What This Template Is For
Defining the boundaries of your Privacy Information Management System (PIMS) is essential before an audit. This template outlines what ISO/IEC 27701:2025 expects in a PIMS scope statement. It's useful for organizations seeking standalone ISO 27701 certification or integrating it into an existing ISO 27001 program.
The scope statement details the processing activities, roles, data categories, and geographic locations your PIMS covers. It's the first document an auditor reviews in Stage 1. If your scope doesn't align with the evidence you provide, you'll spend the audit revising it instead of resolving findings.
This template reflects the standalone structure of the 2025 edition. If you're transitioning from ISO/IEC 27701:2019, note that the scope now needs to stand independently rather than reference your ISMS scope document.
Prerequisites
Before completing this template, gather:
- A current PII inventory listing processing activities, data categories, purposes, and legal bases.
- Role determination per activity showing where you act as a PII controller versus a PII processor.
- Sub-processor and third-party intermediary lists with contract dates and data flows.
- Geographic processing locations where data is stored, accessed, and transferred.
- Organizational boundaries defining which business units, subsidiaries, or product lines are in scope.
If you don't have these yet, start with the inventory. Everything else flows from knowing what data you hold and why.
The Template
Copy the structure below into your document management system. Replace bracketed placeholders with your specifics.
PRIVACY INFORMATION MANAGEMENT SYSTEM SCOPE STATEMENT
Version: [1.0]
Effective Date: [Date]
Next Review: [Date + 12 months]
Owner: [Privacy Lead or DPO]
1. Organizational Context
[Organization Legal Name] operates a Privacy Information Management System to manage risks to individuals whose personal data we process. This PIMS applies to:
- Legal entities in scope: [List subsidiaries, business units, or operating companies covered]
- Physical locations: [List offices, data centers, or facilities where PII is processed or stored]
- Business activities covered: [Describe core operations, e.g., "employee management, customer relationship management, and marketing analytics"]
2. Roles and Processing Activities
We process personal data in the following roles:
As PII Controller:
[List activities where your organization determines purposes and means. Examples: employee HR records, customer account data, marketing contact lists, product usage telemetry tied to identifiable users]
As PII Processor:
[List activities where you process on behalf of another controller. Examples: client data hosted in your SaaS platform under client instruction, payroll data processed for employer clients]
Excluded from scope:
[List processing activities explicitly out of scope, e.g., "Personal data processed by the finance team for accounts payable to individuals is excluded and managed under separate controls"]
3. PII Categories and Sensitivity
The PIMS covers the following categories of personal data:
- Routine identifiers: [Examples: name, email, phone, account ID, IP address]
- Sensitive categories in scope: [List if applicable: biometric data for access control, health data in employee benefits administration, precise geolocation in delivery tracking]
- Automated decision-making: [Describe if you use models or algorithms to score, rank, route, or make decisions about individuals, e.g., "credit scoring for customer accounts," "resume screening for hiring"]
4. Geographic Scope and Cross-Border Transfers
Primary processing locations: [Countries where data is stored or accessed]
International transfers: [Describe mechanisms if PII moves between jurisdictions, e.g., "Customer data is transferred from the EU to U.S. data centers under Standard Contractual Clauses"]
5. Third Parties and Sub-Processors
The PIMS includes oversight of:
- Sub-processors: [Name categories or list vendors who process PII on your behalf, e.g., "cloud hosting provider, email service provider, support ticketing system"]
- Monitoring mechanism: [Describe how you track changes, e.g., "Sub-processor list reviewed quarterly; new vendors added only after data processing agreement execution"]
6. Exclusions and Interfaces
Out of scope:
[Be explicit. Examples: "PII processed by acquired subsidiary [Name] until integration completes in [Quarter]," "Anonymous or aggregated data with no re-identification risk"]
Interfaces with other management systems:
[Describe if integrated with ISO 27001, ISO 37301, or other frameworks, e.g., "The PIMS shares risk assessment and internal audit processes with the ISO 27001 ISMS but maintains separate control objectives in Annex A.1 and A.2"]
7. Approval
This scope was reviewed and approved by:
- Privacy Lead: [Name, Date]
- Executive Sponsor: [Name, Title, Date]
How to Customize It
Section 1 (Organizational Context): If you're a single-entity company with one office, this section is brief. If you're a holding company with subsidiaries in multiple countries, list which entities are in and which are out, and explain why.
Section 2 (Roles): Avoid declaring a single role for the entire organization. You're likely both a controller and a processor. Map it per activity. If you run a SaaS platform and also employ people, you control employee data and process customer data.
Section 3 (PII Categories): Highlight anything that triggers heightened risk: biometric identifiers, health information, data about children, automated profiling. If you don't process sensitive categories, say so explicitly.
Section 4 (Geographic Scope): If your data never leaves one country, write one sentence. If it crosses borders, name the mechanism. "We comply with applicable law" is not a mechanism.
Section 5 (Third Parties): Auditors will compare this list against your actual vendor stack. If a processor appears in your access logs but not in your scope statement, you'll get a finding. Keep it current.
Section 6 (Exclusions): Clearly define what's out of scope. If your PIMS doesn't cover a legacy system scheduled for decommissioning or a subsidiary you're divesting, document it here so the auditor doesn't look for evidence that doesn't exist.
Validation Steps
Before presenting this to an auditor or publishing it internally, run these checks:
Cross-check against your PII inventory. Every processing activity in your inventory should map to a role in Section 2. If it doesn't, either add it to the scope or move it to exclusions.
Compare to your vendor list. Pull your active contracts with any party that touches PII. If a vendor isn't in Section 5 and isn't excluded in Section 6, add it or remove the vendor.
Test the geographic claims. Log into your cloud console and check where data is actually stored. If a region appears that's not in Section 4, your scope statement is already outdated.
Verify role determination with legal. If you're calling yourself a processor for an activity where you set the retention period or decide what analytics to run, your legal team may disagree. Fix it now.
Confirm executive sign-off is real. The approval in Section 7 should reflect an actual review, not a rubber stamp. If your executive sponsor can't explain what the PIMS covers in two sentences, schedule a briefing before the audit.
A scope statement that matches reality will survive Stage 1 without rewrites. One that doesn't will cost you audit days and delay certification. Treat this as a living document and update it whenever processing activities, vendors, or locations change.
