certification
ISO 27701
A voluntary standard for running privacy as a management system, for organisations that decide how personal data is processed and for those that process it for others. No law requires it, and a certificate is not GDPR compliance. Since October 2025 it is a standalone standard.
at a glance
- what it is
- ISO/IEC 27701:2025, edition 2, published in October 2025, for a privacy information management system (PIMS). It replaced the 2019 edition, which ISO lists as withdrawn.
- standalone or extension
- The 2019 edition was titled an extension to ISO/IEC 27001 and 27002. ISO's page for the 2025 edition says it can be used alone.
- who it covers
- Whoever chooses it, or whose customer requires it. ISO says it is designed for controllers and processors of personal data.
- who checks
- An external certification body, against a scope you define. ISO does not certify.
- penalties
- None under law. You can lose the certificate or the contract.
- legal weight
- None under GDPR on its own. A certificate does not show that you comply with GDPR.
basis ISO/IEC 27701:2025 and 2019 catalogue pages; ISO conformity assessment page; GDPR Art. 24(1)
does it apply to you?
A few questions, answered in your browser, tell you which rules are yours. Nothing is sent anywhere.
find my ruleswhich role do you play for each processing activity?
- Do you process personal data on behalf of another organisation, on its documented instructions?noyesProcessor for that activity. Its contract sets what you may do, and you assist the controller with requests, security and breaches.
- Do you decide the purposes and means of the processing together with another organisation?noyesJoint controller. The two of you settle who does what in an arrangement, including towards the people concerned.
- Otherwise you decide alone why and how the data is processed, and you act as a controller. One company often plays different roles for different activities, so write the answer per activity in the records.
basis GDPR Art. 26(1), 28(1), 28(3), 30(2). Reading the standard's own role language is practice; the standard was not read.
from the law to a certificate, and what stays open
- 1the lawGDPR says what must be true for each processing
- 2your records and contractsrecords of processing, processor terms, request and breach procedures
- 3the management systeman owner, a scope, an internal audit and a management review keep them true
- 4the certificatea certification body checked the system, in a scope, on a date
every year, with the certification body checking the cycle
what the certificate does not show
- that each processing is lawfulthe standard checks your system, not each decision
- that you met a deadlinesuch as a request answered or a breach notified in time
- that an authority agreesa supervisory authority applies the law, not the standard
basis GDPR Art. 12(3), 30(1), 28(3), 33(1). Certification meaning: ISO conformity assessment page. What the system covers is practice.
the whole job, in order
Phases, with who carries each step and the proof it leaves. Open a phase to see its steps.
- decide whether to certify, and what for
Find out who needs the certificate, what they would accept instead, which activities it should cover and which role you play in each.
- check where you stand
Compare what you do today with what the standard asks, and turn the differences into a list of work.
- build the privacy management system
Write the records, run the privacy risk work and put the procedures in place for everything inside the scope.
- audit yourself and review with management
Check that the system runs as written, and put the results in front of management.
- pass the external audit
Choose a certification body, go through its audit and deal with what it finds.
- keep it alive each year
Run the system through the year, repeat the audit and review, and meet the certification body's follow-up.
what a certificate does and does not show
Read this before a customer asks you for one.
controllers and processors of personal data who choose it, or whose customer requires it
a privacy information management system, assessed by an external certification body
what it asks, and ways to meet it
The rule says what must be true in the company. It names no tools or methods: you choose them, and the people implementing it and the board answer for the choice. Under each requirement are the controls that usually deliver it. That grouping is our reading of the rule, not a list from the act.
the long read
The full explanation, section by section, with the sources.