ISO/IEC 27701
The privacy extension to ISO 27001. It proves GDPR compliance to third parties with an audited certificate.
Privacy information management
- What is at stake
- Proves GDPR compliance to third parties
Who it applies to
- Companies already ISO 27001 certified
- Processors for large customers
- Platforms with large amounts of personal data
Typical timeline
2 to 3 months
Privacy information management
In detail
Certifiable privacy, built on your security.
ISO/IEC 27701 defines a Privacy Information Management System (PIMS). For years it was an extension to ISO 27001, and since the 2025 edition it can also be certified as a standalone standard.
It sets specific controls for both controllers and processors: lawful basis, data subject rights, minimisation, transfers, breach notification and sub-processor relationships.
It is the most recognised way to show customers and authorities that your GDPR compliance is not just paperwork but audited by a third party.
Real scenarios
When it makes sense.
Processors of others’ data
HR, marketing or cloud companies acting as processors prove to customers that they handle data properly.
Sensitive-data sectors
Health, insurance and education gain a strong argument with patients, policyholders and families.
Already ISO 27001 certified
Adding 27701 is a natural step that reuses the existing management system with moderate effort.
What you get
What you will have at the end.
- Scope extended to privacy
- Risk analysis for data subjects
- Controller and processor controls
- Data subject rights management
- Mapping to GDPR
- Certification audit readiness
How we engage
Three ways to approach it.
Gap analysis
Know exactly what is missing.
- 2 to 3 weeks
- Prioritised report
- Fixed quote
- Most chosen
Full implementation
We take you to the audit.
- Policies and controls
- Evidence prepared
- Audit support
Maintenance
Stay compliant year after year.
- Annual internal audit
- Change tracking
- Support with the auditor
ISO
What we focus on
- 01
Controller and processor roles
- 02
Privacy-specific controls
- 03
Integration with the existing ISMS
- 04
GDPR mapping
ISO/IEC 27701
How we work
- 1
Diagnosis
Gap analysis against the framework, prioritised by risk.
- 2
Plan
A roadmap with owners, budget and schedule.
- 3
Implementation
Policies, technical controls and evidence, with your team.
- 4
Audit
Internal pre-audit and support in front of the auditor.
FAQ
Frequently asked questions
How much does preparing for ISO/IEC 27701 cost?
It depends on scope and starting point. After the first call we give you a fixed quote, no surprises.
Can I combine it with other frameworks?
Yes. We reuse shared controls so each additional certification costs far less.
Does 27701 mean GDPR compliance?
It doesn’t guarantee it legally, but it is strong evidence of diligence and makes demonstrating compliance much easier.
Do I need ISO 27001 first?
Since the 2025 edition it is no longer required, though combining them remains the most efficient route.
Services
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.