You can stand up the core of an ISO 27701 privacy information management system (PIMS) in 12 weeks if you start from a data map, decide whether you act as a controller or processor, and run it in three gated phases. Certification timing is still set by the audit body, and the standard is paywalled, so verify clause details.
What are you building?
ISO/IEC 27701 specifies a privacy information management system. Its October 2025 revision is described in public references as stand-alone, aligned with the 2022 editions of ISO/IEC 27001 and 27002, with management system clauses 4 to 10 and separate annexes of controls for PII controllers and PII processors. The text itself is paywalled and I could not fetch it, so use this calendar as a project skeleton, not a clause by clause reference.
Assumptions: a company of tens of people, a security program already in place or being built alongside, and a privacy lead with real time. If you have no security management system at all, add several weeks or run the security work first.
Phase 1, weeks 1 to 4: know your data and your role
Week 1: scope and sponsor. Get leadership sign off. Decide which products and entities are in scope. Decide, per processing activity, whether you are a controller, a processor or both. That decision selects which control set applies, so make it explicitly and write down the reasoning.
Week 2: data map. Interview each team. For every system list the personal data categories, purposes, data subjects, recipients, locations and retention. This is also the base of a GDPR Article 30 record if that law applies.
Week 3: legal and contract map. List the privacy laws and customer contracts that bind you. Pull the processor agreements you have signed and the ones you rely on.
Week 4: privacy risk and policy. Define the method for assessing risk to individuals. Run it on the top processing activities. Draft the privacy policy for the system, objectives and roles.
Gate 1: scope approved, role decided, data map complete for in scope systems, policy approved.
Phase 2, weeks 5 to 8: controls that touch people's data
Week 5: rights handling. Build a request intake, identity check, search process across systems, response template and log with due dates. Test it by running a mock access request end to end.
Week 6: notices and lawful basis. Align privacy notices and consent flows with the data map. Record the basis or instruction for each purpose.
Week 7: processors and transfers. Inventory sub-processors, review their terms, record transfer mechanisms. If you are a processor, set up a way to follow and log controller instructions.
Week 8: retention, deletion, breach and impact assessments. Set retention rules and prove deletion with a real job log. Add privacy incidents to your incident process with a notification decision step. Create an impact assessment template and run it on the riskiest activity.
Gate 2: every applicable control has an owner, a procedure and at least one dated record.
Phase 3, weeks 9 to 12: prove it works
Week 9: training and awareness. Role based training for support, engineering and sales. Keep attendance.
Week 10: applicability statement and evidence index. For each privacy control state applicable or not, why, and where the evidence lives.
Week 11: internal audit. An independent person tests clauses 4 to 10 and a sample of controls: five rights requests, three deletions, two supplier reviews, one incident exercise. Log findings and corrective actions.
Week 12: management review and booking. Review audit results, risks, objectives, complaints and incidents. Record decisions. Contact the certification body to schedule Stage 1 and Stage 2.
Gate 3: internal audit complete, management review minuted, corrective actions owned, audit dates set.
Where do projects slip?
- Role confusion. Processors who behave like controllers for some data, and the reverse, produce inconsistent controls.
- Data map by questionnaire alone. Staff forget systems, so verify against finance and the identity provider.
- A rights process nobody tested.
- Deletion promised in policy but backups and logs forgotten.
- Training in week 9 covering a process that changes in week 10. Fix the process first.
What to do
- Appoint the privacy lead and a leadership sponsor this week.
- Decide controller or processor role per activity and record it.
- Finish the data map before touching policy text.
- Run the three gates honestly. If a gate fails, extend that phase rather than skipping ahead.
- Keep dated evidence from week 5 so the later audit has records, not claims.
- Ask your certification body early which edition they audit and what they sample.
Quick check
Is ISO 27701 the same as GDPR compliance?
No. ISO 27701 is a management system standard that can support legal compliance, but certification does not by itself prove you meet any law. Keep your legal analysis separate.
Do you decide controller or processor before choosing controls?
Yes. The standard has separate guidance and control sets for each role, so the role decision shapes the work. Many companies are controllers for their own staff and marketing data and processors for customer data.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between audits, which frees the team for other work. For the technical part of a privacy program, evidence comes from your real code and dependencies: scans, SBOMs and reachability. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard helps prepare and keep evidence ready. The certification body, not Safeguard, certifies. Book a call.
Sources
- ISO/IEC 27701 overview, Wikipedia. The iso.org pages and the standard text were blocked or paywalled when fetched, so claims are kept general.
- GDPR Article 30, records of processing
Last reviewed: 18 October 2026.
