ISO/IEC 27701 certification, explained
ISO/IEC 27701 is the standard for privacy information management systems. It helps an organization that handles personal data, whether as a controller deciding how data is used or as a processor acting for others, to manage privacy risk in an organized way. It suits software and cloud firms, outsourcers, health and financial service providers. Independent certification bodies audit it. A certificate is not proof of legal compliance.
Updated 5 November 2026
Info. Showing a standard does not mean a partner holds scope for it. How matching works.
Who it may be relevant for
- Organizations that collect or process personal data about customers, patients or staff
- Cloud, software and outsourcing providers acting as processors for clients
- Companies whose customers ask for evidence of privacy management in procurement
- Organizations that already run information security and want a matching privacy layer
What it covers
- Roles of the organization as a controller, a processor or both
- Privacy risk assessment and decisions about how personal data is handled
- Controls covering purpose limits, consent and notice, individual rights and data sharing
- Working with processors and sub-processors and recording how data moves
- Monitoring, internal audit, management review and improvement of the system
What it can help with
- A defined way to assess and manage privacy risk across projects and suppliers
- Clear internal ownership for requests and incidents involving personal data
- A structured response to customer questions about privacy practices
- A system that complements information security work for organizations that run both
What the pathway means
ISO/IEC 27701 is a certifiable management-system standard. An independent certification body audits your privacy information management system through Stage 1, Stage 2, a decision, surveillance audits and recertification. Certification covers the defined scope. It is not a statement of compliance with any data protection law, and legal requirements vary by country, so check applicable rules separately. MIYAAR CONNECT does not audit or certify. We connect your inquiry with independent certification bodies.
Edition. ISO/IEC 27701:2025 is a second edition published in October 2025, replacing the 2019 edition. The 2019 edition was an extension to ISO/IEC 27001 and ISO/IEC 27002. Certification bodies and other sources describe the 2025 edition as a standalone management system standard that can be used without holding ISO/IEC 27001, while ISO's own page says it aligns with existing ISO/IEC 27001 systems. We could not open the ISO text, so confirm with the certification body how it applies to you and what transition arrangements exist. We do not state transition deadlines.
The typical process
Steps and timing vary by body and scope. This is the usual shape, not a promise.
- You and us
Your inquiry
You describe your needs and share the basics.
- Certification body
Application and contract review
The body reviews your scope, sites and size, then quotes.
- Certification body
Stage 1 audit
A readiness review of your management system documentation.
- Certification body
Stage 2 audit
An evaluation of how the system works in practice.
- This part is theirs
Certification decision
Made by the certification body, never by MIYAAR CONNECT.
- Certification body
Surveillance and recertification
Periodic surveillance audits, then recertification at the end of the cycle.
Where it is typically used
- A SaaS provider documenting its role as a processor and how it supports clients' obligations
- A clinic or insurer mapping personal data flows and access across departments
- A marketing or HR service controlling consent, retention and sharing of personal data
What affects cost
- Number of employees
- Number of sites
- Complexity of what you do and its risks
- The volume and sensitivity of personal data and the number of processing activities in scope
- Whether you act as controller, processor or both, and how many processors you rely on
- Whether you already hold ISO/IEC 27001, which may change how the audits are planned
- Number of locations and teams that handle personal data
What affects timing
- Time to map personal data flows and assign roles and responsibilities
- Which edition your certification body will audit against, and transition arrangements
- Building evidence that privacy controls and requests handling work in practice
- Availability of certification schemes and auditors for the 2025 edition
What to have ready
- A summary of the kinds of personal data you handle and why
- A note on whether you act as controller, processor or both
- Existing privacy notices, data maps or security certificates, described not uploaded
- Customer or regulator expectations that mention privacy management
- Do not send personal data or confidential contracts at the inquiry stage
Accreditation and recognition
A certificate shows an audited privacy management system for a stated scope. Certification bodies are assessed by accreditation bodies for defined scopes, and accredited schemes for a new edition may not yet exist everywhere, so verify for your case. Ask for the certificate number, scope and the edition audited, then confirm accreditation with the accreditation body or through the Global Accreditation Cooperation Incorporated (Global ACI) arrangement, which took over from the IAF and ILAC on 1 January 2026. It does not replace legal compliance work.
Common questions
Does ISO/IEC 27701 make us compliant with data protection law?
Do we need ISO/IEC 27001 first?
What is the difference between a controller and a processor?
Is the 2019 certificate still useful?
Related standards
Relevant industries
Useful reading
Sources
- ISO: ISO/IEC 27701:2025 privacy information management (checked 5 November 2026)
Ask about availability for ISO/IEC 27701
We review availability for each inquiry. If no verified certification body fits your request, we will tell you plainly.