ISO/IEC 27701 certification

What it is

ISO/IEC 27701 extends the ISO/IEC 27001 ISMS with privacy-specific requirements and controls for managing personally identifiable information, for both data controllers and data processors. It provides an auditable framework aligned with the GDPR and other data protection regulations. Certification requires holding — or obtaining simultaneously — a certified ISO/IEC 27001 ISMS.

Benefits

• Objective evidence of compliance with privacy obligations.
• Clear delineation of controller and processor roles.
• Confidence of European customers in how their personal data is handled.
• Direct integration with the existing ISMS: same improvement and audit cycle.
• Facilitates records of processing activities and impact assessments.

How the process works

ISO/IEC 27701 certification is carried out as an extension of the ISO/IEC 27001 cycle: quotation, remote documentation and implementation audits, committee decision and a certificate sharing the same 3-year cycle. See the certification process.