ISO 27701 Privacy Information Management Certification

No, not since the 2025 edition. ISO/IEC 27701:2019 was an extension of ISO 27001, so certification required an information security management system underneath it. ISO/IEC 27701:2025, published in October 2025, is a standalone management system standard with its own clauses and its own Annex A controls, so you can implement and certify a privacy information management system without holding ISO 27001. Many organisations will still run both, because a privacy programme depends on security controls such as access management, logging and incident response, and one integrated system avoids duplicated policies and audits. The decision is commercial: if your customers ask for ISO 27001 as well, build both on one set of controls; if they ask only how you handle personal data, ISO 27701 alone is now a legitimate answer. We scope both options before you commit.

Your certificate stays valid for now, but it will need to move to the 2025 edition within a transition period. Transition arrangements for revised standards are set by the International Accreditation Forum and applied by your certification body, and for most revisions the transition runs for up to three years; because the 2025 edition changed ISO 27701 into a standalone standard, confirm the exact deadline and audit approach with your certification body rather than assuming it. The practical work is a gap assessment against the new clauses and the restructured Annex A, updating your statement of applicability and control mapping, and refreshing records and policies that referred to the 2019 structure. For most organisations with a working programme the gaps are modest. We run that transition assessment and plan the update so it lands in a routine surveillance or recertification audit.

It gets you a long way, but it does not replace the law. ISO 27701's controls for consent, notice, purpose limitation, data subject rights, retention, processors and breach handling map closely to the duties the DPDP Act places on Data Fiduciaries, and a certified PIMS is strong evidence that you manage personal data systematically. The Act, however, has requirements a management system standard cannot know about, such as its specific notice content, consent manager arrangements, children's data rules, Significant Data Fiduciary duties and the breach intimation procedure in the DPDP Rules, 2025, most of which apply from 13 May 2027. We map each ISO 27701 control to the corresponding DPDP Act and Rules obligation during the gap assessment, close the legal gaps on top, and build one set of records that serves both the certification audit and your DPDP Act compliance.

A controller decides why and how personal data is processed; a processor handles it on a controller's instructions. ISO/IEC 27701:2025 reflects that split in Annex A, which contains 34 controls for controllers, 21 for processors and 31 that apply to both, restructured to align with ISO/IEC 27002:2022. Controller controls cover areas such as identifying the lawful basis, consent, notices, data subject rights and privacy by design. Processor controls cover acting only on instructions, assisting the controller with rights requests, sub-processor management and returning or deleting data at the end of a contract. Many businesses are both: a SaaS company is typically a controller for its own customer and employee data and a processor for the data its customers put into the platform. We map every processing activity to its role during scoping so the right controls apply.

If your customers ask for both, yes, on one set of controls. The standards share a management system structure, clauses four to ten, so risk assessment, internal audit, management review and corrective action can run once for both, and security controls such as access control, logging and incident response serve as evidence for each. Certification bodies commonly audit the two together, which reduces audit days compared with separate audits. If you already hold ISO 27001, adding ISO 27701 is mainly the privacy controls, records of processing and rights handling on top of what exists. If you hold neither and customers only ask about personal data, the 2025 edition lets you start with ISO 27701 alone and add ISO 27001 later. We recommend the order during scoping based on the contracts and questionnaires you are actually receiving, not on what sounds most complete.

For a first certificate, usually four to six months, and our phases add up to that. Scoping and role mapping takes one to two weeks, the privacy gap assessment two to three, control design three to four, implementation and records of processing four to eight, and the internal audit one to two, before the certification body's audit. An organisation that already runs ISO 27001 moves faster, because the management system, risk process and many security controls exist. What stretches the timeline is usually the records of processing: finding every place personal data is collected, stored and shared, including spreadsheets, exports and third-party tools nobody listed. The certification body's availability also matters, so book the audit window early. We commit to a date after the gap assessment, once the size of the records and remediation work is clear.

We do not publish a figure for ISO 27701, because the work varies too much between organisations for a range to be useful. The quote depends on the number of processing activities and data flows in scope, whether you act as a controller, a processor or both, how many sites and business units are covered, whether ISO 27001 already exists or is being built at the same time, and how much of the records of processing and rights handling already works. Two costs sit outside our fee: the accredited certification body's audit fee, which you contract directly, and your own team's time building records and running the new procedures. Combining ISO 27701 with an existing or parallel ISO 27001 programme usually lowers the total, because the management system is shared. We scope first, then give you a fixed price in writing for the work.

An accredited certification body issues it after a certification audit of your privacy information management system, and it must stay independent of whoever built that system. SecureRoot is not a certification body and does not issue certificates; a consultant offering to build your PIMS and then certify it would be auditing its own work. What we do is everything before and around the audit: scoping, the privacy gap assessment, control design, records of processing, training, the internal audit, and support through the certification body's audit, including preparing control owners for interviews and closing any findings. We also help you choose a certification body accredited for ISO 27701 and, where you hold ISO 27001, one that can audit both together. The certificate carries the certification body's name; the clean result comes from the preparation that goes before it.