the whole job

ISO 27701: the whole job, in order

A customer who hands you personal data may ask for an ISO 27701 certificate. A certificate shows that a certification body looked at your privacy management system, within a scope you chose, at a point in time. It does not show compliance with GDPR. This plan takes you from the decision to certify to the yearly cycle, in six stages, and puts the GDPR work that the standard rests on in the order that holds up.

last checked 2 November 2026

how to read this plan

ISO/IEC 27701:2025 is a standard for running privacy as a management system, so most steps set up records, owners and checks that repeat. The standard is paid and was not read for this plan, so no step cites a clause: take clause and control numbers from your licensed copy. Where GDPR has a text on the same work, the step cites it, and the basis note says so. Where it does not, the step says practice. A certificate does not make you compliant with GDPR, and this plan does not cover all of GDPR, such as legal grounds and notices. The order follows dependencies. Under each step a small note names the basis.

  • decide and documentchoices, policies and records that someone with authority signs
  • build and configuresystems, settings and procedures that make the choice real
  • prove and operatechecks, logs and records that show it keeps working
01

decide whether to certify, and what for

Find out who needs the certificate, what they would accept instead, which activities it should cover and which role you play in each.

  1. ask who requires the certificate

    Ask the customers that raised it whether they require a certificate or would accept your records, your processor terms or an answer in the questionnaire. Record each answer with the date. No EU rule on this site requires the certificate.

    • owner board
    • decide and document
    what it produces
    a short list of customers, what each asked for and what each would accept
    the proof it leaves
    the list, with the source of each answer

    the work page

    basis working practice. No legal text sets this.

  2. set the scope and your role for each activity

    Decide which processing activities, products, sites and systems the certificate covers, and write down what is out. For each activity, decide whether you act as controller, joint controller or processor, because the duties differ.

    • owner legal or DPO
    • decide and document
    what it produces
    a scope statement with a role for each activity in it
    the proof it leaves
    the statement, approved by management

    basis GDPR Art. 26(1); GDPR Art. 28(1)

  3. name who answers for the system

    A controller is responsible for compliance and must be able to show it. Name one accountable owner at management level and one operational lead for privacy, and give them time and a budget line.

    • owner board
    • decide and document
    what it produces
    a decision naming the accountable owner and the operational lead
    the proof it leaves
    the minutes of that decision

    the work page

    basis GDPR Art. 24(1)

you are done with this phase when you can show a board decision to certify or not, the customers behind it, a written scope and your role for each activity in it.
02

check where you stand

Compare what you do today with what the standard asks, and turn the differences into a list of work.

  1. get a licensed copy of the current edition

    Buy the standard from the publisher or a national standards body, and check that it is the 2025 edition. ISO lists the 2019 edition as withdrawn. Give it to the operational lead and to whoever will advise. Every clause and control number you use should come from your copy.

    • owner head of IT
    • build and configure
    what it produces
    a licensed copy of the current edition held by the people doing the work
    the proof it leaves
    the purchase record, with the edition noted

    basis working practice. No legal text sets this.

  2. compare your practice with the standard

    Go through the standard with the people who handle personal data, and mark what you already do, what you do in part and what is missing. Keep to the scope you wrote. If you already run an information security system, it will cover part of this.

    • owner legal or DPO
    • prove and operate
    what it produces
    a gap list with the finding, the owner and the proof you already hold
    the proof it leaves
    the gap list, dated and signed by the operational lead

    basis working practice. No legal text sets this.

  3. order the gaps into one plan of work

    Put the gaps in the order in which they depend on each other, give each an owner and a date, and decide what you will accept for now. Management approves the plan, so that the work has authority behind it.

    • owner board
    • decide and document
    what it produces
    an ordered plan of work with owners and dates
    the proof it leaves
    the plan, approved by management

    basis working practice. No legal text sets this.

you are done with this phase when you can show a gap list with an owner and an order of work for each item.
03

build the privacy management system

Write the records, run the privacy risk work and put the procedures in place for everything inside the scope.

  1. write the records of processing

    As a controller, list each processing activity with its purpose, the categories of people and data, the recipients, any transfers outside the EU and, where possible, time limits and a general description of the security measures. As a processor, keep a record of the processing you do for each controller. Start from the system list IT already has.

