ISO/IEC 27701:2019
ISO/IEC 27701 certification for privacy information management
Certification of how your organisation governs personal data, as a controller, a processor or both.
- Valid for
- 3 years
- Surveillance
- Years 1 and 2
- Verification
- Public register
Accredited and empanelled
What is ISO 27701?
ISO/IEC 27701 specifies requirements and guidance for a privacy information management system (PIMS). The 2019 edition is written as an extension to ISO/IEC 27001, adding privacy to the ISMS and setting out controls for PII controllers and PII processors.
The certificate states which role you hold for the processing in scope. Annex A of the 2019 edition covers controller obligations such as identifying a lawful basis, consent, records of processing and the rights of PII principals; Annex B covers processor obligations such as acting on customer instructions, managing sub-processors and returning or disposing of data at the end of a contract.
The standard is not a law, but the 2019 edition maps its controls to the GDPR, which makes it a practical way to show customers and regulators how privacy is managed. A revised edition restructures ISO/IEC 27701 as a standalone management system standard; at quotation we confirm which edition your audit uses and how any transition applies.
Who it is for
- SaaS platforms processing customer personal data
- HR, payroll and BPO providers
- Healthcare and health technology organisations
- Fintechs and payment processors
- Marketing, analytics and data services firms
- Organisations preparing for GDPR or DPDP Act scrutiny
What sets audit time and cost
Added to an existing ISO 27001 certificate, the privacy extension can often be audited within twelve weeks of application; certifying both standards from the start takes longer.
- Whether ISO 27001 is already certified or audited at the same time
- PII role: controller, processor or both
- Volume and sensitivity of personal data, such as health or financial records
- Number of processing activities and jurisdictions
- Number of sub-processors and cross-border transfers
Why it matters
What ISO 27701 gives you
- 01
Roles made explicit
Defining where you act as controller and where as processor clarifies contracts, responsibilities and customer expectations.
- 02
Evidence for customer due diligence
A certified PIMS supports data processing agreements and privacy questionnaires with audited evidence.
- 03
Privacy inside security
Privacy risks are assessed and treated within the same management system as security risks, rather than in a separate project.
- 04
Consistent handling of requests
Access, correction and deletion requests follow a defined, tested process with records.
The audit
What our auditors examine
- 01
PII roles and scope
The processing activities in scope, the role you hold for each and how that is reflected in contracts.
- 02
Privacy risk assessment
Risks assessed for their impact on PII principals as well as on the organisation, with privacy impact assessments where processing calls for them.
- 03
Controller obligations
Records of processing, lawful basis, notices, consent where used and privacy by design and by default.
- 04
Processor obligations
Processing only on documented instructions, sub-processor approval, transfer safeguards and return or disposal of data.
- 05
Rights of PII principals
How requests are received, verified, answered within time limits and recorded.
- 06
Breach handling
Incident procedures that recognise PII breaches and meet notification duties to customers, authorities and individuals.
How certification works
Every accredited certificate follows the same three-year cycle, with each step recorded and the result published in our register.
01
Application and quote
Tell us your scope, sites and headcount. We calculate audit time under the accreditation rules and send a fixed quote and audit plan.
02
Stage 1 audit
We review your documented management system, scope and readiness, and agree the Stage 2 plan. Any gaps are reported so you can close them first.
03
Stage 2 audit
Auditors check that the system works in practice: interviews, records and observation across the scope. Nonconformities are raised in writing.
04
Certification decision
Once corrective actions are accepted, a reviewer who did not take part in the audit makes the decision. Your certificate is issued and listed in the public register.
05
Surveillance audits
Shorter audits in the first and second years after certification confirm the system is maintained and improving. The register shows your current status throughout.
06
Recertification
Before the three-year certificate expires, a recertification audit reviews the whole system and renews the certificate for another cycle.
Related standards and audits
Often certified or audited alongside this one, sometimes in a single combined audit.
ISO certification
ISO 27001
Independent certification of your information security management system against ISO/IEC 27001:2022.
Security audits
Data protection compliance
An independent check of how your organisation collects, uses, protects and deletes personal data.
ISO certification
ISO 42001
Independent certification of how your organisation governs the development, provision and use of AI systems.
Security audits
VAPT
Vulnerability scanning followed by hands-on exploitation, so you know which weaknesses an attacker could use.
Industries we audit for
SaaS and cloud
Independent evidence that answers enterprise security reviews and keeps sales moving.
Healthcare and life sciences
Quality and information security certification for organisations where patient safety and patient data both matter.
Banking and fintech
Audits and certifications that support the security evidence regulators, partner banks and payment networks ask for.
ISO 27701 questions
We audit; we do not consult.
To keep certification independent, we never design, build or fix the systems we audit, and decisions are made by people who did not take part in the audit. Read our impartiality policy.
Plan your ISO 27701 certification
Tell us your scope, sites and timeline. We reply with an audit plan and a fixed quote.