ISO 27701 Certification: The Standalone Audit Path
ISO 27701 certification is now available on its own. The 2025 edition turned the standard from an add-on to ISO 27001 into a full management system standard that an accredited certification body can audit directly. This post covers who should pursue it, how the audit runs, what drives cost and timeline, and what to do if you hold a 2019 certificate.
If you want the standard itself rather than the audit, start with the ISO 27701 guide.
What Changed, and Why Some Pages Are Wrong
ISO/IEC 27701 is the international standard for a privacy information management system, or PIMS. It sets out how an organization manages personal data across its whole lifecycle: why it collects it, how long it keeps it, who receives it, and how it responds when a person makes a request.
The 2019 edition was an extension. It only worked if you also implemented ISO 27001 and ISO 27002, so it could not be certified alone. ISO published ISO/IEC 27701:2025 in October 2025, and the product page lists it as a standalone management system standard. The 2019 edition shows as withdrawn.
That matters because many certification body pages still describe 27701 as "an extension of ISO 27001." Those pages are describing the old edition. Check the edition date on anything you read, including quotes and proposals.
For the full side-by-side on how the two standards differ, see ISO 27701 vs ISO 27001. The short version: ISO 27001 protects information, and ISO 27701 protects the people the information is about.
Who Should Pursue ISO 27701 Certification
Certification is a sales and assurance tool, so start with who is asking. The strongest fits are organizations that handle personal data for other people.
SaaS processors. If you process customer data on behalf of European or privacy-conscious customers, those customers carry accountability duties for you as their processor. A certificate makes their vendor review faster.
Controllers with sensitive data. Health, financial, biometric, and children's data raise the stakes on every privacy question. An audited system is worth more when the data is more sensitive.
Teams buried in questionnaires. If you answer the same privacy questionnaire every quarter, certification turns a recurring cost into a one-time project plus an annual check.
Companies that need GDPR evidence. GDPR expects you to demonstrate compliance, not just claim it. A PIMS produces records that do that job, which we cover below.
Weaker fits: pre-revenue companies, and companies whose buyers only ever ask for SOC 2. Build the processing inventory early, because it gets harder later, but skip the audit until a customer asks.
Do You Need ISO 27001 First?
Under the 2025 edition, no. You can scope a PIMS on its own and certify it without holding ISO 27001. That is the biggest practical change for companies that were told they had to do security first.
Whether you should is a different question. Buyers who ask for a privacy certificate often ask for a security one in the same breath. A PIMS with no security system underneath it invites the follow-up question of where the security half is.
Here is a practical way to decide:
- You already hold ISO 27001. Extend it. The PIMS can build on your existing scope, risk method, internal audit, and management review.
- A named customer wants ISO 27701 only. Certify it standalone and add security later.
- You are starting from nothing and buyers want both. Plan the two as one program, even if you audit them in sequence.
If you plan to run both, the ISO 27001 service page covers the security side of that path.
How to Get ISO 27701 Certification: The Process
The path has the same shape as other ISO management system certifications. The order matters, and skipping a step usually costs time later.
1. Define scope and roles
Decide which services, entities, and locations sit inside the PIMS. Then decide, for each processing activity, whether you act as a controller, a processor, or both. Most SaaS companies are processors for customer data and controllers for their own marketing and HR data at the same time.
This choice drives which controls apply, so make it carefully. A scope that excludes the product your buyer uses will not answer their question.
2. Gap assessment
Compare what the standard requires with what you actually do. Security teams usually find the management system pieces already exist. The privacy-specific pieces are what is missing.
Typical gaps:
- A complete processing inventory with purposes and retention periods
- Documented controller and processor role decisions
- Working procedures for access, deletion, and correction requests
- Records of sub-processors and the safeguards on transfers
3. Implement the PIMS
Build the missing pieces, then run them. A certification body cannot audit a system that has never operated. It needs records, such as rights requests handled, retention jobs executed, and sub-processors assessed before onboarding.
