ISO 27701 Certification for Privacy Information Management Systems
ISO/IEC 27701 certification from a UAF-accredited certification body in Dallas–Fort Worth, Texas, for organizations that process personal data as a controller or processor. One senior auditor, one fixed-fee proposal, and clear guidance on the new 2025 edition. Most certification audits take 6–12 weeks.
Page reviewed 29 September 2026 by the Accredify Global certification team.
What Is ISO 27701 Certification?
ISO 27701 certification is independent confirmation that your privacy information management system (PIMS) meets ISO/IEC 27701. It shows customers, partners, and regulators that you manage personally identifiable information (PII) with defined roles, assessed risks, and controls that work in practice.
The standard covers PII controllers, which decide why and how personal data is processed. It also covers PII processors, which process it on a customer's behalf. Many SaaS and service companies are both. Our audit follows real personal data through your systems, from collection and consent to access requests, retention, and deletion.
We certify US organizations from our Dallas–Fort Worth, Texas headquarters and audit clients across 71 countries. You can certify ISO 27701 on its own under the 2025 edition, or together with ISO 27001.
ISO/IEC 27701:2025 Is Standalone: What Changed, and What It Means for Your Certificate
ISO published ISO/IEC 27701:2025 on 14 October 2025. The biggest change is that it is now a standalone management system standard. Under the 2019 edition, ISO 27701 could only be certified as an extension of an ISO 27001 information security management system. Under the 2025 edition, you can certify your privacy management system on its own.
The 2025 edition follows the same structure as other ISO management system standards, so it integrates with ISO 27001, ISO 9001, and ISO 42001. A transition period is expected to run to around October 2028, with the exact rules set by accreditation bodies. ISO 27701:2019 certificates stay valid until then. We confirm which edition applies to your audit at scope review and plan any transition into your existing cycle.
Sources: DNV: revision of ISO/IEC 27701 · A-LIGN: ISO 27701 updates
When Do Organizations Need ISO 27701 Certification?
Most ISO 27701 projects start when a customer, regulator, or privacy team asks for independent proof that personal data is governed, not just secured.
Enterprise customers want evidence that you process their users' personal data only as instructed.
A certified PIMS gives structured evidence for GDPR compliance, though it is not a GDPR certification.
Customers' DPAs require processor controls, sub-processor oversight, and breach notification you can prove.
Clear records of where personal data goes, and the safeguards used for each transfer.
Sensitive personal data under HIPAA, financial privacy rules, and customer contracts.
Privacy accountability for global clients, and for India's Digital Personal Data Protection Act.
ISO 27701 for PII Controllers vs PII Processors
ISO 27701 has separate control sets for each role. Your scope can include one or both.
| Area | PII controller | PII processor |
|---|---|---|
| Who you are | You decide why and how personal data is processed | You process personal data on a customer's behalf |
| Lawful basis & consent | Identify the legal basis, and record and manage consent | Process only on the customer's documented instructions |
| Individuals' rights | Answer access, correction, and deletion requests | Help the customer answer those requests |
| Third parties | Manage processors and transfers | Disclose and control sub-processors |
| Retention & deletion | Set retention periods and delete when due | Return or delete data at contract end |
How to Get ISO 27701 Certified
Six stages from first call to certificate, with the same senior auditor at every audit stage.
Not sure whether you are a controller, a processor, or both, or which edition to certify to? A free scope review tells you before the auditor does.
Book a free audit scope reviewWhat Makes an ISO 27701 Audit at Accredify Global Different
The questions buyers ask most when comparing ISO 27701 certification bodies, answered upfront.
The auditor who scopes your certification leads Stage 1, Stage 2, and surveillance. Findings cite the evidence and the clause or control behind them.
We follow personal data from collection to deletion and sample real access requests, consent records, and sub-processor reviews.
If you hold or want ISO 27001, both standards run as one audit program with shared evidence and fewer audit days.
We tell you whether to certify to 2019 or 2025, and plan any transition into your existing surveillance cycle.
ISO 27701 Certification Requirements: What the Audit Evaluates
Auditors check the privacy management system and the controller or processor controls in your scope.
