ISO 27701 is worth doing when two things are true at once: you handle a meaningful volume of personal data on behalf of other organisations, and those organisations have started asking you privacy questions that your ISO 27001 certificate does not answer. If only one of those is true, it is usually early.
The most important structural fact first. ISO 27701 is not a standalone privacy certificate you can pick up instead of ISO 27001. It defines a privacy information management system, or PIMS, that sits on top of an information security management system. In practice you are certified against 27701 alongside a 27001 ISMS, either at the same time or as an extension to a certificate you already hold. The standard has been revised since its original publication, and the precise transition and scoping arrangements are the kind of thing to confirm with your certification body rather than take from a blog post. What has not changed is the dependency: the privacy management system is built on the security management system, not next to it.
What the standard actually adds
ISO 27001 asks you to manage risk to information. ISO 27701 asks you to manage risk to personally identifiable information specifically, and to do it while being explicit about the role you play.
That role distinction is the substance of the standard. It separates requirements and guidance for organisations acting as a PII controller — you decide why and how personal data is processed — from those acting as a PII processor, where you process it on someone else’s instructions. Most SaaS companies are processors for customer data and controllers for their own employee and marketing data, so most end up in scope for both sets.
On top of that, the standard extends the familiar security controls with privacy-specific ones: identifying and documenting the lawful basis and purpose for processing, handling data subject rights requests, limiting collection and retention, managing the records you keep of processing activities, controlling onward transfers and subprocessors, and being able to demonstrate all of it. If you have run a serious privacy programme already, none of this will be unfamiliar. What 27701 does is force it into an auditable management system with owners, evidence and a review cycle.
The standard also ships mapping annexes that line its requirements up against other privacy frameworks and regulations. Those mappings are genuinely useful as a planning tool. They are not, however, a compliance verdict, which brings us to the most common misunderstanding.
What it does not prove
An ISO 27701 certificate is not a GDPR certificate. It is not a finding by any data protection authority that your processing is lawful. Formal certification mechanisms under European data protection law follow their own approval route through supervisory authorities, and a 27701 certificate is not that.
What it demonstrates is that an accredited certification body examined your privacy management system against a recognised standard and found it conforming. That is a real and useful thing. It says you have a defined process for handling personal data, that someone independent has checked it, and that you are subject to surveillance audits. It does not say that every processing activity you run has a valid lawful basis, or that your privacy notices are adequate, or that a particular international transfer is permissible. Those remain legal questions for your counsel.
Be careful how your sales team phrases this. “Certified to ISO 27701” is accurate. “GDPR certified” is not, and privacy-literate buyers notice.
Signals that it is worth the money
Certification tends to pay for itself when you see these patterns:
- Enterprise buyers in Europe, the UK or other privacy-regulated markets are sending you data protection questionnaires and DPIA support requests that take days of engineering and legal time each. A certificate does not eliminate those, but it shortens them substantially.
- Personal data is the product, or close to it. HR platforms, health and wellbeing apps, marketing and identity providers, background screening, anything handling special category data.
- You are already certified to ISO 27001 and your ISMS is mature enough that the incremental audit is an extension rather than a fresh build.
- Your competitors in RFPs hold it. Unfair, but procurement scoring sheets are real.
- You act as a processor for many controllers and are repeatedly asked to prove subprocessor management and data subject request handling.
Signals that it is early
Hold off if you do not yet have a certified ISO 27001 ISMS, or if yours was certified last quarter and has not been through a full internal audit and management review cycle. Layering a second management system onto an ISMS that is still bedding in tends to produce documentation nobody maintains.
Hold off if your privacy questions are coming from one prospect rather than a pattern. A well-written data processing addendum, a clear subprocessor list and a documented data subject request process will answer most single-buyer concerns without an audit.
And hold off if your buyers are predominantly North American and are asking for SOC 2. In that market the privacy signal is more often carried by the Privacy or Confidentiality trust services criteria inside a SOC 2 examination than by an ISO certificate.
How it compares with SOC 2 privacy coverage
These are different instruments and buyers treat them differently.
| ISO 27701 | SOC 2 with Privacy criteria | |
|---|---|---|
| Output | Certificate from an accredited certification body | Attestation report with an opinion from a CPA firm |
| What the reader sees | Certificate and scope statement | Full report including controls, tests performed and results |
| Prerequisite | An ISO 27001 ISMS | A SOC 2 examination, Security criteria always included |
| Cycle | Three-year cycle with surveillance audits | Annual report covering a stated period |
| Strongest with | European, UK and international buyers | US buyers, especially enterprise procurement |
Neither one supersedes the other, and plenty of companies selling on both sides of the Atlantic end up holding both. If you already run ISO 27001 and SOC 2 together, adding 27701 is a smaller step than adding the Privacy criteria to a SOC 2 for the first time, because the ISMS scaffolding is already there.
The work you should budget for
Assume the following on top of your existing ISMS, though the depth varies considerably with how much personal data you handle:
- A data inventory and processing register that is accurate rather than aspirational. This is where most of the effort goes and where most programmes stall.
- Role determination — controller, processor or both — documented per processing activity, because the applicable requirements differ.
- Privacy risk assessment integrated with, not bolted onto, your existing risk process.
- Data subject request handling with defined timelines, owners and evidence that requests were actually worked.
- Retention and deletion that runs in production, not just in a policy. Auditors ask to see records actually disappear.
- Subprocessor management including contractual flow-down and periodic review.
Practice varies between certification bodies on scope definition and on how privacy scope relates to ISMS scope, so agree that early rather than discovering it at stage one.
What to do next
Before you commission anything, do a one-page test. Write down the last five privacy questions a customer asked you, and next to each one write whether an ISO 27701 certificate would have answered it outright, shortened the conversation, or made no difference. If most land in the first two columns, start scoping. If most land in the third, spend the money on your data inventory instead — you will need it either way, and it is the foundation of every privacy answer you will ever give.
Assurion works on ISO 27001 and 27701 programmes alongside SOC examinations, and we are happy to tell you which one your buyers are actually asking for.