Last reviewed: 20 October 2026
ISO 27701 in Nepal comes up whenever an organization handles large volumes of personal data: banks and insurers with customer records, fintechs with transaction histories, hospitals, schools, and software firms processing data for foreign clients. Nepal has a privacy law, the Individual Privacy Act, 2075, and ISO publishes a management system standard for privacy. This guide explains what ISO/IEC 27701 is, what changed with its 2025 edition, and how to use it as a working structure for privacy compliance in Nepal.
One caution first. This article does not interpret the Individual Privacy Act's clauses. Read the Act itself, and take legal advice on what it requires of your organization. A management system helps you meet legal duties consistently; it does not define them.
What ISO/IEC 27701 is
ISO's page for ISO/IEC 27701:2025 describes it as "an international standard that sets out requirements for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS)."
A PIMS, in ISO's words, "is a structured framework for managing PII responsibly and in line with privacy laws and standards." PII means personally identifiable information.
On who it is for, ISO is broad: "Any organisation that collects, processes, stores or controls personally identifiable information (PII), including public, private and not-for-profit entities."
ISO also explains why the standard exists: "it's not enough to say you care about privacy—you need to prove it." The standard "provides a structured, internationally recognised framework that helps organisations show accountability, manage risks around personally identifiable information (PII), and continually improve their privacy practices."
What changed in the 2025 edition
ISO lists ISO/IEC 27701:2025 as the second edition, published in October 2025. Its predecessor, ISO/IEC 27701:2019, is shown as withdrawn.
The most practical change for planning is stated in ISO's FAQ. Asked "Can ISO/IEC 27701 be used alone?", ISO answers: "Yes, as it is an independent management system standard (MSS)."
That matters for Nepali organizations deciding where to start. A privacy management system no longer has to be planned only as an add-on to an existing ISO/IEC 27001 programme. Many organizations will still run the two together, because information security and privacy share so much (access control, supplier management, incident handling, evidence). The choice of path now depends on your risks and priorities. If you already hold or plan ISO 27001 certification, ask your certification body how it audits combined systems.
Nepal's Individual Privacy Act, 2075
Nepal Law Commission's alphabetical index of Acts lists वैयक्तिक गोपनियता सम्बन्धी ऐन, २०७५ (the Individual Privacy Act, 2075). The Law Commission publishes Nepal's Acts; use its copy as your reference text.
We deliberately do not summarize the Act's provisions here. Privacy duties are legal obligations, and a summary in a vendor article is not a substitute for reading the law with your legal adviser. What a management system can do is make sure that, once you know your obligations, they are met every time, by the right people, with evidence.
Where privacy and security work overlap
Whether you run a PIMS on its own or alongside an ISMS, the day-to-day work overlaps heavily. Planning for that overlap avoids doing the same work twice:
- Asset and data inventories. A security asset register and a personal-data inventory describe many of the same systems. Keep them linked, so a change in one prompts a review of the other.
- Access control. Who can see personal data is both a security and a privacy question. One access review process can serve both.
- Supplier management. The same supplier review can cover security controls and the handling of personal data.
- Incident handling. A security incident that exposes personal data is also a privacy incident. Your response plan should say who decides on any notification and on what evidence.
- Training. Staff who handle customer data need both security and privacy awareness. Combine the content where you can.
- Internal audit and management review. One audit programme can test both systems, as long as each is covered on its own terms.
The difference is the question each system asks. Security asks whether information is protected. Privacy also asks whether you should hold and use the personal data at all, for how long, and for what purpose.
Using a PIMS as the structure for compliance
A practical way to combine the law and the standard is to treat the Act as the source of what you must do, and the PIMS as how you make sure it happens.
- Get the legal reading first. Have counsel identify the Act's obligations that apply to your organization and record them in a register, with references to the Act.
- Map your personal data. You cannot manage what you have not found. List the personal data you hold, where it sits, which systems and suppliers touch it, and why you hold it.
- Assign owners. Every category of personal data and every obligation in your register needs a named owner.
- Design the controls. For each obligation, decide what process or control meets it, and what record proves it ran.
- Bring suppliers in. Processors and IT providers handle your personal data. Your contracts and supplier reviews need to cover privacy as well as security.
- Measure and improve. The standard is about "continually improving" the PIMS. Review incidents, complaints and audit findings, and adjust.
Checklist: is your organization ready for a PIMS?
| Question | Why it matters |
|---|---|
| Has counsel reviewed the Individual Privacy Act, 2075 against our activities? | The law defines the obligations; the PIMS operates them. |
| Do we have an inventory of personal data and where it is held? | Every later step depends on it. |
| Is there a named senior owner for privacy? | Accountability is the point of a management system. |
| Do we know which suppliers process personal data for us? | Their handling is part of your risk. |
| Do we have a process to handle a request from an individual about their data? | It is the most visible test of a privacy programme. |
| Do we already run ISO/IEC 27001, or plan to? | Decides whether to run the PIMS standalone or alongside it. |
| Have we decided whether we want certification, or the practices alone? | It changes the evidence and audit planning. |
Frequently asked questions
Is ISO/IEC 27701 a legal requirement in Nepal?
Nepal's privacy obligations come from the Individual Privacy Act, 2075 and related law, not from the standard. Ask your legal adviser and regulator whether any rule that applies to you refers to ISO/IEC 27701. ISO/IEC 27701 is a framework for managing personal data "in line with privacy laws and standards."
Can we implement ISO/IEC 27701 without ISO/IEC 27001?
According to ISO, yes: ISO/IEC 27701 "is an independent management system standard (MSS)." Many organizations still run the two together because they share many controls.
Which edition should we use?
ISO/IEC 27701:2025, the second edition, published in October 2025. ISO lists the 2019 edition as withdrawn.
Does certification to ISO/IEC 27701 prove we comply with the Privacy Act?
No. Certification shows that your management system meets the standard. Legal compliance is a separate question that your legal adviser should assess against the Act.
Who should use ISO/IEC 27701?
ISO says: "Any organisation that collects, processes, stores or controls personally identifiable information (PII), including public, private and not-for-profit entities."
Next step
Trinity Technology runs gap assessments, implementation and audit-readiness work for ISO 27001, ISO 27701 and ISO 42001 in Nepal. See our ISO 27001 / 27701 / 42001 readiness service, or tell us your scope and we will reply within 24 hours.