Scope & roles
A defined PIMS scope, and your role as controller, processor, or both, for each processing activity.
Privacy risk assessment
Risks to individuals assessed and treated, with privacy impact assessments where needed.
Records of processing
What personal data you hold, why, where it is stored, and who it is shared with.
Individuals' rights
Access, correction, deletion, and objection requests answered on time, with records.
Third parties & transfers
Processor and sub-processor contracts, oversight, and cross-border transfer safeguards.
Breach handling & improvement
Privacy incident response, notification, internal audit, and management review.
Documents the auditor will ask for
- PIMS scope and privacy policy
- Roles, including a named privacy lead
- Privacy risk assessment and treatment plan
- Statement of Applicability for controller and processor controls
- Records of processing activities
- Privacy notices and consent records
- Data processing agreements and sub-processor list
- Rights-request, breach, and retention procedures
- Internal audit and management review results
What changed in the 2025 edition
- Standalone — ISO 27001 is no longer a prerequisite
- Common structure — aligned with other ISO management system standards
- Security controls included — the information security controls a PIMS needs are now in the standard
- Controller and processor controls — updated and kept as separate sets
ISO 27701 Certification Cost and Timeline
ISO 27701 certification doesn't have a list price. The fee follows the number of audit man-days your scope needs, which depends mostly on headcount, sites, and processing complexity. A free scope review gives you one fixed-fee proposal for your real scope.
What sets your audit man-days (and fee)
- Employees within the PIMS scope
- Number of sites, and where personal data is processed
- Your role: controller, processor, or both
- Volume and sensitivity of personal data, and the number of processing activities
- Whether ISO 27001 is certified in the same audit program
Typical certification audit timeline
| Mature documented controls | 6–8 weeks |
|---|---|
| Moderate management maturity | 8–10 weeks |
| Multi-site or complex scope | 10–12 weeks |
These timelines cover the certification audit once your PIMS is documented and in use.
ISO 27701 vs ISO 27001, GDPR, SOC 2, and ISO 27018
How ISO 27701 relates to the frameworks it's most often compared with.
| Framework | What it covers | How it relates to ISO 27701 |
|---|---|---|
| ISO 27001 | Information security management | Protects all information; ISO 27701 governs personal data. Often certified together. |
| GDPR | EU data protection law | ISO 27701 supports GDPR accountability but is not a GDPR certification. |
| SOC 2 | CPA attestation, with an optional privacy criterion | Popular with US buyers; ISO 27701 gives an international certificate. |
| ISO 27018 | Code of practice for PII in public clouds | Guidance for cloud providers that complements an ISO 27701 PIMS. |
| HIPAA | US health privacy and security law | ISO 27701 controls help evidence HIPAA privacy practices. |
How to Choose an ISO 27701 Certification Body
The questions worth asking any ISO 27701 certification body before you sign, and how Accredify Global answers them.
| Question to ask | Accredify Global's answer |
|---|---|
| Are you accredited, and can I verify it? | We're UAF-accredited under the IAF MLA framework. Check our scope in the UAF directory, and any certificate we issue on IAF CertSearch. |
| Do we need ISO 27001 first? | Not under the 2025 edition. Under 2019, yes. We confirm the right edition at scope review. |
| Who actually leads the audit? | One dedicated senior auditor, from the scope call to the certificate and on through surveillance. |
| How is the audit priced? | One fixed fee, set by the audit man-days your scope requires. No hidden costs are added after you agree it. |
| Can you audit ISO 27001 at the same time? | Yes, as one integrated audit program with shared evidence. |
| How long will certification take? | Usually 6–12 weeks for the audit itself, once your PIMS is in use. |
What You Receive
Covering your defined PIMS scope and role, valid for three years with annual surveillance.
Each finding linked to the evidence and the clause or control behind it.
Customers can check your certificate on our certificate verification page.
Certificate and scope wording ready for privacy questionnaires and DPAs.
When and how your certificate moves to ISO/IEC 27701:2025.
Add ISO 27001 or ISO 42001 to the same audit program whenever you're ready.
Frequently Asked Questions About ISO 27701 Certification
Straight answers on the 2025 edition, ISO 27001, GDPR, cost, and timeline.
