ISO does not publish statistics on common ISO 27701 audit findings, so we will not invent any. What we can do is list the areas a privacy management system audit must probe, based on how the standard is built, so you can test them first. Roles, records, requests, retention and processors lead.
What changed in the standard?
The 2019 edition of ISO/IEC 27701 was an extension to ISO/IEC 27001 and 27002 for privacy information management, applying to organizations acting as controllers or processors of personally identifiable information. That edition is now withdrawn. The 2025 edition is an independent management system standard, and ISO presents it as usable without ISO 27001, while still allowing integration (ISO).
We did not find transition timelines or a control-by-control mapping between editions in our search, so ask your certification body which edition applies to your audit.
Where should you look for gaps?
These are test areas, not claims about how often they fail.
Role clarity. Are you a controller, a processor or both, for each processing activity? Auditors ask, and a vague answer leads to the wrong controls being applied. The 2019 edition had separate control sets for controllers and processors, and the 2025 edition covers both.
Records of processing. Is there a current register that matches what teams do? Compare it with two real systems.
Data subject requests. Is there a defined process, a log and evidence of response times?
Retention and deletion. A schedule on paper does not show deletion runs. Look for proof, such as a deletion job log.
Processor and sub-processor management. Do you have contracts, a list and a review? New tools adopted by one team are the typical gap.
Privacy by design. Is there a step in your change process that asks about personal data before release?
Incident handling. Does your incident process include privacy breaches and who decides on notification?
Management review. Does leadership review privacy performance at planned intervals, with minutes?
Scope statement. Does the scope match the systems where personal data lives?
What do auditors look for in evidence?
A management system audit asks four questions: is there a documented rule, is it followed, is there a record, and does the organization review and improve it. Weakness in any one shows up as a finding. Gaps in the record link are common in management systems generally, but we have no ISO 27701 data to say so specifically.
How should you prepare the team?
Privacy controls live with people outside security: product, support, marketing and HR. Brief each group on the three or four questions an auditor is likely to ask them, and let them show their own records. Answers that come from the people doing the work are more convincing than answers from a compliance lead.
What to do
- Confirm which edition your certification body will audit against.
- Run an internal audit of the nine areas above before the external one.
- Sample two systems and compare them with the processing register.
- Test one data subject request end to end and note the elapsed time.
- Verify retention by finding a deletion log, not a policy.
- List every processor, including tools added in the last year.
- Hold and minute a management review.
Quick check
Do I need ISO 27001 to certify against ISO 27701?
Under the 2019 edition, yes in practice, as it was an extension. ISO presents the 2025 edition as standalone. Confirm with your certification body.
Is ISO 27701 a legal safe harbor for GDPR?
No. It supports GDPR work, but certification does not prove legal compliance.
Sources
Last reviewed: 18 October 2026.
