Home  /  ISO 27701
ISO/IEC 27701 · Privacy information management

Show customers you handle personal data properly.

ISO/IEC 27701 is the certifiable standard for managing privacy. We audit your Privacy Information Management System independently, so you see every gap before the certification body does.

CertifiableInternational privacy standard
Lead AuditorIndependent internal audit
StandaloneOr integrated with ISO 27001
In short: ISO/IEC 27701 is the certifiable standard for privacy information management. Since the 2025 edition it can be certified on its own or alongside ISO 27001. Cyber Veda provides independent internal audits by a Lead Auditor and supports you through certification.

Why ISO 27701

Security questionnaires increasingly ask about privacy as well as security. ISO 27701 turns your privacy practices into a management system an auditor can verify, so you can answer with a certificate instead of a long questionnaire.

Internal audit, then certification

Certification requires an internal audit before the certification body arrives. Ours is run by a Lead Auditor, independent of whoever built your system, and conducted the way the certification body will audit you. The certificate itself comes from that external audit, by an accredited certification body you engage directly; we recommend and introduce ones we have worked with. See internal vs external audit.

The ISO 27701 certification cycle Internal audit and preparation (Cyber Veda)External audit (your certification body)
  1. Before Build and internal audit Implementation, then a full internal audit and management review
  2. Year 0 Stage 1 audit Certification body reviews your documented system and readiness
  3. Year 0 Stage 2 audit Certification body tests that the system operates; certificate issued
  4. Year 1 Surveillance audit A sample of the system re-checked, after your annual internal audit
  5. Year 2 Surveillance audit Another sample re-checked, after your annual internal audit
  6. Year 3 Recertification A full audit renews the certificate for another three years

Standalone since 2025

ISO/IEC 27701:2025 turned the privacy standard from an extension of ISO 27001 into a management system in its own right. That makes privacy certification possible for organisations that don’t hold ISO 27001, and simpler to scope for those that do. If you were certified to the 2019 edition, plan your transition with your certification body.

What's included

  • Audit plan scoped to your privacy roles: controller, processor or both
  • Independent audit of privacy policies, processes and controls
  • Evidence-based findings and a corrective action register
  • Mapping to GDPR and Australian Privacy Act obligations
  • Support through Stage 1 and Stage 2 with your certification body

When you'd use this

  • You hold ISO 27001 and customers now ask how you protect personal data
  • You are preparing for ISO 27701 certification and need the required internal audit
  • You want independent assurance over your privacy program
FAQ

Common questions

What is ISO 27701?

ISO/IEC 27701 is the international standard for a Privacy Information Management System (PIMS). It sets requirements for how organisations that control or process personal data manage privacy, and it can be independently certified.

Do we need ISO 27001 first?

Not any more. The 2019 edition was an extension to ISO 27001, but ISO/IEC 27701:2025, published in October 2025, is a standalone management system standard, so you can certify your privacy management on its own. If you already hold ISO 27001, the two share the same structure and run well as one integrated system.

What changed in ISO 27701:2025?

It became a standalone standard with its own management system requirements, rather than an add-on to ISO 27001. Organisations certified to the 2019 edition will need to transition; the deadline is set by the accreditation bodies, and your certification body can confirm what applies to you.

Controller or processor: which applies to us?

A controller decides why and how personal data is processed; a processor handles it on a controller’s behalf. Many businesses are both, for example a controller for their own staff and customers and a processor for client data in their platform. ISO 27701 has controls for each role, and we scope the audit to the roles you actually play.

How does ISO 27701 relate to the Australian Privacy Act?

ISO 27701 is not a legal compliance scheme, so certification doesn’t prove you meet the Privacy Act. But it gives you an auditable way to run the practices the Act expects, such as knowing what personal information you hold, using it for the right purposes, securing it and handling requests and breaches, and we map your PIMS to the Australian Privacy Principles.

How long does ISO 27701 take?

It depends on how much personal data you handle, whether you act as controller, processor or both, and whether you already run ISO 27001 or a GDPR program. Existing privacy and security work shortens the path considerably. We give you a realistic timeline in the free consultation.

Who issues the ISO 27701 certificate?

An accredited certification body, which you engage directly for the external audit. We run the internal audit, help you close the gaps and support you through their Stage 1 and Stage 2 audits.

Does ISO 27701 cover GDPR?

It maps closely to GDPR and is a recognised way to demonstrate privacy practices, but certification alone does not make you GDPR compliant. We show you where the two line up and where GDPR asks for more.

Talk to someone who has taken companies like yours to audit.

Book a free 30-minute consultation. Tell us what is driving the need, and leave with a realistic timeline and the first three things to do.

Book a 30-min consultation Explore services