Fast facts
ISO/IEC 27701 extends ISO 27001 and ISO 27002 into the privacy domain. Rather than defining a standalone system, it adds privacy-specific requirements to the ISMS clauses and introduces two additional control sets: one for organisations acting as personally identifiable information controllers, and one for those acting as processors.
Its practical value is comparability. A privacy programme built to 27701 can be mapped, control by control, to DPDPA, GDPR, and most other data protection regimes — which is why it has become the default answer to "how do you evidence privacy maturity?" in enterprise procurement.
Certification requires a valid ISO 27001 certification, either held already or achieved concurrently. For organisations pursuing both, running them together is meaningfully cheaper than sequentially.
Who it applies to
The commercial and regulatory argument, rather than a restatement of the text. If none of these apply to you, the honest answer is that this framework is not your priority.
Enterprise procurement increasingly asks how privacy maturity is evidenced. A certificate answers in one line what would otherwise be a bespoke due-diligence exercise for every deal.
A programme built to 27701 maps control by control to DPDPA, GDPR and most other data protection regimes, which is why multinationals use it as the common denominator rather than maintaining separate programmes.
Because it extends an existing management system rather than standing up a new one, the marginal cost is roughly 30% of an ISO 27001 programme when run concurrently.
Scope is the decision that sets the cost, and it is usually made in week one when the team knows least. Both columns matter equally.
In scope
Out of scope
How the boundary is decided: The determining decision is role. Most organisations are a controller for some processing and a processor for others, and the applicable control set differs materially. Getting the role split wrong is the most common cause of a failed 27701 audit.
Stated as the duty rather than the clause number, because clause numbers do not tell an engineering team what to build.
Extend the ISMS scope to cover privacy, determining the organisation's role as PII controller, PII processor or both for each processing activity.
Risk assessment extended to include risk to data subjects, not only risk to the organisation — a distinction auditors examine closely.
Conditions for collection and processing, obligations to PII principals, privacy by design and by default, and controls for sharing, transfer and disclosure.
Processing under customer instruction, obligations to the controller, sub-processor management, and records the controller can rely on for their own compliance.
Maintained records of PII processing, published privacy information, and evidence of lawful basis for each processing purpose.
The areas your teams will actually be building in, with control counts where the framework defines them.
Privacy-adjusted versions of context, leadership, planning, support, operation, evaluation and improvement clauses.
Privacy-specific interpretation of each of the ISO 27002 security controls.
Consent, purpose specification, PII principal rights, privacy by design, automated decision-making and transfer controls.
Customer instruction, marketing restrictions, sub-processor engagement, disclosure notification and return or disposal of PII.
Phases overlap deliberately. Design begins before assessment closes, so the programme does not stall waiting for a document to be signed off.
Weeks 1–2
Establish controller and processor roles precisely for each processing activity, including intra-group and customer-directed processing.
Weeks 2–5
Widen scope, context and interested parties to cover privacy. Extend the risk methodology to capture risk to data subjects, not only to the organisation.
Weeks 4–8
Establish records of PII processing as a live artefact fed by the data inventory rather than a document maintained by hand.
Weeks 6–12
Deliver the controller and processor control sets applicable to your role mix, with DPDPA and GDPR obligations cross-mapped onto them.
Weeks 12–14
Internal audit across ISMS and PIMS together, then certification audit as an extension to the existing certificate.
Named artefacts, listed in the statement of work. If something is not on this list, we will tell you before you sign rather than after.
Where ISO 27001 is already held, 27701 extension typically takes 10–14 weeks. Running both concurrently adds roughly 30% to an ISO 27001 timeline rather than doubling it.
Role determination
Weeks 1–2
Short but decisive. Everything downstream depends on getting this right.
System extension
Weeks 2–8
ISMS widened to privacy, records established, risk methodology extended.
Control delivery
Weeks 6–12
Controller and processor controls implemented and evidenced.
Certification
Weeks 12–14
Combined audit as an extension. Adds roughly 30% to an ISO 27001 timeline when run concurrently rather than doubling it.
The sequence we follow, and the parts where first-time implementations most often lose time.
Determine controller and processor roles precisely for each processing activity.
Extend the existing risk methodology to capture risk to data subjects.
Map DPDPA and GDPR obligations onto the 27701 control set so one system serves all.
Build the PII processing records as a live artefact fed by the data inventory.
Implement the controller and processor controls applicable to your role mix.
Run a combined internal audit across ISMS and PIMS to avoid duplicated effort.
Turn data protection law into working product behaviour.
We map where personal data actually lives, rebuild consent and rights flows into your product, and leave you with a privacy programme that survives an audit and a board question.
Explore capabilityCertification without the eighteen-month scramble.
Readiness, implementation and audit support for ISO 27001, ISO 27701, ISO 42001, SOC 2 and PCI DSS — run as a project with dates, owners and a definition of done.
Explore capabilityA named, qualified DPO — accountable, available and independent.
Statutory Data Protection Officer capability delivered as a service: named point of contact, regulator liaison, DPIA sign-off and board reporting, without a full-time hire.
Explore capabilitySequencing matters. Running these together off one control library costs meaningfully less than running them apart.
Including the questions where the honest answer is less convenient than the marketing one.
Ask a practitioner directly. First responses come from the person who would run your engagement, within one business day.
Ask a question
