To implement ISO 27701 yourself, set scope and your controller or processor roles, map personal data, assess privacy risk, select and run controls, keep records, test your rights and breach processes, run an internal audit and management review, then ask a certification body to assess you. Start from the current 2025 edition.
What are you building?
A privacy information management system, or PIMS. It is a repeatable way to decide what personal data you handle, what could go wrong, which controls you use, and how you prove they work. ISO says the standard is for PII controllers and processors who hold responsibility for processing personal data. ISO lists ISO/IEC 27701:2025 as edition 2 and shows the 2019 edition as withdrawn. The text is paid, so budget for it and check the structure with your certification body. This guide stays at the level any edition shares.
The ten steps
1. Get a sponsor. Top management must approve scope, policy and resources. Owner: a director or the CEO.
2. Name the lead. One person owns the PIMS day to day. This may be a privacy lead or a DPO if you have one.
3. Decide scope and roles. List products, locations, teams and systems in scope. For each processing activity, note whether you act as controller, processor, or both.
4. Build the data map. Record categories of personal data, purposes, sources, recipients, storage locations, retention and transfers. Include logs, analytics, support tools and backups.
5. List legal and contract duties. Collect the privacy laws and customer contract terms that apply. This register ties each duty to a control.
6. Assess privacy risk. Rate risks to people, not just to the company: unauthorised access, excessive collection, inability to honour a request. Record the treatment for each.
7. Select and implement controls. Pull from the standard's control set for your roles. For processors this means instructions from the customer, subprocessor terms, return or deletion of data and breach support. For controllers it adds notices, lawful basis, consent where relevant and individual rights.
8. Write only the documents you need. Scope statement, policy, risk method, control selection record, retention schedule, subprocessor list, rights and breach procedures.
9. Test. Run a dry individual request across all systems. Run a breach drill. Check that new vendors go through the same review as existing ones.
10. Audit and review. Hold an internal audit, fix findings, then hold a management review that records decisions. Only then book the external assessment.
What evidence will the assessor want?
Dated records that show the system runs: approved scope and policy, the data map with an update history, risk assessments, the control selection record, training records, supplier due diligence, request logs with response times, breach drill notes, internal audit report, management review minutes. For technical controls such as access and vulnerability handling, they will want system exports, not descriptions.
How long will it take?
No fetched source gives a reliable duration, and it depends on your size, existing ISO 27001 maturity and how many systems hold personal data. Plan against your own calendar and ask a certification body for their view.
What to do
- Buy the current edition and confirm structure with a certification body.
- Approve scope, roles and a named lead.
- Build the data map and legal register.
- Run the risk assessment and select controls.
- Write the minimum document set.
- Test the rights and breach processes.
- Run internal audit and management review.
- Book the external assessment.
Quick check
Who needs ISO 27701?
ISO says it is for organisations that act as PII controllers or processors. Customers in procurement often ask processors for evidence of privacy controls, which is a common trigger.
Do I need a DPO?
ISO 27701 asks for clear privacy responsibility, not a specific title. Whether GDPR requires a DPO for you depends on Article 37 and your activities, so check that separately.
How Safeguard helps automate this
The technical half of a PIMS is evidence that security controls over personal data keep working. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between audits. That frees the team for the parts only people can do, such as risk judgement and the rights process. Technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability. Safeguard's agent can open tested fix pull requests for vulnerable dependencies; it is off by default, every category starts on Manual, and you choose which categories run automatically. The assessment is done by a third party.
Try the framework mapping demo full screen.
Sources
- ISO, ISO/IEC 27701:2025 catalogue entry (read via an archived copy because iso.org blocks direct access)
- ISO, ISO/IEC 27701:2019 catalogue entry
- EUR-Lex, GDPR text, Article 37
Last reviewed: 18 October 2026.
