ISO/IEC 27701
Privacy information management system — an extension to ISO/IEC 27001. Updated: September 29, 2026.
ISO/IEC 27701 is the privacy counterpart to ISO/IEC 27001: a privacy information management system, with requirements for organisations acting as controllers of personal data, as processors, or as both. It is the nearest thing to a certifiable privacy standard, which is why it gets asked about.
What It Adds to 27001
Security asks whether data is protected. Privacy asks a different set of questions, and 27701 adds them:
- Lawful basis and purpose. Why you hold the data at all, and whether you are still using it for that reason.
- Individuals' rights — access, correction, deletion, portability, objection — as an operational process with a clock on it, not a policy statement.
- Data minimisation and retention. Collecting less, and deleting on a schedule rather than never.
- Privacy by design in new systems, and impact assessments where processing is high risk.
- Records of processing, and the controller/processor split written down for each flow.
- Transfers — where data goes, and on what basis it is allowed to go there. This intersects directly with the residency scope discussed under security and compliance needs.
How It Is Certified
27701 was published as an extension requiring an ISO/IEC 27001 management system underneath it — you cannot certify to it in isolation on that basis, and the two are typically audited together. The standard has since been revised, and editions differ in how standalone use is treated, so check which edition a certificate cites and what your certification body currently offers. That check matters both when you certify and when you evaluate somebody else's certificate.
Its Relationship With the GDPR
27701 includes mappings to data protection regimes including the GDPR, and those mappings are genuinely useful as an implementation guide. But certification to 27701 is not certification of GDPR compliance, and no certification body can issue the latter — only a supervisory authority interprets the law. What the certificate demonstrates is a systematic, independently audited approach to privacy management, which is a real and defensible claim to make to a customer or in a tender.
What the Auditor Will Ask to See
On top of everything the underlying ISO 27001 system produces:
- Records of processing, with the lawful basis and purpose for each, and your controller or processor role stated per flow.
- Rights requests handled — a sample with dates, showing the clock was met. The process existing is not the evidence; the handled requests are.
- Retention schedules, and deletion actually happening. Everybody has the schedule. The records showing data was deleted on it are rarer and are what gets tested.
- Privacy impact assessments for high-risk processing, with the decisions they led to.
- Transfer records: where personal data goes, and the basis for each transfer — which intersects with the residency scope discussed under security and compliance needs.
- Privacy by design: evidence it was considered in a specific new system, not asserted as a principle.
- Processor agreements with your own suppliers, and evidence of their assurance.
Who Needs It
Organisations processing significant volumes of personal data, particularly processors whose customers are themselves under regulatory pressure, and any business where privacy is part of what is being sold. For a small organisation with limited personal data, the controls are worth implementing and the certificate frequently is not.
Written from an infrastructure perspective. We are not a certification body, an audit firm or a legal adviser, and this is not legal advice. Standards are revised on a cycle — confirm the current edition before you commit.