    • owner legal or DPO
    • build and configure
    what it produces
    records of processing with a system and an owner per activity
    the proof it leaves
    the records, dated and reviewed by the owner

    the control: asset-inventory

    basis GDPR Art. 30(1); GDPR Art. 30(2)

  2. write the privacy policy and name the roles

    Write a short privacy policy that management signs, and list who decides and who carries what. Check whether you must designate a data protection officer, and write down the answer and the reason either way.

    • owner board
    • build and configure
    what it produces
    a signed privacy policy, a table of roles and a note on the data protection officer
    the proof it leaves
    the policy with its version and approval, the table and the note

    basis GDPR Art. 37(1)

  3. add privacy risk to the risk assessment

    Add the risk to people to your risk assessment, and score what a leak or loss would do to them. Where a type of processing is likely to result in a high risk to people, carry out an impact assessment before it starts. Record who accepted which risk.

    • owner head of IT
    • build and configure
    what it produces
    a risk register with a risk-to-people column, and an impact assessment where one is needed
    the proof it leaves
    the register, the assessments and the sign-off for accepted risks

    the work pagethe control: risk-register

    basis GDPR Art. 32(1); GDPR Art. 35(1)

  4. put processor terms in place

    List the suppliers that process personal data for you, check that each gives sufficient guarantees and sign a contract with the terms GDPR lists. Require each processor to get your authorisation before it engages another. If you are a processor yourself, expect your customers to ask for the same terms and know what you can commit to.

    • owner procurement
    • build and configure
    what it produces
    a processor register with the contract for each, and a standard set of terms you can offer as a processor
    the proof it leaves
    the register, the signed contracts and the authorisations for sub-processors

    the work pagethe control: supplier-management

    basis GDPR Art. 28(1); GDPR Art. 28(2); GDPR Art. 28(3)

  5. set up handling of requests from people

    Decide who receives a request, how you confirm who is asking, who finds the data in each system and who answers. The controller must answer within one month of receipt. Where necessary, given how complex or how many the requests are, that can be extended by two further months, and the person is told of the extension and the reasons within the first month. As a processor, agree how you help the controller.

    • owner legal or DPO
    • build and configure
    what it produces
    a request procedure with owners, a log and answer templates
    the proof it leaves
    the procedure and the log, with each request dated and closed

    basis GDPR Art. 12(2); GDPR Art. 12(3)

  6. write the breach path

    A processor tells the controller without undue delay. The controller tells the authority within 72 hours where feasible, unless the breach is unlikely to result in a risk, and tells the people affected where the risk is high. Write who decides, who files and who keeps the log of every breach, and test it once.

    • owner head of IT
    • build and configure
    what it produces
    a breach procedure with a decision table, templates and a log
    the proof it leaves
    the procedure, the log and the record of the test

    the work pagethe control: incident-management

    basis GDPR Art. 33(1); GDPR Art. 33(2); GDPR Art. 33(5); GDPR Art. 34(1)

  7. train the people inside the scope

    Train the people who handle personal data on the privacy policy, on recognising a request and on what to do when something goes wrong. Keep the record for each person.

    • owner HR
    • build and configure
    what it produces
    a short training for staff in scope, and the attendance record
    the proof it leaves
    the attendance record and the material, dated

    the work pagethe control: awareness-training

    basis working practice. No legal text sets this.

you are done with this phase when you can show the records of processing, the privacy risk assessment, the processor terms and the request and breach procedures running for the whole scope.
04

audit yourself and review with management

Check that the system runs as written, and put the results in front of management.

  1. audit the system from inside

    Have someone who did not build the system check, against your own rules and the standard, that each part of the scope runs as written. Take a sample of records, of processor contracts, of requests and of breach log entries. Plan the audit, keep notes and write a report with findings.

    • owner everyone
    • prove and operate
    what it produces
    an internal audit plan and report with findings
    the proof it leaves
    the report, dated, with the auditor named

    basis working practice. No legal text sets this.

  2. fix the findings and record the fix

    For each finding, decide the fix, an owner and a date, and record when it was done. Fix the cause as well as the symptom, so that it does not return next year.

