Your practical guide to accredited privacy certification, trusted by regulators, clients, and data-driven organisations worldwide.
Privacy is no longer just a legal obligation. It is a business expectation. ISO/IEC 27701 certification demonstrates that your organisation has a structured, independently verified system for managing personal information responsibly, giving customers, regulators, and partners the confidence that privacy is built into how you operate, not bolted on as an afterthought.
ISO/IEC 27701 is the international standard for Privacy Information Management Systems (PIMS), developed as an extension to ISO/IEC 27001 and ISO/IEC 27002. Where ISO/IEC 27001 addresses information security broadly, ISO/IEC 27701 goes further by establishing specific requirements and guidance for managing personally identifiable information (PII), making it one of the most comprehensive privacy management frameworks available to organisations today.
The current version, ISO/IEC 27701:2025, represents a significant update to the original 2019 publication, reflecting the maturation of global privacy regulation and the increasing complexity of how organisations collect, process, and share personal information. It maintains strong alignment with major data protection frameworks including GDPR and the CCPA, and applies to organisations acting as PII controllers, PII processors, or both, covering the full lifecycle of personal data from collection and storage through to sharing, retention, and deletion.
Rather than replacing existing privacy compliance programmes, ISO/IEC 27701 builds on them. Organisations already certified to ISO/IEC 27001 can extend their existing ISMS to incorporate a PIMS, making it an efficient and practical route to demonstrating privacy accountability that regulators, clients, and procurement teams can independently verify.
Get in touch with Pacific Certifications today for a seamless, transparent path to accredited registration. Our global experts are available 24/7 to support your operational needs.
ISO/IEC 27701 operates as an extension of ISO/IEC 27001, inheriting and building upon the PDCA-based structure of the parent standard. This means the Plan-Do-Check-Act approach that governs your ISMS automatically extends to cover your Privacy Information Management System as well. In practice, this means:
The key distinction is that ISO/IEC 27701 cannot be implemented or certified in isolation. It requires ISO/IEC 27001 as its foundation, and the two systems are assessed together.
From stage-1 audit to certified status, our auditors bring real privacy and information security expertise to every stage of your certification journey.
Receive an independently audited, internationally recognised ISO/IEC 27701 certificate as an extension of your ISO/IEC 27001 certification, through a clear, structured audit process.
Build internal capability across your privacy, legal, and information security teams with training pathways from awareness through to lead implementer level.
ISO/IEC 27701 is designed to be audited alongside ISO/IEC 27001. We combine both assessments into a single, efficient programme that avoids duplication and reduces disruption.
Review your existing ISO/IEC 27001 system and current privacy practices internally against ISO/IEC 27701:2025 requirements before the formal audit, so your PII processing records and privacy controls are ready when it counts.
ISO/IEC 27701 has evolved to reflect the growing expectations around privacy governance, moving from informal compliance practices to a structured, auditable management system.
| Parameter | Pre-ISO/IEC 27701 Approach | ISO/IEC 27701:2019 | ISO/IEC 27701:2025 |
|---|---|---|---|
| Privacy Management | Ad hoc or compliance-driven privacy practices with no unified framework. | Structured PIMS built on ISO/IEC 27001 with defined PII controller and processor requirements. | Refined and updated requirements reflecting matured global privacy regulation and operational realities. |
| Regulatory Alignment | Organisation-specific interpretation of GDPR, CCPA, and other frameworks. | Mapped controls aligning with GDPR Articles and CCPA requirements. | Strengthened alignment with an expanded range of global privacy frameworks and updated regulatory expectations. |
| PII Controller vs Processor | Roles often unclear or informally managed. | Distinct requirements for PII controllers and processors with separate control sets. | Clearer, more precise obligations for each role reflecting evolving processing relationships and data flows. |
| Third-Party Oversight | Supplier privacy practices rarely formally assessed or monitored. | Structured requirements for managing PII processors and third-party data sharing. | Enhanced expectations around sub-processor oversight, contractual controls, and cross-border transfer management. |
| Evidence and Accountability | Privacy accountability limited to policies and training records. | Documented, auditable evidence of privacy controls and data subject rights management. | Stronger accountability requirements with greater emphasis on demonstrable, measurable privacy outcomes. |
| Integration with Security | Privacy and information security managed separately. | Privacy fully integrated with ISO/IEC 27001 ISMS. | Deeper integration reflecting updated ISO/IEC 27001:2022 control structure and Annex A alignment. |
ISO/IEC 27701 is built on a set of privacy principles drawn from internationally recognised data protection frameworks, translated into practical management system requirements.
Personal information must be collected for a specific, legitimate purpose and only processed in ways consistent with that purpose.
