ISO 27701 Certification
The privacy extension to ISO 27001, setting requirements for managing personal information as a controller, a processor or both.
- Standard
- ISO 27701:2019
- Indicative timeline
- 8-14 weeks, depending on scope and readiness
- Discipline
- ISO Standards
- Assessment type
- Independent third-party assessment
The standard
Overview
ISO 27701:2019 extends ISO 27001 and ISO 27002 to cover the processing of personally identifiable information. It adds privacy-specific requirements to the information security management system, along with two sets of controls: Annex A for organisations acting as PII controllers and Annex B for those acting as PII processors. Together these form a privacy information management system, or PIMS.
Certification shows customers, data protection officers and procurement teams that privacy obligations are managed through an audited system rather than policy documents alone. Annex D maps the standard to GDPR articles, which makes it a practical way to evidence UK GDPR and Data Protection Act 2018 accountability duties in contracts and supplier due diligence.
Because ISO 27701 is an extension, UKCert assesses it against a certified ISO 27001 system, either added to an existing certificate or as a combined assessment. Stage 1 reviews PIMS scope, roles and applicability. Stage 2 tests records of processing, rights handling, transfers and retention.
Who this is for
- SaaS and cloud providers processing customer personal data
- Outsourced service providers acting as processors
- Organisations already certified to ISO 27001
- Businesses handling special category or children's data
- Suppliers answering privacy due diligence in tenders
What it gives you
Why organisations certify
What a certified ISO 27701:2019 assessment gives you once the certificate is issued.
Builds on ISO 27001
The PIMS reuses the existing risk assessment, internal audit and management review, so privacy is added to a working system rather than run separately alongside it.
Controller and processor roles
Annex A and Annex B separate the duties of controllers and processors, so responsibilities are defined for each processing activity and each customer contract.
GDPR evidence mapping
Annex D maps clauses to GDPR articles, so accountability, transparency and records obligations can be evidenced against a recognised structure during audits and due diligence.
Faster due diligence
Buyers, data protection officers and prospective clients ask much the same privacy questions. A certificate and statement of applicability answer most of them at once.
Rights and breach handling
Subject access, erasure, objection and breach notification follow defined routes with owners and timescales, so statutory deadlines are met by process rather than memory.
Transfer and retention control
International transfers, sub-processor use and retention periods are recorded and reviewed, which reduces the risk of data being kept or sent without a lawful basis.
Scope
What the assessment covers
The areas an assessor works through. Your final scope is confirmed in writing before any audit is booked.
- PIMS scope covering controller and processor roles
- Records of processing activities
- Annex A controls for PII controllers
- Annex B controls for PII processors
- Lawful basis, consent and transparency records
- Data subject rights procedures
- Privacy by design and privacy impact assessment
- Transfer, sub-processor and retention records
How it runs
The assessment, stage by stage
From first enquiry to certificate. Each stage is agreed with you before it starts.
-
Scope and roles
We confirm whether the organisation acts as a controller, a processor or both, which processing activities are in scope, and how the PIMS extends the existing ISMS boundary.
-
ISO 27001 position
Certification requires a certified ISO 27001 system. We confirm the existing certificate, or plan a combined assessment covering both standards within a single audit programme.
-
Stage 1 review
A review of PIMS documentation: statement of applicability, records of processing activities, privacy risk assessment, processor contracts and the data subject rights procedure.
-
Stage 2 assessment
Auditors sample real processing activities, test how rights requests, transfers, retention and breach notification actually run, and interview the staff who handle personal data.
-
Certification decision
Findings are graded and closed out. An independent reviewer takes the certification decision, and the PIMS is recorded on the certificate alongside the ISO 27001 scope.
-
Surveillance and recertification
The PIMS is audited on the same three-year cycle as the ISMS, with annual surveillance and a full recertification audit before the certificate reaches expiry.
Questions
ISO 27701:2019 — frequently asked
Anything here that does not cover your situation, put it to an assessor rather than guessing at it.
Same discipline
Other schemes in ISO Standards
Certifying against more than one standard?
Where you hold several standards, shared clauses are assessed once in a combined visit rather than as separate audits. Talk it through with an assessor before you decide what ISO 27701:2019 should sit alongside.