A policy approved the week before the audit and never used is a finding, not evidence. Plan for a real operating period before Stage 2, and ask your certification body what they expect.
4. Internal audit and management review
Both are requirements of the standard. Run a full internal audit, log what it found, and hold a documented management review where leadership looks at the results and makes decisions. Auditors ask for both, and skipping them is the surest way to stall at Stage 1.
5. Stage 1 audit
An accredited certification body reviews your documentation and checks readiness. Confirm the body is accredited for ISO/IEC 27701:2025 specifically, because accreditation for other standards does not automatically cover it.
Stage 1 often surfaces gaps. That is its purpose, and finding them here costs less than finding them at Stage 2.
6. Stage 2 audit
Auditors test whether the system works in practice. They interview staff, pick a processing activity, and trace it from inventory to purpose to retention to rights handling. Minor nonconformities need a corrective action plan. Major ones must be fixed and verified before a certificate is issued.
7. Certificate and surveillance
The certificate runs on a three-year cycle. Surveillance audits take place in between, typically once a year, and a recertification audit closes the cycle. Certification is an ongoing commitment, and the surveillance audits are where a neglected system gets exposed.
What Auditors Look At Most
Knowing where auditors concentrate saves months of preparing the wrong evidence.
Role consistency. If you claim to be a processor, but your contracts let you use customer data for your own analytics, you are acting as a controller. A mismatch between declared and actual role is a common major finding.
Inventory completeness. An auditor will name a system that is not on your list and ask why. Marketing tools and spreadsheets are the usual sources.
Rights requests as operated. A written procedure is not enough. They want evidence of real requests handled in the stated window.
Retention enforced. A retention schedule with no deletion evidence behind it is a finding. Show the job, the log, or the ticket.
Notice that none of these is new security tooling. Teams that already hold ISO 27001 rarely fail on technical controls. They fail on purpose documentation and rights handling.
Transition for ISO 27701:2019 Certificates
If you hold a certificate to the 2019 edition, you will need to move to the 2025 edition. Here is what the published material supports, and where it disagrees.
- The 2019 edition is withdrawn. ISO's own page for it points to the 2025 edition as its replacement.
- Certification bodies move first. The companion standard for bodies that certify PIMS, ISO/IEC 27706:2025, was also revised. Bodies must meet it before they can certify clients to the new edition.
- There is a transition window. Several published schedules describe a three-year period ending around October 2028. The exact end date varies by source.
- Some schedules are tighter. At least one certification body, working under its national accreditation policy, sets an earlier cut-off at the end of 2027.
Because the sources disagree, we will not give you a date to plan around. Confirm your deadline with your certification body, since it follows their accreditation body's rules and your own certificate cycle. Then work backward from your next surveillance or recertification audit.
Plan early. Every certified organization moves in the same window, and accredited auditor capacity is finite. A transition audit is also the right moment to check your PIMS against the new standalone structure instead of the old extension model.
What Drives ISO 27701 Certification Cost
We do not quote prices here, because any number given without seeing your scope would be fiction. What we can do is explain what moves it, so you can compare quotes fairly.
Scope size. The number of processing activities, systems, entities, and sites. This dominates everything else.
Existing ISO 27001 system. If you hold one, the audit can reuse much of your scope, evidence, and cycle. Certifying standalone removes that reuse, so quote it as its own certification.
Privacy record maturity. Companies with a current processing inventory and working rights-request process start much further along.
Gap remediation. Usually the largest item, and it is internal effort or consulting rather than a certification body fee.
Audit cycle. Budget the full three-year cycle. Surveillance audits recur every year.
When you request quotes, give every certification body the same scope statement. Otherwise you are comparing numbers that describe different projects.
How Long Does It Take?
It depends on where you start, and the biggest variable is the operating period before Stage 2 rather than the audit itself. A team with an ISO 27001 system, a small scope, and good records moves much faster than one building its first management system.
