ISO 27701ISO 27701 extends ISO 27001 with a Privacy Information Management System for organizations acting as PII controllers or processors. This checklist guides you through implementing privacy controls, conducting privacy risk assessments, and achieving certification.
ISO/IEC 27701 is an international standard that provides guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS) as an extension to ISO/IEC 27001 and ISO/IEC 27002.
The standard helps organizations manage privacy risks related to personally identifiable information (PII) and demonstrates compliance with global privacy regulations such as GDPR.
ISO 27701 specifies requirements and provides guidance for PII controllers and PII processors, supporting the integration of privacy controls into an existing information security management system (ISMS).
Privacy Controls
Aligned
Scope
Click each step to expand the details. Work through them in order — each step builds on the previous one.
Ensure the prerequisite management system is in place
ISO 27701 extends the ISO 27001 ISMS into a Privacy Information Management System (PIMS). An established and ideally certified ISMS is required before implementing ISO 27701 privacy-specific controls and management processes.
Determine your role as PII controller, processor, or both
ISO 27701 distinguishes between PII controllers (who determine the purposes and means of processing) and PII processors (who process PII on behalf of controllers). Your role determines which controls apply and how your PIMS is structured.
Identify and evaluate risks to PII
Extend your ISO 27001 risk assessment to specifically address privacy risks. This includes evaluating risks to PII principals arising from your processing activities, assessing the impact of potential privacy breaches, and identifying where additional privacy controls are needed.
Identify applicable privacy controls for your role
ISO 27701 provides 49 privacy-specific controls organized for PII controllers (Annex A) and PII processors (Annex B). Map these controls against your current practices to build your implementation roadmap.
Deploy controls for PII protection and privacy management
Implement the privacy controls identified in your gap analysis. These controls go beyond information security to address the full privacy lifecycle including lawful processing, purpose limitation, data subject rights, cross-border transfers, and privacy by design.
Create the documentation framework for your PIMS
ISO 27701 requires specific privacy documentation including a PII processing policy, privacy notices, records of processing activities, and data protection impact assessments. These documents form the governance backbone of your privacy management system.
Verify PIMS controls before the certification audit
Extend your internal audit program to cover ISO 27701 privacy controls. The audit should evaluate whether your PIMS meets the standard's requirements and whether privacy controls are operating effectively to protect PII.
Obtain ISO 27701 certification as an ISO 27001 extension
Work with your certification body to add ISO 27701 to your ISO 27001 certification. The audit evaluates your PIMS including privacy controls, processing records, and data subject rights processes. Your certificate will specify your certified role as controller, processor, or both.
Feeling overwhelmed? You don't have to do this alone.
Transparent cost ranges so you can plan and budget. Costs vary based on organization size, current security posture, and environment complexity.
Including preparation, tooling, and assessment fees
Depending on current maturity and scope
Independent verification of your compliance
Compliance management and evidence collection tools
SIEM, EDR, vulnerability scanning, encryption tools
Hundreds of hours across IT, security, and leadership
Annual reviews, continuous monitoring, recertification
The cost of non-compliance far exceeds the investment in getting certified. Consider what's at stake:
The question isn't whether you can afford compliance — it's whether you can afford not to have it.
Illumen specializes in helping organizations achieve ISO 27701 compliance — from initial assessment through certification. We meet you wherever you are in the journey.
Know exactly where you stand against requirements
Close gaps with expert guidance and support
Policies, procedures, and evidence packages
Common questions about ISO 27701 compliance and certification.
