ISO 27701

A customer who hands you personal data may ask for an ISO 27701 certificate in a due diligence questionnaire or a contract. The ISO catalogue describes the standard as requirements for establishing, implementing, maintaining and continually improving a privacy information management system, with guidance for putting them into practice. It is designed for organisations that control the processing of personal data and for those that process it on their behalf.

A certificate shows that a certification body checked your privacy management system, within a scope you chose, against the standard. It is not a certificate of GDPR compliance. ISO’s own page lists helping to demonstrate compliance with privacy laws such as GDPR among its benefits. That is ISO’s description of the standard. The law is applied by supervisory authorities and courts, and nothing on ISO’s page says that a certificate settles the question for them.

Today the current edition is ISO/IEC 27701:2025, edition 2, published in October 2025. ISO lists the 2019 edition as withdrawn, and its page for the 2019 edition points to the 2025 one as the new version.

The two editions differ in how ISO frames them. The 2019 title called it an extension to ISO/IEC 27001 and ISO/IEC 27002. The 2025 title does not: it is called a standard on privacy information management systems, requirements and guidance. ISO’s page answers the question “can it be used alone?” with yes, and describes it as a management system standard in its own right. The same page also lists alignment with existing ISO/IEC 27001 systems among the benefits. So a company that already runs an ISO 27001 system has a head start, and one that does not can still use the standard.

Two things were not read: the clauses of either edition, and any rule on how long certificates against the 2019 edition stay valid or how a move to the 2025 edition works. If you hold or were offered a 2019 certificate, ask the certification body which edition it certifies against and what the transition is.

No for the law. No EU rule on this site requires the certificate. GDPR makes the controller responsible for compliance and asks it to be able to show it. It does not name a certificate as the way to do so.

Possibly for sales. Controllers who use you as a processor may ask. Before you commit a year to it, find out which of them would accept something less: your records of processing, your processor terms and a short description of how you handle requests and breaches.

It shows that a certification body, on a date, found a system that meets the standard in the scope stated on the certificate, with the issuer’s name on it. It does not show that each processing activity is lawful, that you answered a request or notified a breach in time, or that a supervisory authority agrees with you. A system outside the scope is not covered, so a certificate for one product says nothing about your staff records.

GDPR itself keeps the duties in its own text, and the work below leaves records you will want in either case: the records of processing, the processor contracts, the way you answer people’s requests and the breach path.

ISO says it does not certify and does not issue certificates. Certification is the provision of written assurance that a system meets specific requirements, and it is carried out by an external certification body, which ISO also calls third-party conformity assessment. A company cannot be certified by ISO.

ISO advises evaluating several certification bodies, checking whether the body uses the relevant standard for certification bodies, and checking whether it is accredited. Accreditation is the formal recognition that a certification body operates to international standards. ISO adds that accreditation is not compulsory and that a body without it is not necessarily disreputable. To check a certificate you were shown, ISO points to the global database of the accreditation community, or to the certification body or accreditation body directly.

This page did not read which bodies are accredited for the 2025 edition, or by whom. Ask each body for its accreditation scope and check it with the accreditation body.

None of this is a clause of the standard as read for this page. It is the order that holds up, and each item names the GDPR text behind it where one exists.

1. Scope and role. Decide which activities the system covers and, for each, whether you act as controller, joint controller or processor.
2. Records of processing. A controller keeps a record with the purposes, the categories of people and data, the recipients, transfers and, where possible, time limits and a general description of the security measures. A processor keeps its own record of the processing it does for each controller.
3. Roles. Name who answers at management level and who runs the work. Check whether you must designate a data protection officer.
4. Privacy risk. Add the risk to people to your risk assessment, and carry out an impact assessment before processing that is likely to result in a high risk to them.
5. Suppliers and processors. Use processors that give sufficient guarantees, under a contract with the terms GDPR lists, and require the processor to get your authorisation before it engages another one.
6. Requests from people. Make it easy to exercise their rights and answer within one month, with a stated way to extend and to refuse.
7. Breach path. A processor tells you without undue delay. You tell the authority within 72 hours where feasible, unless the breach is unlikely to result in a risk, and tell the people affected where the risk is high.
8. Internal audit and management review. Check that all of this runs as written and put the result in front of management once a year.

The full steps, with owners and evidence, are in the ISO 27701 plan on this area’s page. For the security measures that GDPR asks for, see the GDPR guide and the ISO 27001 guide.

The standard is paid. This page used public sources only: the ISO catalogue pages for both editions, ISO’s pages on conformity assessment and certification, and the text of GDPR on EUR-Lex. Clause numbers, annexes and control lists of ISO/IEC 27701 were not read, and none is cited. Check them against your licensed copy before you scope or answer a customer. Any national supervisory authority’s view of certification was not read either: ask your lawyer.