ISO 27701 certification,
explained plainly

ISO/IEC 27701 is the international standard for a privacy information management system, PIMS for short. It does not certify that you comply with a particular privacy law. It certifies that you run a working system for protecting personally identifiable information: you know which PII you process and why, on which lawful basis, with which processors and in which countries, you assess the risks to the people behind the data, you answer their requests, you notify breaches, and you audit and improve all of it.

The standard uses its own vocabulary, taken from ISO/IEC 29100. PII is personally identifiable information, the PII principal is the person the data is about, the PII controller decides purposes and means, and the PII processor processes PII on a controller’s behalf. If you know the GDPR, read personal data, data subject, controller and processor.

The requirements follow the harmonized structure ISO uses for all management system standards, so they look like ISO 27001 with privacy in place of information security. Clause 4 is context: which role you play for each processing activity, which privacy laws and contracts apply, and what the PIMS covers. Clause 5 is leadership: top management owns the privacy policy, the objectives and the assignment of roles, including a data protection officer where the law requires one. Clause 6 is planning: a privacy risk assessment that weighs consequences for the people behind the data, not only for the organization, a risk treatment process that ends in a statement of applicability against Annex A, and measurable privacy objectives.

Clause 7 is support: resources, competence, awareness, communication and documented information, which for a PIMS includes the record of processing, impact assessments, processor contracts and consent records. Clause 8 is operation: running the processes, repeating the risk assessment before new or changed processing, and carrying out the treatment plan. Clause 9 is performance evaluation: privacy metrics, internal audit and management review. Clause 10 is improvement: nonconformities, corrective action and continual improvement.

Annex A is where the privacy substance lives, and it is organized by the role you play. Table A.1 holds 31 controls for PII controllers, grouped into conditions for collection and processing (purpose, lawful basis, consent, impact assessment, processor contracts, records), obligations to PII principals (information, access, correction, erasure, objection, portability, automated decisions), privacy by design and by default (collection and processing limits, accuracy, minimization, retention, disposal, transmission), and sharing, transfer and disclosure (transfer basis, destination countries, records).

Table A.2 holds 18 controls for PII processors: processing only on the customer’s documented instructions, no use for the processor’s own or marketing purposes, flagging unlawful instructions, giving customers what they need to demonstrate compliance and to answer their PII principals, returning or deleting data at the end, and the full sub-processor discipline of disclosure, prior authorization, flow-down contracts and change notice. Table A.3 holds 29 information security controls taken from ISO 27002:2022 and sharpened for PII, from classification and access rights to logging, backup, cryptography, secure development and test data. Annex B gives implementation guidance for every control.

The standard is deliberately law-neutral. It asks you to identify the privacy laws that apply to you and to run a system that meets them, and its Annex A controls are written so that the obligations of the major privacy laws have a home: the record of processing, the lawful basis, the impact assessment, the data protection officer, the processor contract, the transfer basis, the rights of access, correction, erasure and portability, and breach notification are all there. The standard also carries annexes that map its controls to other privacy frameworks.

That makes it the natural bridge between an ISMS and privacy law. An organization that runs ISO 27001 and is subject to the GDPR or the Swiss FADP typically finds that most of its legal obligations already have a process, but no management system around them: nobody audits the rights request process, the processor register lives in a spreadsheet, and the impact assessments are wherever the last project left them. ISO 27701 puts those processes under the same discipline as the security controls, with the same audit and review cycle.

Certification is carried out by an accredited certification body in the same two stages as ISO 27001. Stage 1 is a readiness review of the documented PIMS: scope, privacy policy, role determination, risk assessment and treatment, the statement of applicability against Annex A, and whether internal audit and management review have run. Stage 2 is the implementation audit: the auditor samples processing activities, follows a rights request through the process, checks processor contracts and transfer records, tests the breach procedure and interviews the people who run it.

Since the 2025 edition you choose between a standalone PIMS certificate and an integrated audit with ISO 27001, where one audit programme, one management review and one corrective action process serve both. Organizations certified to the 2019 edition transition to the 2025 edition on the timeline their certification body publishes. The certificate then follows the usual three-year cycle: a surveillance audit in years one and two and a recertification audit in year three.

Privacy is the part of a management system that changes most between audits. New processing starts, providers and sub-processors change, an adequacy decision falls, a new law applies, and every one of those events has to reach the record of processing, the risk assessment, the notices and the contracts. Surveillance auditors follow exactly those trails: they pick a processing activity that started since the last visit and ask for its assessment, its contract and its notice.

Teams that keep the record of processing, the processor register and the assessments in one place, tied to the controls they satisfy, answer that in minutes. Teams that keep them in separate spreadsheets rebuild the trail before every audit.

The certification body charges for the Stage 1 and Stage 2 audits and for each surveillance audit, scaled to the size and complexity of the processing in scope. If you integrate the audit with ISO 27001, the added audit days are modest. That fee is usually the smaller part.

The larger cost is the system: building and maintaining the record of processing, running impact assessments before launches instead of after, contracting and monitoring every processor, answering rights requests within deadlines and keeping evidence of all of it. Two levers move that cost. Scope, because certifying the processing your customers actually ask about is cheaper than certifying everything. And integration, because an existing ISMS already provides the audit programme, the management review, the corrective action process and most of the Table A.3 controls.