ISO/IEC 27701 Privacy Information Management System
ISO 27701 extends your ISO 27001 ISMS into a privacy management system, giving you a certifiable answer to "how do you manage personal data?" that maps cleanly onto GDPR and the DPDP Act.
4.9/5 average client rating · 500+ engagements delivered
How ISO 27701 works
ISO 27701 is not standalone — it is a certifiable extension. You take your existing ISMS, broaden the scope to privacy, apply the additional requirements to clauses 4 to 10, and implement the controller controls, the processor controls, or both depending on your roles.
The value is external: a certificate that a customer or regulator recognises, backed by Annex mappings that show which GDPR articles each control supports. It converts privacy from a set of policies into an audited system.
- ISMS extended with privacy-specific requirements across context, leadership, planning and operation
- Annex A — 31 controls for PII controllers: consent, purpose, rights, transparency and transfers
- Annex B — 18 controls for PII processors: customer instructions, sub-processors, records and assistance
- Roles and responsibilities including where a DPO exists
- Privacy risk assessment and privacy impact assessment integration
- Records of processing, retention, disposal and transfer documentation
Key facts
| Standard | ISO/IEC 27701:2019 (extension to ISO/IEC 27001 and 27002) |
|---|---|
| Prerequisite | ISO 27001 certification, either already held or achieved in the same audit |
| Structure | ISMS extensions plus Annex A (PII controller) and Annex B (PII processor) controls |
| Regulatory mapping | Annexes D and F map controls to GDPR articles; readily extended to DPDP |
| Typical timeline | 6–10 weeks when ISO 27001 is already in place |
What we implement
We extend the ISMS rather than building a parallel system, which is what keeps the incremental cost low.
Role determination
Controller, processor or joint controller per processing activity — the decision that sets which annex applies.
Scope extension
ISMS scope broadened to PII processing, with the privacy-specific additions to clauses 4–10 documented.
Controller controls
Lawful basis, consent records, notice, individual rights, automated decisions, transfers and joint controller arrangements.
Processor controls
Processing only on instruction, sub-processor management, controller assistance, records and return or deletion of PII.
Regulation mapping
Control-to-article mapping for GDPR and clause mapping for the DPDP Act, maintained as a live matrix.
Assurance
Extended internal audit, management review and combined certification audit with your ISMS.
Who benefits
Organisations that already hold ISO 27001 and face repeated privacy due diligence, or that operate across multiple privacy regimes.
- SaaS and cloud processors handling customer personal data at scale
- BPO, analytics and marketing service providers acting as processors
- Healthtech, fintech and HR technology companies with sensitive data
- Companies subject to both GDPR and India’s DPDP Act
- Any ISO 27001 certified organisation whose customers now ask about privacy specifically
A certificate for privacy
GDPR has no official certification scheme; ISO 27701 is the closest recognised equivalent buyers will accept.
Low incremental effort
Sharing the ISMS means certification usually adds only a few audit days rather than a full project.
Multi-regime coverage
One control set evidenced against GDPR, UK GDPR and the DPDP Act simultaneously.
Faster due diligence
Privacy questionnaires get answered by certificate and mapping matrix rather than bespoke responses.
How the engagement runs
Readiness check
ISO 27001 maturity confirmed, roles determined per processing activity and scope extension agreed.
Gap assessment
Assessment against clause extensions and the applicable annex controls, with remediation plan.
Implementation
Privacy policies, records of processing, rights workflows, sub-processor governance and transfer documentation.
Mapping & audit
GDPR/DPDP mapping matrix produced, internal audit extended and management review conducted.
Certification
Combined ISO 27001 + 27701 audit coordinated with your certification body.
What you receive
- Role determination matrix per processing activity
- Extended ISMS scope and privacy-adapted clause documentation
- Applicable Annex A / Annex B control implementation evidence
- Records of PII processing for controller and processor roles
- Privacy notices, rights fulfilment procedures and retention schedule
- Sub-processor register, transfer documentation and customer assistance procedures
- GDPR and DPDP mapping matrix, internal audit and certification support
ISO 27701 — frequently asked questions
No. ISO 27701 is an extension standard — the certificate is issued against ISO 27001 plus ISO 27701. You can achieve both in a single combined audit if you are starting fresh, which is what we usually recommend.
It gets you a long way and gives you evidence, but it is not a legal determination. Annex D maps controls to GDPR articles, yet some obligations — lawful basis judgements, DPIA conclusions, representative appointment — remain legal decisions the certificate does not make for you.
Typically a modest increment. If the ISMS is mature, the additional implementation is six to ten weeks and the certification body usually adds a small number of audit days rather than a full audit cycle.
Annex A if you determine purposes and means (controller), Annex B if you process on another organisation’s instructions (processor). Most SaaS companies are both — processor for customer data, controller for their own employees and marketing — and implement both annexes.
Not out of the box, but the control set covers most DPDP duties. We add a DPDP mapping layer covering consent granularity, itemised multilingual notices, Board breach notification and children’s data, which are the areas where DPDP goes beyond the standard’s GDPR-oriented annexes.
Still not sure what applies to you?
Ask an assessor directly — we answer scoping questions before anyone talks about a fee.
Get a realistic timeline and a fixed fee
A 30-minute call is usually enough to scope ISO 27701 accurately. You will leave with a timeline, an evidence checklist and a number — whether or not you engage us.