ISO/IEC 27701

What ISO 27701 is

ISO/IEC 27701 defines a privacy information management system. It takes the structure of ISO 27001 and adds what is specific to processing personal data: requirements and controls that differ depending on whether you act as a controller or as a processor.

It answers a real problem. The GDPR is not certifiable, and many organisations need to show something a third party has verified. ISO 27701 does not attest GDPR compliance, but it does attest that you manage privacy through an audited system.

Who ISO 27701 applies to

No organisation by legal obligation. It is adopted where privacy is part of the commercial argument:

• Processors who need to demonstrate it to their controllers
• Organisations that already hold ISO 27001 and need privacy covered
• Sectors where personal data is the product or the principal risk

What ISO 27701 requires

The management system requirements, extended with what is specific to privacy, and additional controls split into two blocks: those that apply when you are a controller, and those that apply when you are a processor.

The standard includes mappings between its controls and the articles of the GDPR. That mapping is why it gets used: it turns a legal obligation into an auditable list.

How ISO 27701 is demonstrated

With certification issued by an independent accredited body.

With Zerod

The GDPR cannot be certified. ISO 27701 can, and it is the closest you will get to having a document to show.

Activate ISO 27701 and Zerod gives you its control register split by role, generates the privacy management system documentation, and organises evidence collection.