If your company holds ISO 27001 and is being asked about PrivacyMark, or the other way round, someone has probably told you the two can be run as one integrated management system.
That's true, and it saves real work. But it's true of the management system, not of the controls, and the distinction costs people months when they find it out late.
Here is the whole picture on one page.
What genuinely merges
Both standards are built on the Annex SL clause structure. Clauses 4 through 10 (context, leadership, planning, support, operation, performance evaluation, improvement) are structurally the same in each.
That means one set of policies, one internal audit programme, one management review, one corrective action process. You are not writing a second document set. You are not sitting two management reviews. When JIS Q 15001 was revised in 2023 it explicitly adopted this structure, and the standard says outright that the common approach benefits organisations operating more than one management system.
If you already run a working ISMS, this half is close to free.
What doesn't
Here is the part that surprises people.
ISO 27001:2022 carries its controls in Annex A: 93 of them, grouped into organizational, people, physical and technological, selected by risk and declared in your Statement of Applicability. That is what you get audited against.
JIS Q 15001:2023 also has an Annex A, but it contains something completely different. A.1 through A.28 are personal information protection controls drawn from Japan's personal information protection law: purpose specification, lawful acquisition, restrictions on third-party provision, disclosure and correction on request, supervision of employees and of contractors, breach reporting.
These are legal obligations, not security controls. And this is the annex a PrivacyMark audit actually tests.
That catches out people who arrive from an ISO background expecting a controls audit. It isn't one. It is a compliance audit with a security annex attached, and if you prepare for it the way you prepare for a surveillance audit, you will prepare for the wrong thing.
Where the security controls went
They are in Annex D, and Annex D is worth understanding properly.
Clause A.10 covers security control measures, and it refers out to Annex D for the detail. But Annex D is informative, not normative. The standard describes it as a comprehensive list to select from based on your risk analysis, rather than a set of requirements.
And its contents have a specific origin. Table D.1 is built from JIS Q 27002:2014, with the sub-clause numbers D.5 to D.18 deliberately matching that standard's clause numbers. JIS Q 27002:2014 is the Japanese adoption of ISO/IEC 27002:2013, the fourteen-clause, 114-control generation that ISO 27001 replaced when it restructured into 93 controls in 2022.
So if you hold ISO 27001:2022, your controls live in the 2022 structure while PrivacyMark points at the 2013 generation. The two do not map by number. Reconciling them is manual work, and no compliance platform I've seen does it for you.
What to do with this
None of it is a reason to run the standards separately. Integration still saves a great deal, and the savings are in the expensive part: the management system, the documentation, the audit programme.
But scope the work honestly. Merging the management system is largely structural and goes quickly. Reconciling the control sets is a mapping exercise someone has to sit down and do, once, carefully. Budget for it separately, do it before your first integrated audit rather than during it, and write down the mapping so next year's internal audit isn't the same exercise again.
The one thing I'd avoid: assuming that because both annexes are called Annex A, they're the same kind of thing. They aren't, and the gap between them is where the findings come from.
If you're working through this and want a second pair of eyes before an audit, that's what the internal audit engagement is for.