ISMS (ISO 27001) vs Privacy Mark: Which Certification Should a Japanese IT Company Choose?

The difference in one sentence

The two are often lumped together as security certifications, but they protect different things. ISMS looks at information assets in general such as servers, source code, contracts and know-how, and audits the management system that keeps confidentiality, integrity and availability under control. The Privacy Mark narrows the target to personal information and audits how it is collected, used, stored and disposed of.

That single distinction produces most of the practical differences below. Neither is superior; the right choice depends on what information your business handles and what your customers are actually asking for.

• ISMS lets you define the scope, so a single service or engineering unit can be certified
• The Privacy Mark applies to the legal entity as a whole, with no partial-scope concept
• ISMS is an international standard, so it can be presented to overseas customers as is
• The Privacy Mark logo is widely recognised by Japanese consumers and signals trust domestically

What ISMS (ISO/IEC 27001) is

ISMS stands for Information Security Management System, and ISO/IEC 27001 is the international standard that sets out its requirements. The current edition is the 2022 revision, whose Annex A reorganises the controls into 93 items. Rather than checking whether individual security measures exist, the audit asks whether a cycle of selecting controls from a risk assessment, operating them and improving them is genuinely running.

In practice that means a policy, risk identification and evaluation, a Statement of Applicability, internal audits and management review, together with the records that evidence them. For what has to be written down, see the ISMS document list; for the path to certification, see how ISO 27001 certification works.

What the Privacy Mark is

The Privacy Mark (P Mark) is a Japanese third-party certification for the handling of personal information, operated by JIPDEC (Japan Institute for Promotion of Digital Economy and Community). Its basis is JIS Q 15001, the Japanese Industrial Standard for a personal information protection management system, which reflects the thinking of the Act on the Protection of Personal Information while setting its own management requirements.

An audit covers the inventory of personal information held, notification and publication of purposes of use, procedures for handling disclosure requests from individuals, supervision of subcontractors, and employee training. Because everything down to business cards and job applications is in scope, the entity-wide boundary is what makes this the heavier lift for many companies.

ISMS and Privacy Mark side by side

Cost and duration vary widely with headcount, number of sites, breadth of scope and how mature your existing rules are, so both are given as ranges. The breakdown and the factors that move it are covered in the ISMS certification cost guide.

How to decide which one to pursue

Industry alone does not settle the question. Looking at your situation through these five lenses usually makes the priority obvious.

• What customers ask for: which name appears on the security questionnaires and tender conditions you receive. This is the strongest signal
• Type of information held: client systems, source code and trade secrets point to ISMS; consumer personal data points to the Privacy Mark
• Overseas business: if you must explain your posture to non-Japanese customers or auditors, an international standard travels better
• Internal structure: the Privacy Mark covers the whole entity, so more sites and business lines mean more work. ISMS can start narrow
• Room to grow: if you plan to certify one service first and widen later, ISMS is built for that

Among Japanese B2B IT companies of up to about 100 people, customer security requirements frequently name ISO/IEC 27001 specifically, which is why ISMS often comes first. If personal data is the core of your product, that reasoning does not hold.

Holding both, and what can be shared

Some companies hold both. The usual reasons are a B2B SaaS that also holds end-user personal data, or enterprise customers asking for ISMS while public-sector work asks for the Privacy Mark. When that happens, building two separate systems from scratch is wasteful; the shared layer should be operated once.

• Policies: keep the information security policy and the personal information protection policy consistent as one hierarchy
• Employee training: merge annual materials and attendance records, with privacy protection as a module inside them
• Incident response: unify reporting routes, first response and record formats, with a branch for personal data breaches
• Document control: run versioning, approval, retention and disposal on one common framework
• Internal audit: keep checklists separate but share the annual plan and auditor development

Risk assessment and the Statement of Applicability are distinctly ISMS, while the personal information inventory is distinctly Privacy Mark. Keeping those separate is usually easier to maintain than forcing them together.

Three common misconceptions

These three assumptions come up often, and each stems from misreading what a certification represents.

The second is the belief that certifying to ISMS automatically satisfies the Act on the Protection of Personal Information. ISMS examines a management system for information assets; it is not a determination of legal compliance. Specifying and notifying purposes of use, responding to requests from individuals, and reporting obligations after a breach still have to be handled separately. The third is reading certification as a promise that nothing will go wrong. It records that a third party confirmed the system was functioning, which is not the same as the absence of incidents.

Start by mapping where you stand

Whichever route you take, the decision rests on knowing what you already have and what is missing. Policies that exist only in part, an asset inventory with no risk evaluation behind it, training delivered but never recorded: the real starting point differs considerably from company to company.

The ISMS readiness self-check makes that visible by answering a short set of questions. Even while you are still weighing ISMS against the Privacy Mark, seeing which areas are thin makes the comparison a much easier conversation to have internally.

This article is for general information only and does not guarantee any audit outcome or certification. Schemes and costs change, so confirm the latest details with certification bodies.