Cyber-Management
EN / FRbook a consultation

ISO 27701

ISO 27701 certification for SMBs: proof of how you handle personal data.

Customers asking how you protect their personal data? Answer with an audited certificate.

book a free 25-minute consultation

Does it apply to you?

Do your customers or contracts ask for it?

ISO 27701 is voluntary. It is worth it when buyers want proof, not promises, about personal data. Yes to any of these: take a closer look.

  • You handle personal data for your clientsAs a cloud, software, payroll or IT provider. Clients in finance, health and the public sector increasingly ask for it.
  • You already hold ISO 27001Much of the security side is done, so adding privacy is the shorter step.
  • Your competitors all hold ISO 27001ISO 27701 sets you apart in tenders and supplier reviews.
  • You want your GDPR work independently auditedIt supports your GDPR accountability. It is not a GDPR certificate.

What changes for you

Independent proof of how you manage personal data.

ISO 27701 certifies a privacy management system: how you decide which personal data you collect, why and for how long, and how you handle people’s requests and your suppliers. Since its 2025 edition it stands on its own. ISO 27001 is no longer required, although the two are often audited together.

It does not replace GDPR work such as choosing the legal basis for each use of data, or appointing a data protection officer (DPO) when one is required. What it gives you is an audited, maintained system that customers recognise.

Without it, nothing happens legally: GDPR applies either way. The risk is commercial, in tenders and supplier reviews that favour competitors who can show a certificate.

What to do first

Reuse your GDPR and ISO 27001 work, then fill the gaps.

What we deliver

  • A review against the standard, for your role as controller, processor or both
  • A check of your existing GDPR documents: what can be reused
  • The privacy management system, on its own or built into your ISO 27001 one
  • An internal privacy audit before certification
  • Certification audits combined with your ISO 27001 audits where possible

Who does what

We lead the privacy work. Your IT provider keeps the technical side.

What we lead

  • Set the scope and your role for each data flow
  • Write the privacy policies, notices and procedures
  • Lead privacy risk and impact assessments
  • Lead the internal audit and prepare the certification

What stays with your IT provider

  • Apply access, retention and deletion settings
  • Keep the records the auditor will ask for
  • Fix the technical findings

You name a privacy lead or DPO on your side, who owns the system day to day.

How it starts

Your first step: a review against the standard.

You learn what is already covered by your GDPR and ISO 27001 work, what is missing, and how long certification would take. The rest of the work is sized from it, at a fixed fee.

Price
Fixed fee

Fixed quote after the free call.

book a free 25-minute consultation

For your IT manager, DPO or CFO

What ISO 27701 requires.
  1. 01Clauses 4–10

    The management system

    Privacy context, leadership obligations, privacy risk and impact assessment, documented privacy objectives, performance evaluation and improvement — the same structure as ISO 27001.

  2. 02Annex A · Table A.1

    Controls for data controllers

    Conditions for collection, consent management, privacy notices, privacy by design, data minimisation, retention, data subject rights, third-party disclosure.

  3. 03Annex A · Table A.2

    Controls for data processors

    Obligations to the controller, sub-processor management, breach notification to controller, return/deletion of personal data at contract end.

  4. 04Annex A · Table A.3

    Security controls for both roles

    The information-security controls that protect personal data — largely covered by an existing ISO 27001 ISMS, or built as part of the PIMS.

No statutory penalties — but GDPR penalties apply to underlying privacy.

ISO 27701 itself is voluntary. There are no statutory fines for not certifying. But the GDPR penalties for the privacy practices ISO 27701 governs are very real — €20M or 4% of global turnover for the most serious violations.

Certification is increasingly asked for in regulated-sector procurement (financial services, healthcare, public sector). It helps evidence GDPR Article 32 security and speeds up customer due diligence.

  • Underlying GDPR risk

    €20M / 4%

    turnover — the GDPR ceiling for the most serious infringements; certification does not reduce it.

  • Procurement leverage

    Regulated

    sectors increasingly require ISO 27701 as a vendor qualification.

Typical timeline

Depends on whether ISO 27001 is already in place.

  1. 4–8 months

    With existing ISO 27001

    Privacy gap analysis, PIMS extension, controls implementation, internal audit, certification audit (combined with ISO 27001 surveillance).

  2. 10–14 months

    ISO 27001 + ISO 27701 together

    Combined integrated program — faster, cheaper, less internal disruption than sequential implementation. Ends with certification against both standards, with the audits combined.

FAQ

What DPOs and IT managers ask us about ISO 27701.

What exactly is ISO/IEC 27701?
It specifies a Privacy Information Management System (PIMS). Where ISO 27001 protects information from a security angle, ISO 27701 manages personal data from a privacy angle: the why and how of processing. Certificates are issued by accredited certification bodies operating across the EU, such as AFNOR (France), TÜV (Germany), TrustCB (Netherlands), AENOR (Spain), plus EU-wide players like Bureau Veritas, BSI, LRQA, SGS and DNV.
Who is ISO 27701 for?
ISO 27001-certified organisations handling personal data; processors serving regulated-sector clients (cloud, SaaS, payroll, MSPs); organisations wanting independently audited evidence of privacy governance; multi-jurisdiction operators needing one core framework; organisations with a DPO, who gain a documented framework to work within; and vendors who want to stand out in RFPs where many competitors already hold ISO 27001.
Is ISO 27701 certification the same as GDPR compliance?
No. It helps evidence GDPR accountability and Article 32 security, but it is not a GDPR certification under Article 42 and does not bind supervisory authorities. Some GDPR obligations need separate legal work it does not replace: the lawful basis for each processing activity, mandatory DPO designation, and consultation of the authority for high-risk DPIAs.
Can we pursue ISO 27701 without ISO 27001?
Yes, since the 2025 edition. ISO/IEC 27701:2025 is a standalone management system, so ISO 27001 is no longer a prerequisite for certification; without an ISMS, the PIMS includes the information-security controls that protect personal data. If you already hold or plan ISO 27001, the two are commonly implemented and audited together, and your ISMS already covers much of the security side.
What's the difference between ISO 27701 and a GDPR audit?
A GDPR audit is a point-in-time view of where you stand; it produces no certificate. ISO 27701 certification is independently assessed, maintained over time and renewed through annual surveillance audits and a three-year recertification, which carries more weight with enterprise clients and procurement.
Does ISO 27701 apply to both controllers and processors?
Yes — Annex A sets out separate controls for controllers and for processors, plus security controls that apply to both. Many organisations are both: controller for their own employee/customer data, processor for clients' data. ISO 27701 accommodates the dual role; you implement relevant controls from both sets and clearly define your roles in the Statement of Applicability.
How does ISO 27701 affect our DPO obligation?
It does not replace the DPO designation required by GDPR Article 37: if you must appoint a DPO, you must do so regardless. The two work well together, since the standard gives the DPO a documented framework to work within. We often combine ISO 27701 and DPO as a Service in one privacy programme.
Is ISO 27701 recognised outside the EU?
Yes. As an international standard, the same management system can support privacy programmes under several laws; each jurisdiction's specific requirements still need their own analysis. Organisations processing personal data from several regions can use ISO 27701 as the core framework, with jurisdiction-specific addenda.

Related

The privacy stack.

ISO 27001

No longer a prerequisite since the 2025 edition, but the natural companion — an ISMS covers much of the security side.

Read more

EU GDPR

The regulation ISO 27701 maps to. Certification is evidence; full GDPR work is separate.

Read more

DPO as a Service

Article 37 designation is separate from ISO 27701 — they pair naturally.

Read more
back to compliance hub