy your own copy of ISO/IEC 27701:2025. The toolkit describes requirements in its own words and maps every clause and control area to the document that meets it, so you can check each against the standard.
Which edition does the kit follow?
ISO/IEC 27701:2025 (second edition, published October 2025), the current edition. It is a standalone privacy information management system standard with its own clauses 4 to 10 and replaced the 2019 edition, which was an extension to ISO/IEC 27001 and could be certified only alongside it. Certificates to the 2019 edition are understood to be valid only until about October 2028; confirm with your certification body.
Does the kit make us compliant or give legal advice?
No. A privacy information management system helps manage privacy risk but cannot guarantee compliance with any law, and certification does not show that no breach has occurred. The kit does not decide which law applies to you or what it requires and gives no legal advice. Take advice from a lawyer or your regulator.
Do we need ISO/IEC 27001 first?
Not under the 2025 edition, which can be certified on its own. If you also run an information security system the two can be audited together, and the kit's information security procedures link to it.
Are the examples and figures real data?
No. Names, systems, retention periods, response times, lawful bases, thresholds and cases in example records are fictional and marked as examples. Set your own from the law that applies to you, your contracts and your risk assessment.
Can we edit the documents after purchase, and will this get us certified?
Yes, files are delivered as standard, unlocked .docx and .xlsx files. The toolkit gives you a complete, clause-mapped baseline and tools for operating the system, but certification is decided by independent bodies after they audit a working system, including sampling of records and interviews, so you must run the system for some months first. Neither a toolkit nor a management system guarantees certification or compliance.
How long can we download the files?
For 7 days from payment. In that time you can enter your company details, correct them and regenerate, and download as often as you need. After 7 days the purchase stays in your account history, but the download closes. Save the ZIP somewhere safe.
What if we need the files again later?
Buying the same toolkit again is a new order with its own 7-day download window. Each purchase is listed separately in your account.
Licence
One purchase licenses one organization to use, edit and adapt the documents for its own management system. You may not resell, share or publish the toolkit or its templates. Each file carries a footer line with the buyer’s email and order number. Full wording is in the Terms & licence.