ISO/IEC 27701 gives a company a recognized structure for managing personal data, and a certification body can assess it. The privacy content inside that structure is the same work the GDPR already asks for, which is where Engage Compliance fits.
Key takeaways
- ISO/IEC 27701 is a voluntary standard for a privacy information management system (PIMS). The GDPR is the law, and the two are separate.
- The current edition is ISO/IEC 27701:2025, which replaces the 2019 edition. ISO no longer titles it as an extension to ISO 27001.
- Certification is done by an independent certification body. Engage Compliance does not certify, audit for certification or make any accreditation claim.
- The privacy work behind the standard (records of processing, lawful bases, requests, processor contracts, risk assessments) is GDPR work, and an expert privacy team can do most of it with you before the audit.
What is ISO 27701?
ISO/IEC 27701 specifies requirements for establishing, running and improving a privacy information management system, and gives guidance on putting them into practice. It is written for organizations that act as controllers or processors of personal data, which in GDPR terms covers most companies we work with.
The 2019 edition was published as an extension to ISO/IEC 27001 and ISO/IEC 27002, so it was read together with an information security management system. ISO published a second edition, ISO/IEC 27701:2025, which replaces the 2019 edition and is no longer titled as an extension. If you hold or are planning a certificate, ask your certification body for its transition rules and whether it certifies the 2025 edition on its own, since they set the timetable and not us.
How does ISO 27701 relate to the GDPR?
The standard and the regulation overlap in subject matter but not in status. The GDPR binds you if it applies to your processing. ISO/IEC 27701 is something you choose to adopt, usually because a customer asks for it or because you want a structured way to show your privacy program is managed.
Article 42 of the GDPR describes data protection certification mechanisms, and Article 42(4) says that a certification under it does not reduce the responsibility of the controller or processor for complying with the GDPR. We make no claim here that an ISO certificate is a certification under that Article. A certificate against an ISO standard is evidence about your management system. Compliance of the processing itself stays your responsibility.
For the security side of the comparison, see our guide to GDPR and ISO 27001.
Who asks for ISO 27701?
Mostly enterprise buyers and their procurement teams, as part of vendor due diligence. Customers ask for it less often than they ask for ISO 27001 or a SOC 2 report, and many ask for neither if your answers to their privacy questionnaire are solid. A company handling large volumes of personal data on behalf of customers, such as a processor selling to European enterprises, is the usual candidate.
Ask the customer what they need before you commit to a certification. A signed data processing agreement and clear answers to their privacy questionnaire sometimes close the question without one. Our SOC 2 and ISO 27001 guide covers the same question for the security standards.
What does the privacy work behind ISO 27701 involve?
The standard expects a working privacy program, documented and kept up to date. In practice that means:
- A defined scope, and a clear statement of whether you act as controller, processor or both for each activity.
- A record of processing activities, the same record Article 30 of the GDPR requires. Our RoPA services build it with you.
- Lawful bases, privacy notices and consent wording that match what the product does.
- Contracts with processors and sub-processors, and a view of international transfers.
- Privacy risk assessment, including data protection impact assessments for higher-risk processing.
- A process for access, deletion and other data subject requests, and for personal data breaches.
- Training, internal review and management review, so the program keeps running after the audit.
Most of this is already needed for GDPR compliance. If it is missing, the certification audit finds it, and so does a customer questionnaire.
Where does Engage Compliance help?
We are the privacy expert on your team. We run a GDPR audit to show what is missing, write or repair the documents and processes above, and keep them current as the product changes. When Article 37 applies to you, or a customer wants a named DPO, our outsourced DPO services cover that role too.
We work next to your security lead, your compliance platform and your certification body. They run the management system and the audit, and we supply the privacy content and the answers to privacy questions. We do not audit you for certification, we do not issue certificates, and we make no claim about accreditation.
Privacy Advisory starts From €600 per month, and DPO Foundation, with a named DPO, starts From €1,000 per month. The right starting point depends on how much of the program you already run.
Next step
If a customer has asked for ISO 27701 and you want to know what it would take on the privacy side, book a free intro call. We will tell you what to do first, and whether you need the certification at all.
Sources and references
- ISO/IEC 27701:2025, Privacy information management systems: Requirements and guidance, International Organization for Standardization
- ISO/IEC 27706:2025, Requirements for bodies providing audit and certification of privacy information management systems, International Organization for Standardization
- Regulation (EU) 2016/679 (GDPR), official text, EUR-Lex
This page is general information, not legal advice.