ISO/IEC 27701 certification: privacy management guide

Overview

What the privacy information management standard covers, why it matters, and how the 2025 edition can be certified.

What it is

ISO/IEC 27701:2025 is an independent certifiable management system standard for organizations acting as controllers or processors of personally identifiable information. It covers privacy governance, roles, risk, operational controls, data-subject matters, processor relationships, evidence, evaluation, and improvement.

Why it matters

Certification can demonstrate accountable privacy management and complement ISO/IEC 27001 and legal privacy programmes. It can support customer assurance, but it does not automatically prove GDPR or every national privacy law is satisfied, and its scope must match the relevant processing.

How to obtain it or demonstrate compliance

1. Define the legal entity, sites, products, services, and processes inside the certification scope.
2. Buy or lawfully access the current standard and perform a documented gap assessment.
3. Implement objectives, responsibilities, controls, records, competence, and corrective-action processes.
4. Complete internal audits and a management review, then close identified gaps.
5. Select a competent certification body—preferably accredited for the standard and sector—and verify its status.
6. Complete the stage 1 and stage 2 audits, correct nonconformities, and maintain certification through surveillance and recertification.

What to review

1. Confirm the current edition, certification scope, sites, legal entities, exclusions, and certificate validity.
2. Map applicable laws, regulator duties, contracts, customer requirements, and sector-specific controls separately from the voluntary standard.
3. Test whether policies operate in practice and whether records support each material claim before the external audit.
4. Describe the standard, edition, scope, certification body, accreditation, and limitations accurately in procurement and marketing.

What to do next

Treat certification as an operating system, not a document project. Assign accountable owners, measure performance, investigate failures, correct root causes, and keep evidence current between audits.

Official sources and further reading

• ISO/IEC 27701:2025 — Privacy information management systems — International Organization for Standardization
• Certification — ISO does not perform certification — International Organization for Standardization