ISO 27701: show you manage personal data well
ISO 27701 is the international standard for managing privacy: how you handle personal data, whether you hold it for yourself or handle it for clients. The standard suits firms that process personal data for others, often alongside ISO/IEC 27001. We implement; an accredited certification body audits and issues the certificate.
Who asks for it, and what it shows them
One certificate. Many audiences read it.
- Regulators“Can you show your privacy management is accountable and evidence-based?”ISO says the standard helps demonstrate compliance with privacy laws such as the GDPR.ISO, read 12 Oct 2026
- Customers“How do you manage the personal data you process for us?”A management system for personal data that ISO says supports trust with clients and partners.ISO, read 12 Oct 2026
- Management“Can we run privacy as a system rather than a set of policies?”Accountable, evidence-based privacy management, aligned with an ISO 27001 system.ISO, read 12 Oct 2026
- Partners and multinational clients“(A multinational client) You process our personal data. What independent assurance do you have?”Microsoft accepts ISO 27701 with ISO 27001 as the assurance for suppliers that process its personal data.Microsoft, read 12 Oct 2026
A supplier processing Microsoft personal data in higher-risk profiles must submit ISO 27701 with ISO 27001, or complete a separate independent assessment, before new in-scope purchase orders are processed.
Microsoft, read 12 Oct 2026Who it is for
Firms that handle personal data for clients, such as software, outsourcing, HR and health services, and firms with ISO/IEC 27001 that want privacy covered too. Privacy leads get a privacy information management system (PIMS).
Who does what
- You
You name a privacy lead, confirm the scope and run the agreed processes.
- Us: we prepare you
We implement: privacy risk assessment, records of processing, policies, controls, internal audit and management review.
- Independent body: audits and certifies
An accredited certification body audits your privacy management system and, if you conform, issues the certificate.
What you get
Deliverables mapped to what the assessor tests.
- Privacy roles, purposes and records of processing
- Controls mapped to the ISO/IEC 27701:2025 clauses
- Evidence that sits alongside your ISO/IEC 27001 system
- Internal audit and management review records
What drives the time and the effort
- Whether ISO/IEC 27001 is already in place
- How many systems, vendors and countries handle personal data
- Your role: holding data for yourself, for clients, or both
- Existing privacy policies, records and consent processes
- The certification body’s audit fee, charged by that body
Our ISO implementers are practising lead auditors for ISO/IEC 27001, 27701, 22301 and 42001.
Common questions
What is the ISO 27701 standard?
An international standard for privacy information management, published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). The standard sets out how to govern personal data and meet privacy laws such as the Personal Data Protection Act (PDPA).
What is the difference between ISO 27001 and ISO 27701?
ISO/IEC 27001 protects all information. ISO/IEC 27701 focuses on personal data: privacy roles, purposes, consent, individuals’ rights and vendors. Many firms run both as one management system with one audit.
Do we need ISO 27701 for the PDPA?
No, the PDPA does not require ISO 27701. Certification is independent proof that your privacy management works, which matters to clients that send you personal data.
How much does ISO 27701 certification cost?
Our fee depends on scope, existing ISO/IEC 27001 work, systems and vendors; the certification body charges its own audit fee. You get a fixed-fee proposal after a short scoping call. Government grants may cover part of the cost. We check at your first call. Tell us your scope in 5 minutes and you get a fixed-fee proposal within 2 working days: Scope your project
Latest PDPC case on this topic · 2026-08-05 · Construction, engineering and manufacturing · Voluntary undertaking
Relying on an IT vendor does not remove your responsibility: know how your servers are secured and maintained, and check the vendor is doing it.
Read the PDPC decision of 5 August 2026, on pdpc.gov.sg (opens in a new tab)ISO work is led by a practising lead auditor, certified through IRCA or PECB.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)