ISO 27701 privacy audit for organisations that want to be demonstrably compliant

ISO 27701 is the international standard for a Privacy Information Management System (PIMS). It is an extension to ISO 27001 that adds specific requirements and guidelines for managing privacy and the processing of personal data. With ISO 27701 you demonstrably show that you manage privacy risks and you support your GDPR compliance from a structured management system.

ISO 27001 focuses on information security in the broad sense through an ISMS. ISO 27701 builds on this and adds a privacy layer: the PIMS. Where ISO 27001 asks how you secure information, ISO 27701 asks how you manage personal data and privacy risks. You cannot certify ISO 27701 in isolation; it always requires an underlying ISO 27001 ISMS.

Yes. ISO 27701 translates many GDPR obligations into concrete controls: a record of processing activities, data subject rights, DPIAs, data processing agreements and retention periods. It makes compliance demonstrable and repeatable rather than a one-off exercise. It is not an automatic guarantee that you are fully GDPR-compliant, but it provides a strong, verifiable framework that covers most of it.

No. ISO 27701 is an extension to ISO 27001 and cannot be certified without an underlying ISO 27001 ISMS. In practice, organisations implement both standards together, often in one integrated management system and a single combined audit, because information security and privacy overlap strongly.

The auditor assesses whether privacy is demonstrably managed. They look at the division of roles between controller and processor, the record of processing activities, DPIAs, data processing agreements, retention periods, the handling of data subject requests and the data breach procedure. As with ISO 27001, they look for evidence that policy is applied in practice, not just that it exists on paper.

A privacy gap analysis compares your current privacy practice with the requirements of ISO 27701 and the GDPR. You gain insight into which documents, processes and measures are already in order and where the gaps lie. The result is a priority list and roadmap, so you can make targeted improvements before a formal audit or certification takes place.

These include an up-to-date record of processing activities, a privacy policy, DPIAs for high-risk processing, data processing agreements with suppliers, a procedure for data subject rights, a data breach procedure and defined retention periods. The auditor checks not only whether these exist, but also whether they are up to date and actually used.

For SaaS providers that, as a processor, handle large volumes of customers' personal data, ISO 27701 is often a strong selling point. It demonstrably shows business customers that privacy is under control, simplifies due diligence and processor assessments, and ties in seamlessly with an existing ISO 27001 certificate.