Privacy Information Management

ISO/IEC 27701 is the international standard for a Privacy Information Management System (PIMS) — a structured way to manage personal data responsibly and prove you do. It is not a standalone standard: it is an extension to ISO/IEC 27001, adding privacy-specific requirements and controls on top of an existing or new information security management system.

In plain terms, ISO 27001 keeps information secure; ISO/IEC 27701 goes further and shows you handle personal data lawfully and transparently — covering things like the rights of individuals, records of processing, consent, data-sharing and your responsibilities whether you are a data controller, a processor, or both. It gives structure and independent assurance to your privacy programme, and it maps well onto privacy laws such as the GDPR and others around the world.

Because it extends ISO 27001, certification is assessed by an accredited certification body alongside (or after) your ISO 27001 certification. Like its parent standard, it is technology-neutral and fits a SaaS company, a BPO, a healthcare provider and a marketing firm equally well.

ISO/IEC 27701 is not legally mandatory, but it has become a powerful way to demonstrate privacy accountability to customers and regulators. If you handle personal data and people keep asking how you protect it and comply with privacy law, this is a strong answer. It is especially valuable for:

• SaaS, software and technology companies that process customer or end-user personal data in the cloud.
• BPOs, outsourcers and back-office providers that process personal data on behalf of their clients as processors.
• Healthcare, insurance and financial services organizations handling sensitive personal information.
• Marketing, adtech and analytics firms whose business depends on personal data.
• Any organization subject to GDPR or similar laws that wants a recognized framework to demonstrate compliance.
• Providers bidding for enterprise or overseas contracts where customers demand proof of privacy governance, not just security.

A useful test: if you process personal data and a breach or a compliance failure would seriously damage your customers' trust, your revenue or your regulatory standing, ISO/IEC 27701 is worth having.

Because ISO/IEC 27701 extends ISO 27001, you need an ISMS in place — either already certified or built alongside it. On top of that foundation, the standard asks you to:

• Extend your management system to cover privacy — broadening scope, policy, roles and risk assessment to include the processing of personal data.
• Determine your role — whether you act as a controller, a processor, or both, for each type of processing, because your obligations differ.
• Maintain records of your processing of personal data — what you hold, why, on what basis, and who you share it with.
• Apply privacy-specific controls for controllers — such as lawful basis and consent, transparency, supporting individuals' rights, and privacy by design.
• Apply privacy-specific controls for processors — such as acting only on documented instructions, supporting your customers' obligations, and managing sub-processors.
• Govern data sharing, transfers and retention — including how personal data moves across borders and how long it is kept.
• Monitor, audit and review — internal audits, management reviews, incident handling and continual improvement, integrated with your ISMS.

The depth of each control should match your risk and the personal data you actually process, not a checklist. What matters is that your privacy practices are defined, followed and demonstrably improving.

The strongest reason most of our clients pursue ISO/IEC 27701 is trust — and increasingly, the ability to win deals with it. Enterprise customers and regulators now expect more than security; they want evidence that personal data is handled lawfully. A certificate gives you independent proof of privacy accountability that can replace long privacy questionnaires and shorten sales cycles.

It also makes compliance with laws like the GDPR far more manageable. Rather than treating privacy as a scramble every time a regulator or customer asks, you have a structured, auditable system that shows what you do, why, and how you keep it working. In the event of a complaint or incident, that documented diligence matters.

Because it builds directly on ISO 27001, the effort is efficient: you reuse the same leadership, audit and review machinery and simply extend it to privacy, rather than standing up a separate system. And it demonstrates to customers, staff and partners that you take personal data seriously as a matter of governance, not just good intentions.

We've spent more than 30 years helping organizations get certified, with 900+ clients certified and a 100% first-time pass rate at the certification audit. Our 10-Step Approach turns ISO/IEC 27701 from an intimidating framework into a clear, week-by-week path.

We start by understanding the personal data you process, your role as controller or processor, and the privacy laws that apply to you — not a generic template. If you don't yet hold ISO 27001, we build the ISMS and the privacy extension together so you're not paying for two projects. Then we run a gap assessment, map your obligations onto the standard's controls, and put a right-sized system in place. Our documentation is deliberately lean: a single-level system, typically under 200 pages, written for the people who actually use it rather than to impress an auditor.

From there we help you implement the controls, set up your records of processing, train your staff, run internal audits and a management review, then support you through the certification audit. A typical project runs 4–9 months depending on your size and whether ISO 27001 is already in place. When we're done, you hold the certificate — and you own a privacy system your team can actually run afterward, without depending on us forever.

• Trying to certify without an ISMS. ISO/IEC 27701 extends ISO 27001 — it can't stand alone. We make sure the security foundation is in place, building it alongside if needed.
• Getting your role wrong. Controller and processor obligations differ significantly. We help you determine your role for each type of processing so the right controls apply.
• Buying a template pack and calling it a privacy programme. Auditors and regulators spot generic documentation instantly. We build the system around the personal data you actually process.
• Assuming certification equals automatic GDPR compliance. The standard maps well onto GDPR and strongly supports compliance, but it isn't a legal certification of it. We keep that framing honest and useful.
• Incomplete records of processing. If you can't show what personal data you hold and why, the audit will expose it. We help you build records that are accurate and maintainable.
• Over-documenting. Thick manuals no one reads become findings, not strengths. Lean, usable documentation passes audits and survives real life.
• Forgetting it's ongoing. Surveillance audits come every year, and privacy law keeps evolving. We leave you with a system that keeps working, not a one-off scramble.