Privacy, made certifiable. ISO 27701 extends ISO 27001 into a Privacy Information Management System — the auditable way to demonstrate systematic compliance with GDPR and other privacy regimes.
ISO/IEC 27701:2019 extends ISO 27001 and 27002 to create a Privacy Information Management System (PIMS). Where ISO 27001 protects information generally, ISO 27701 adds the controls and accountability specific to personal data.
It is explicitly mapped to privacy regulations including GDPR, which makes it the strongest auditable evidence available that an organisation manages personal data systematically — useful where a regulation itself offers no certificate.
It is implemented and certified as an extension to an ISO 27001 ISMS, so the two are best pursued together.
Companies that need auditable proof of privacy compliance, not just policies.
Businesses processing personal data across multiple privacy regimes.
Both roles benefit from a certified privacy management system.
Delivered through our specialist network, as an extension to ISO 27001. We build the privacy-specific controls and map them to the regulations that apply to you — turning a GDPR programme into something you can actually certify.
We define the boundary of your programme — systems, locations, and teams in scope — and agree the timeline and responsibilities up front, so there are no surprises later.
A structured assessment of your current posture against every requirement, producing a prioritised remediation plan with realistic effort estimates.
We write the policies, procedures, and controls, and work alongside your engineering team on a weekly cadence to implement them — not a stack of templates left for you to figure out.
The management system runs and generates evidence. We drive the internal audit and management review so the programme is demonstrably working before any external scrutiny.
We prepare the evidence package and sit alongside you through assessment, answering the assessor's questions directly rather than leaving you to defend the work alone.
GDPR and UK GDPR have no official certificate, yet customers and regulators still want evidence that you manage personal data systematically. ISO 27701 is the closest thing to a certifiable answer, because it turns privacy obligations into an auditable management system.
Controller or processor? The standard covers both roles. Controllers decide why and how personal data is used, processors handle data on a controller's behalf. Knowing which you are, and for which processing, shapes the controls you need and the answers you give customers.
How it fits with GDPR and ISO 27001. ISO 27701 extends ISO 27001 with privacy-specific controls and is mapped to GDPR, so it supports UK GDPR and EU GDPR work without replacing legal compliance. It is typically pursued together with ISO 27001. See our GDPR page and ISO 27001 page.
Remote-first delivery. ISONEX works remotely with clients across the GCC, UK, EU and US. We map your personal-data processing, build the privacy documentation and prepare you for the audit; for legal advice we work alongside your counsel. This page is general information, not legal advice. Book a free advisory session.
A GDPR programme makes you compliant; ISO 27701 makes that compliance auditable and certifiable. The PIMS gives you a recognised certificate to show customers and regulators, which GDPR alone does not provide.
Yes — ISO 27701 is built on ISO 27001 and certified together with it. Many clients implement both in a single combined engagement.
No. It supports GDPR compliance and gives you auditable evidence of a systematic approach, but it is a voluntary standard and does not replace legal compliance.
There is no single official GDPR certificate in this sense. ISO 27701 is a widely used way to demonstrate a managed privacy programme.
Certification bodies publish their own arrangements for editions of the standard. We confirm the right edition and approach with your certification body at scoping.
Yes. ISONEX is a remote-first consultancy and we deliver privacy programmes for clients in the UK, the EU, the US and the GCC. Everything is done online, scheduled around your working hours.
Book a free advisory session and we'll map your fastest credible route to compliance.
Book a free advisory session