Organisations should collect and retain only the personal information genuinely necessary for the stated purpose, nothing more.
Personal data must be kept accurate and up to date, with processes in place to identify and correct inaccuracies promptly.
Personal information should not be retained beyond the period necessary for its purpose, with clear retention and deletion policies in place.
Individuals have rights over their personal information, including access, correction, deletion, and objection, and organisations must have workable processes to honour them.
Organisations must be able to demonstrate compliance with privacy requirements through documented evidence, not just stated commitment.
Personal data must be protected by appropriate technical and organisational controls, aligned with the broader ISO/IEC 27001 information security framework.
ISO/IEC 27701 extends the clause structure of ISO/IEC 27001, adding privacy-specific requirements across the same framework with additional clauses for PII controllers and processors.
| Clause | Title | Scope & Requirement Objective |
|---|---|---|
| Clause 4 | General | Defines how ISO/IEC 27701 extends ISO/IEC 27001 and ISO/IEC 27002 to incorporate privacy management requirements. |
| Clause 5 | PIMS-Specific Requirements Related to ISO/IEC 27001 | Extends each ISO/IEC 27001 clause with additional privacy-specific requirements covering context, leadership, planning, support, operation, evaluation, and improvement. |
| Clause 6 | PIMS-Specific Guidance Related to ISO/IEC 27002 | Extends ISO/IEC 27002 control guidance with privacy-specific implementation advice for each relevant security control. |
| Clause 7 | Additional Guidance for PII Controllers | Specific requirements and guidance for organisations acting as PII controllers, covering consent, purpose limitation, data subject rights, and third-party management. |
| Clause 8 | Additional Guidance for PII Processors | Specific requirements and guidance for organisations acting as PII processors, covering obligations to controllers, sub-processor management, and cross-border transfers. |
| Annex A | PIMS-Specific Reference Control Objectives for PII Controllers | Extended control set for PII controllers mapping to ISO/IEC 27001 Annex A. |
| Annex B | PIMS-Specific Reference Control Objectives for PII Processors | Extended control set for PII processors mapping to ISO/IEC 27001 Annex A. |
| Annex D | GDPR Mapping | Reference table mapping ISO/IEC 27701 controls to GDPR Articles to support regulatory compliance demonstration. |
Everything you need to prepare for ISO/IEC 27701 certification, in one place.
The path to certification balances system building with rigorous auditing.
Submit your application and confirm your ISO/IEC 27001 certification status, PII processing scope, and applicable regulatory framework.
Before the formal audit begins, review your existing ISMS and privacy practices internally against ISO/IEC 27701:2025 requirements to identify gaps in PII controls, processing records, and data subject rights management.
A documentation review to confirm your PIMS documentation, PII processing records, and privacy controls are adequately developed and ready for the main assessment.
Our auditor evaluates whether your PIMS is fully implemented and effective, covering PII controller and processor obligations, data subject rights processes, and third-party management.
Upon successful completion, your ISO/IEC 27701 certificate is issued alongside your ISO/IEC 27001 certification, valid for three years.
Annual surveillance audits covering both ISO/IEC 27001 and ISO/IEC 27701 requirements maintain your certification, followed by full recertification at the end of the three-year cycle.
For organisations already certified to ISO/IEC 27001, the additional certification process typically follows an eight to ten week timeline.
| Week | Activity | Core Milestones & Focus Areas |
|---|---|---|
| Week 1 | Application & Scoping | Confirm ISO/IEC 27001 status, define PIMS scope, and identify PII controller and processor roles. |
| Week 2 | Gap Analysis | Internally review existing ISMS and privacy practices against ISO/IEC 27701:2025 requirements. |
| Weeks 3-4 | PIMS Implementation | Extend ISMS controls to cover PII processing, data subject rights, consent management, and third-party processor oversight. |
| Weeks 5-6 | Stage 1 Audit | Our auditor reviews your PIMS documentation and PII processing records to confirm readiness for the main assessment. |
| Weeks 7-8 | Stage 2 Audit | Full evaluation of your PIMS implementation covering PII controller and processor obligations and privacy control effectiveness. |
| Week 9 | Technical Review | Address any findings, close non-conformities, and finalise the certification review. |
| Week 10 | Certificate Issuance | Receive your accredited ISO/IEC 27701 certificate alongside your ISO/IEC 27001 certification. |
Note: The timeline assumes an existing ISO/IEC 27001 certification is in place. Organisations pursuing both certifications simultaneously should expect a longer implementation period.