    • owner head of IT
    • build and configure
    what it produces
    a corrective action list with owners and dates
    the proof it leaves
    the list, with each item closed or dated

    basis working practice. No legal text sets this.

  3. hold the management review

    Put the audit result, the privacy risk picture, requests, breaches and open gaps in front of management, and record what they decide. The standard asks for this review, so check its inputs against your copy.

    • owner board
    • prove and operate
    what it produces
    a management review record with decisions and actions
    the proof it leaves
    the record and the minutes

    the work page

    basis working practice. No legal text sets this.

you are done with this phase when you can show an internal audit report, a management review record and a list of corrective actions.
05

pass the external audit

Choose a certification body, go through its audit and deal with what it finds.

  1. choose a certification body and check its accreditation

    Evaluate several bodies. Ask each which accreditation it holds for this standard and its 2025 edition, from which accreditation body, and check the answer with that body. Ask what the audit covers and how it proceeds, and get the answers in writing. ISO notes that accreditation is not compulsory.

    • owner procurement
    • decide and document
    what it produces
    a chosen certification body and its accreditation scope
    the proof it leaves
    the written answers and the accreditation check

    basis working practice. No legal text sets this.

  2. prepare the evidence and the people

    Gather the policy, the records of processing, the risk assessment, the processor contracts, the request and breach logs, the audit report and the review record in one place, organised by what the standard asks. Brief the people who will be interviewed.

    • owner everyone
    • prove and operate
    what it produces
    an evidence folder and a list of interviewees
    the proof it leaves
    the folder, with each item dated

    basis working practice. No legal text sets this.

  3. go through the audit and answer the findings

    Give the auditor access, answer what is asked and note every finding. For each, agree the fix with the certification body and carry it out in the time it sets.

    • owner everyone
    • prove and operate
    what it produces
    the audit report, the finding responses and the fixes
    the proof it leaves
    the report, the responses and the closing records

    basis working practice. No legal text sets this.

  4. read the certificate and say what it covers

    Check the scope, the dates, the edition and the issuer printed on the certificate, and use them as written when you answer a customer. Say plainly what it covers and what it does not, and do not describe it as compliance with GDPR.

    • owner legal or DPO
    • decide and document
    what it produces
    a short statement of what the certificate covers, for sales and legal
    the proof it leaves
    the certificate and the statement

    basis working practice. No legal text sets this.

you are done with this phase when you can show a certification body's decision and the scope it states.
06

keep it alive each year

Run the system through the year, repeat the audit and review, and meet the certification body's follow-up.

  1. ask what follows the certificate

    Ask the certification body what it checks after the certificate is issued, how often and what happens if findings stay open. Put the dates in the same calendar as your own audit and review.

    • owner procurement
    • decide and document
    what it produces
    a calendar of the body's follow-up and your own internal dates
    the proof it leaves
    the written answer and the calendar

    basis working practice. No legal text sets this.

  2. repeat the internal audit and the review

    Run the internal audit and the management review again on a fixed rhythm, with fresh evidence. Update the records of processing and the processor register whenever you start a new activity or a new supplier, and re-run the privacy risk work when they change.

    • owner everyone
    • prove and operate
    what it produces
    a yearly internal audit and management review
    the proof it leaves
    the reports and the minutes, dated

    basis working practice. No legal text sets this.

  3. change the scope on purpose

    When the company adds a product, a site, an activity or a supplier, decide whether it joins the scope and tell the certification body. If a customer later asks for more, widen the scope by decision, with a plan.

    • owner board
    • decide and document
    what it produces
    a scope change decision with its reason
    the proof it leaves
    the decision and the notice to the body

    basis working practice. No legal text sets this.

you are done with this phase when you can show a second internal audit and management review, and the body's follow-up outcome.

who carries what

The same steps, grouped by the person who has to act.

board

legal or DPO

head of IT

procurement

HR

everyone

controls you will need

Each control has its own page: what it is, what to look for, where it goes wrong and the proof it leaves.

    check it yourself

    your next step

    Ask the customers who raised it whether they want a certificate or would accept your records of processing, your processor terms and a description of how you handle requests and breaches, and write the answers down before you scope anything.

    read the GDPR guide