Privacy, made certifiable. ISO 27701 extends ISO 27001 into a Privacy Information Management System — the auditable way to demonstrate systematic compliance with GDPR and other privacy regimes.
ISO/IEC 27701:2019 extends ISO 27001 and 27002 to create a Privacy Information Management System (PIMS). Where ISO 27001 protects information generally, ISO 27701 adds the controls and accountability specific to personal data.
It is explicitly mapped to privacy regulations including GDPR, which makes it the strongest auditable evidence available that an organisation manages personal data systematically — useful where a regulation itself offers no certificate.
It is implemented and certified as an extension to an ISO 27001 ISMS, so the two are best pursued together.
Companies that need auditable proof of privacy compliance, not just policies.
Businesses processing personal data across multiple privacy regimes.
Both roles benefit from a certified privacy management system.
Delivered through our specialist network, as an extension to ISO 27001. We build the privacy-specific controls and map them to the regulations that apply to you — turning a GDPR programme into something you can actually certify.
We define the boundary of your programme — systems, locations, and teams in scope — and agree the timeline and responsibilities up front, so there are no surprises later.
A structured assessment of your current posture against every requirement, producing a prioritised remediation plan with realistic effort estimates.
We write the policies, procedures, and controls, and work alongside your engineering team on a weekly cadence to implement them — not a stack of templates left for you to figure out.
The management system runs and generates evidence. We drive the internal audit and management review so the programme is demonstrably working before any external scrutiny.
We prepare the evidence package and sit alongside you through assessment, answering the assessor's questions directly rather than leaving you to defend the work alone.
A GDPR programme makes you compliant; ISO 27701 makes that compliance auditable and certifiable. The PIMS gives you a recognised certificate to show customers and regulators, which GDPR alone does not provide.
Yes — ISO 27701 is built on ISO 27001 and certified together with it. Many clients implement both in a single combined engagement.
Book a free advisory session and we'll map your fastest credible route to compliance.
Book a free advisory session