ISO/IEC 27701
Privacy information management: extends the ISMS with controls for PII controllers and processors; the 2019 edition builds on ISO 27001, and a revised edition was published in 2025, so confirm the version your certification body audits against.
Readiness items we start from
- Records of processing
- Lawful basis and consent records
- Data subject request handling
- Processor and sub-processor contracts
- Privacy impact assessments
- Retention and deletion schedules
- Breach notification process
- Privacy training records
The framework's own criteria or clauses govern; this list is where most companies have gaps.
Timeline and cost, honestly
Readiness two to four months for a company with basic controls in place. Certification involves a stage 1 and a stage 2 audit, then surveillance audits in a three-year cycle. Auditor and certification-body fees vary by scope and are paid to them; ask for quotes from more than one. Our readiness fee covers preparation, the readiness review and the auditor introduction.
Start with ISO/IEC 27701
Tell us the buyer who is asking and what you already have.