ISO 27701 Privacy Information Management Certification

Flow chart of the ISO 27701 engagement, 6 phases in order, each one selectable. Phase 1, PIMS Scoping and Role Mapping. We confirm where you act as a controller and where as a processor, then set the scope of your privacy management system. Activities: Inventory processing activities across the business; Classify each activity as controller or processor; Align the PIMS scope with the existing ISMS scope; Identify applicable privacy laws and contracts. Hands over PIMS Scope Statement and Role Map. Phase 2, Privacy Gap Assessment. We measure your current practices against the ISO 27701 controls and the privacy laws you must meet. You see exactly what is missing. Activities: Assess practices against clause 5 to 8 requirements; Test the Annex A and Annex B control sets; Check alignment with the DPDP Act and GDPR duties; Rank privacy gaps by legal exposure and effort. Hands over Privacy Gap Assessment Report. Phase 3, Privacy Control Design. We design controls for consent, data subject rights, retention, and processor agreements, all linked to your existing ISMS. Activities: Draft consent and purpose limitation controls; Design the data subject rights handling process; Set retention and deletion schedules; Update processor and sub-processor agreements. Hands over PIMS Control Set and Policy Updates. Phase 4, Implementation and Records. We help you build records of processing and embed privacy into day-to-day operations. Evidence starts flowing as the controls go live. Activities: Build records of processing activities; Embed privacy checks into change and onboarding flows; Train teams on the new privacy procedures; Start collecting evidence in the compliance platform. Hands over Records of Processing Activities and Evidence Trail. Phase 5, Internal Audit. We audit the PIMS against the standard and your legal obligations, then log and prioritise any findings. Activities: Plan the PIMS internal audit alongside the ISMS audit; Sample data subject requests and consent records; Log nonconformities against ISO 27701 controls; Agree corrective actions with control owners. Hands over PIMS Internal Audit Report. Phase 6, Certification Support. We stand with you through the certification audit, which usually runs alongside your ISO 27001 surveillance. Activities: Prepare the evidence pack for the certification body; Coordinate the extension audit with ISO 27001 surveillance; Support interviews with privacy control owners; Close findings raised during the audit. Hands over ISO 27701 Certificate. Each phase begins from the artefact the phase before it produced.