What ISO 27701 is and why buyers ask for it
ISO/IEC 27701 is the international standard for a Privacy Information Management System (PIMS). It branches out of ISO 27001 and ISO/IEC 27002, extending an information security management system with the additional requirements and controls needed to protect personally identifiable information (PII). In short: where ISO 27001 certifies that you manage information security, ISO 27701 certifies that you manage privacy.
As privacy regulation has tightened worldwide, buyers and regulators increasingly want evidence that an organisation runs a deliberate, audited privacy programme rather than relying on good intentions. ISO 27701 certification provides that evidence, and it supports compliance efforts under regimes such as GDPR, HIPAA and PCI DSS. It is part of the broader ISO Certifications portfolio ABS issues under IAS accreditation and the IAF Multilateral Recognition Arrangement.
What the audit covers
A PIMS audit assesses how your organisation manages PII across its lifecycle, building on the ISO 27001 ISMS as its foundation. Key areas include:
- The roles your organisation plays — PII controller, PII processor, or both — and the distinct controls for each
- Mapping of the personal data you process, and the lawful, transparent basis for doing so
- Privacy-specific controls covering consent, purpose limitation, retention and the support of data subject rights
- Management of processors and sub-processors handling PII on your behalf
Certification follows the same two-stage assessment as other ISO management systems, with surveillance audits across the three-year cycle. Because ISO 27701 extends ISO 27001, the audit is most efficient when an ISMS is already in place or implemented alongside it.
Typical timeline
For an organisation that already holds ISO 27001, adding ISO 27701 typically takes around 10–14 weeks. Implementing both together from a standing start takes longer and depends on the scope of PII processing and the number of sites. Each engagement begins with a fixed-price scoping call, and we send a proposal within 24 hours with a firm timeline.
Common questions
Do we need ISO 27001 before ISO 27701?
Yes. ISO 27701 is an extension of ISO 27001 — it adds privacy-specific requirements and controls on top of an information security management system. You need an ISO 27001 ISMS as the foundation, though many organisations implement or certify both together in a single programme.
How does ISO 27701 relate to GDPR?
ISO 27701 is a certifiable management system standard whose controls map onto many GDPR requirements, so certification is a recognised way to demonstrate a managed privacy programme to customers and regulators. It is not, by itself, an automatic legal guarantee of GDPR compliance — but it provides much of the audited framework.
Who needs ISO 27701?
Organisations that process significant volumes of personally identifiable information — healthcare providers, financial institutions, IT and SaaS companies, e-commerce businesses and education organisations — use ISO 27701 to evidence that privacy is managed to an independent, recognised standard.
What is the difference between a PII controller and a PII processor under ISO 27701?
ISO 27701 sets out separate sets of controls for organisations acting as a PII controller (which determines why and how personal data is processed) and as a PII processor (which processes data on a controller’s behalf). The audit scopes whichever role — or both — applies to your business.