Three things set the pace:
- Discovery. Finding every place personal data lives, including tools teams adopted on their own. Start the inventory on day one.
- Evidence. The system has to run long enough to generate records the auditor can sample.
- Audit scheduling. Accredited bodies book out. Ask for dates early, and consider aligning with an existing ISO 27001 surveillance visit.
Ask your certification body how much operating history they expect before Stage 2, rather than guessing.
ISO 27701 and GDPR: Evidence, Not a Passport
ISO 27701 certification does not make you GDPR compliant. GDPR compliance is a legal state decided by regulators and courts, and a management system certificate cannot grant it.
What certification does give you is evidence. Article 5(2) of GDPR requires controllers to be able to demonstrate compliance. A PIMS produces the records that demonstrate it: processing inventories, rights-request logs, vendor assessments, and breach procedures.
It also gives your customers a third-party audited artifact. A prospect can verify a certificate quickly. They cannot verify your self-assessment at all.
Certification will not choose your lawful basis, decide whether you need a data protection impact assessment for a given product, or settle transfer questions between jurisdictions. Those need legal judgment. For the practical side, see the GDPR and HIPAA compliance post and the GDPR service page.
Individual Certification Is a Different Thing
Searches for ISO 27701 certification also surface training courses, exams, and "lead auditor" credentials. Those are personal qualifications awarded to a person, not to a company.
A course will not certify your business, and certifying your business will not credential your staff. ShieldKey does not run training courses, so go to a training provider if that is what you want. Everything in this post is about the organizational audit.
Choosing a Certification Body
A few practical checks:
- Accreditation scope. Ask for proof that the body is accredited for ISO/IEC 27701:2025 and is working to the revised certification body standard.
- Independence. A body that audits you cannot also consult on the same management system.
- Sector familiarity. Auditors who understand SaaS data flows ask better questions.
- Combined audits. If you also hold or want ISO 27001, a body that can audit both together saves audit days.
ShieldKey does implementation and readiness work, not certification. We cannot issue your certificate.
For the standard itself, see the ISO 27701 guide and the ISO 27701 service page. To weigh it against the security standard, read ISO 27701 vs ISO 27001 and the ISO 27001 service page. The GDPR service page covers the legal side that a certificate supports but never replaces.
Frequently Asked Questions
How do you get ISO 27701 certification? Set scope and controller or processor roles, run a gap assessment against ISO/IEC 27701:2025, close the gaps, and operate the system long enough to generate records. Complete an internal audit and management review. Then pass the Stage 1 and Stage 2 audits with an accredited certification body, and maintain the certificate through surveillance audits on a three-year cycle.
Do you need ISO 27001 before ISO 27701 certification? No. The 2025 edition is a standalone management system standard that can be certified on its own. The 2019 edition was an extension, which is why older pages say otherwise. Many buyers still want both, so most SaaS companies plan the two together.
How much does ISO 27701 certification cost? There is no list price. Cost follows scope, whether you already hold ISO 27001, the maturity of your privacy records, and how much gap remediation you need. Budget the certification body's fees across the three-year cycle and the readiness effort separately. The readiness effort is usually larger.
Does ISO 27701 certification make you GDPR compliant? No. It gives you audited evidence that you run the processes GDPR expects, which supports your accountability duty under Article 5(2). It does not decide your lawful basis, transfer mechanisms, or impact assessments.
Is ISO 27701 certification for individuals or for companies? Both exist and they are different. Organizational certification audits a company's PIMS. Individual certification is a training credential like Lead Auditor. For a customer's procurement question, you need the organizational kind.
Planning an ISO 27701 Certification?
ShieldKey Solutions runs ISO 27701 readiness work against the 2025 edition: scoping, controller and processor role decisions, the processing inventory, rights-request workflows, and getting you audit-ready before a certification body arrives. We do not issue certificates, which is why we can tell you honestly what your scope should be.