What is ISO 27701 certification?
ISO 27701 certification is independent confirmation that an organization's privacy information management system (PIMS) meets ISO/IEC 27701. It shows customers, partners, and regulators that personal data is managed with defined roles, assessed risks, and working controls. It is verified through Stage 1 and Stage 2 audits.
What is the latest version of ISO 27701?
ISO/IEC 27701:2025, published on 14 October 2025, is the latest edition. It replaces ISO/IEC 27701:2019 and makes ISO 27701 a standalone management system standard.
Do I need ISO 27001 before ISO 27701?
Not under the 2025 edition, which can be certified on its own. Under the 2019 edition, ISO 27701 is an extension of ISO 27001 and needs an ISO 27001 information security management system. Accredify Global confirms the right edition for your audit at scope review.
What happens to ISO 27701:2019 certificates?
They stay valid during a transition period expected to run to around October 2028, with the exact rules set by accreditation bodies. Certified organizations move to the 2025 edition through a transition audit, which Accredify Global plans into your existing cycle.
How do I get ISO 27701 certified?
Define your PIMS scope and your role as controller, processor, or both. Implement the privacy controls, run the system long enough to complete an internal audit and management review, then have a certification body audit it. With Accredify Global the path is a free scope review, application, Stage 1, Stage 2, certification decision, and annual surveillance.
What is the difference between a PII controller and a PII processor?
A PII controller decides why and how personal data is processed. A PII processor processes personal data on a customer's behalf, following the customer's documented instructions. ISO 27701 has separate control sets for each role, and many organizations are both.
What are the ISO 27701 certification requirements?
ISO 27701 requires a defined PIMS scope and roles, a privacy risk assessment, and a Statement of Applicability for controller and processor controls. It also requires records of processing, privacy notices and consent, handling of individuals' rights, processor and transfer controls, breach handling, internal audit, and management review.
Does ISO 27701 certification mean GDPR compliance?
No. ISO 27701 supports GDPR accountability with structured, audited evidence, but it is not a GDPR certification and does not guarantee compliance with any law.
How much does ISO 27701 certification cost?
ISO 27701 certification cost depends on the audit man-days your scope requires. The main drivers are headcount, sites, and your role as controller or processor. The volume and sensitivity of personal data, and whether ISO 27001 is audited at the same time, also matter. Accredify Global reviews your scope for free and issues one fixed-fee proposal.
How long does ISO 27701 certification take?
The certification audit typically takes 6 to 12 weeks. That is 6–8 weeks for mature documented controls, 8–10 weeks for moderate maturity, and 10–12 weeks for multi-site or complex scopes.
How long is an ISO 27701 certificate valid for?
Three years. Annual surveillance audits confirm the PIMS is still maintained, and a recertification audit is required before the certificate expires.
Can ISO 27001 and ISO 27701 be audited together?
Yes. Accredify Global audits them as one integrated program with shared evidence. That reduces repeated audit time for shared processes such as risk assessment, internal audit, and management review.
What is the difference between ISO 27701 and ISO 27001?
ISO 27001 manages the security of all information. ISO 27701 manages the privacy of personal data, including lawful processing, individuals' rights, and processor obligations. Many organizations certify both.
What is the difference between ISO 27701 and ISO 27018?
ISO 27018 is a code of practice for protecting personal data in public cloud services and is not certified as a management system on its own. ISO 27701 is a certifiable privacy management system standard. Cloud providers often use both.
Can ISO 27701 help with India's DPDP Act?
Yes. ISO 27701 gives a structured way to show privacy accountability, which supports compliance programs for India's Digital Personal Data Protection Act. It does not replace legal advice on the Act.
How do I choose an ISO 27701 certification body?
Check that the certification body is accredited under the IAF MLA framework and that its certificates appear on IAF CertSearch. Then ask which edition it certifies to, who leads the audit, and how the fee is set. Also ask whether ISO 27001 can be audited at the same time.
Get One Fixed-Fee Proposal for Your Actual Privacy Scope
Tell us about your role, systems, and the customer or regulator asking about privacy. We'll recommend an edition and timeline, and return a fixed-fee proposal.
Book your free audit scope review →