ISO/IEC 27701 certification costs vary depending on the complexity of your PII processing activities, the scope of your PIMS, and whether you are pursuing it alongside an existing ISO/IEC 27001 audit or as a separate assessment. Organisations integrating ISO/IEC 27701 with their ISO/IEC 27001 surveillance or recertification audit will generally find it more cost-effective than a standalone assessment.
At Pacific Certifications, we offer transparent, competitive pricing with no hidden charges. Contact us for a tailored quote or use our free cost calculator to get an instant estimate.
Data protection regulators are issuing larger fines, enforcement actions are becoming more frequent, and customers are making active decisions about which organisations they trust with their personal information. In the current business environment, a privacy policy on a website is not enough. Organisations need to demonstrate that privacy is managed as a system, with documented controls, regular audits, and independent verification.
ISO/IEC 27701:2025 certification provides exactly that. It gives your organisation a credible, internationally recognised way to demonstrate privacy accountability to regulators, enterprise clients, and procurement teams who increasingly require verified privacy credentials before entering into data-sharing relationships.
We provide deep, sector-specific auditing aligned directly with your daily operations.
Build the internal expertise your organisation needs to implement, maintain, and audit ISO/IEC 27701 effectively alongside your ISO/IEC 27001 programme.
For professionals looking to audit Privacy Information Management Systems with confidence, covering both ISO/IEC 27001 and ISO/IEC 27701:2025 requirements.
For those responsible for extending an existing ISMS to incorporate privacy management requirements and PII-specific controls under the 2025 version of the standard.
For teams handling personal data who need a clear, practical understanding of what ISO/IEC 27701:2025 means for their responsibilities and day-to-day work.
We are not just a certification body, we are the partner that helps your organisation earn trust, improve performance, and grow with confidence.
Accredited by the ABIS (Accreditation Board for International Standards), our certificates are accepted by clients, regulators, and procurement bodies worldwide.
Our auditors bring sector-specific knowledge to every engagement, ensuring your audit is relevant, thorough, and conducted by someone who understands your business.
We operate globally with the capability to conduct both remote and on-site audits, delivering consistent, high-quality certification services wherever you are.
From your first enquiry to your final certificate, we keep things clear, efficient, and tailored to your organisation — no unnecessary delays, no hidden costs.
ISO/IEC 27001 addresses information security management broadly. ISO/IEC 27701 is a privacy-specific extension that adds requirements for managing personally identifiable information, covering PII controller and processor obligations, data subject rights, consent management, and regulatory alignment. The two standards are designed to work together, not separately.
Yes. ISO/IEC 27701 cannot be certified in isolation. It requires an existing ISO/IEC 27001 certification as its foundation. Organisations can pursue both certifications simultaneously if they do not yet hold ISO/IEC 27001.
ISO/IEC 27701:2025 refines and strengthens the original framework with updated alignment to ISO/IEC 27001:2022, clearer obligations for PII controllers and processors, enhanced expectations around sub-processor oversight and cross-border data transfers, and stronger accountability requirements reflecting the matured global privacy regulatory landscape.
Yes. ISO/IEC 27701 includes an Annex that maps its controls directly to GDPR Articles, making it one of the most practical tools available for demonstrating GDPR compliance readiness. Certification does not guarantee legal compliance, but it provides strong documented evidence of a structured, accountable approach to data protection.
For organisations already certified to ISO/IEC 27001, the additional ISO/IEC 27701 process typically adds 8 to 10 weeks. Organisations pursuing both certifications simultaneously should allow 4 to 6 months in total depending on the complexity of their PII processing activities.
Costs depend on the scope of your PII processing activities, the complexity of your PIMS, and whether the assessment is integrated with an existing ISO/IEC 27001 audit. Pacific Certifications offers transparent, competitive pricing. Contact us or use our cost calculator for a tailored estimate.
Certification is voluntary, but in 2026 it has become a practical expectation in many enterprise procurement processes, particularly where personal data is shared across organisational boundaries. Regulatory pressure and client requirements are increasingly making it a commercial necessity rather than a choice.
ISO/IEC 27701 certificates are valid for three years and are maintained through annual surveillance audits conducted alongside your ISO/IEC 27001 surveillance programme. A full recertification audit takes place at the end of the three-year cycle.
A PII controller determines the purposes and means of processing personal information. A PII processor processes personal information on behalf of a controller. ISO/IEC 27701 includes separate sets of requirements for each role, and many organisations need to address both depending on their activities.
If non-conformities are identified, you will be given a defined timeframe to address them and provide evidence of corrective action. Our auditors engage with every organisation constructively, the goal is always to help you achieve certification, not to create unnecessary barriers to getting there.
Get in touch with us today. Complete the form and we’ll be happy to assist you.
This will close in 20 seconds
