ISO 27701 extends an information security management system with privacy management. The document set to prepare is: PIMS scope, privacy policy, roles, a data inventory and records of processing, a risk and impact assessment method, procedures for data subject requests and breaches, processor agreements, retention rules and training records. Check the current edition with ISO.
What is ISO 27701 in one paragraph?
ISO 27701 is the privacy information management standard that builds on ISO 27001 and 27002. ISO's pages were blocked when we tried to fetch them on 18 October 2026, and the standard has been revised since its first edition, so the structure below comes from common implementation practice. Buy the current edition and check how it is arranged before you begin, including whether it sits on top of an existing 27001 certificate or stands alone.
The document list works whichever way, because privacy management needs the same few artefacts.
Which documents should exist?
Scope statement. Which processing activities, systems, locations and roles are in the privacy management system, and whether you act as a controller, a processor or both. Be specific about the products and data flows.
Privacy policy (internal). A short statement of leadership commitment, principles and responsibilities. Distinguish it from the public notice on your website.
Roles and responsibilities. Who owns privacy, who handles requests, who approves new processing, and whether a data protection officer is appointed under GDPR.
Inventory of personal data and records of processing. For each activity: purposes, categories of data and people, recipients, transfers, retention and security measures. GDPR Article 30 sets out what controllers and processors record, which makes this a document you probably need anyway.
Risk and impact assessment procedure. How you assess privacy risk and when you run a data protection impact assessment. GDPR Article 35 requires one where processing is likely to result in high risk, so your procedure should say how you decide that and who signs off.
Data subject request procedure. Intake, identity checks, search across systems, response templates, time limits and logging. Include a log, which becomes evidence.
Retention and deletion schedule. What you keep, for how long, why, and how deletion is carried out and verified.
Processor and sub processor management. A register of suppliers handling personal data, a standard data processing agreement, due diligence records and a process for approving new sub processors. GDPR Article 28 lists what a processor contract must contain.
Breach procedure. How events are triaged, who decides, the notification route to regulators and customers and a decision log. Article 33 sets a 72 hour target for notifying a supervisory authority where feasible.
Training and awareness. Content, attendance records and role specific modules.
Internal audit and management review records. Inherited from the management system approach: audit programme, findings, review minutes and corrective actions.
Statement of applicability or equivalent. A mapping of the standard's privacy controls to your decisions, with reasons for exclusions.
How long should the documents be?
As long as they need to be, and no more. A ten page policy that nobody reads loses to a two page procedure that people follow. Use plain headings, name owners and dates and add a review cycle.
What evidence will you need beyond documents?
Records of processing that match what engineers can see in systems, completed assessments, request logs with response dates, signed processor agreements, training attendance and minutes of reviews. Auditors test operation, so a document without records that someone followed it is half the story.
Where do teams go wrong?
- Copying a privacy policy template with processing activities you do not have.
- Records of processing built once, never updated.
- A request procedure with no log.
- Processor agreements signed for new vendors but not older ones.
- Confusing the public privacy notice with the internal policy.
- Writing as controller when contracts show you act as processor for some data.
What to do
- Decide your role per activity: controller, processor or both.
- Draft the scope statement and agree it with leadership.
- Build the data inventory from real systems and turn it into records of processing.
- Write the assessment, request, breach and retention procedures, each with an owner and a log.
- Build the supplier register and check each contract.
- Train staff and keep records.
- Review all documents yearly and when processing changes.
Quick check
Do I need ISO 27001 before ISO 27701?
Check the edition you intend to use. Earlier guidance describes 27701 as an extension to 27001, and a newer revision may change how the two relate. Confirm with ISO or your certification body.
Is a DPIA procedure part of the document set?
It is a sensible part, since GDPR Article 35 requires assessments for high risk processing and a procedure shows how you decide and who approves.
Sources
- ISO, ISO/IEC 27701: blocked when fetched on 18 October 2026, so edition details need checking.
- Art. 30 GDPR, records of processing
- Art. 35 GDPR, data protection impact assessment
- Art. 28 GDPR, processor
- Art. 33 GDPR, breach notification
How Safeguard helps automate this
Documents are the easy half; keeping the records behind them current is harder. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code rather than by screenshot, and monitoring runs between audits. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability, which helps show which suppliers and libraries touch your product. The remediation agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and with what approval. Safeguard helps you prepare and keep evidence ready; an independent certification body performs the audit. Book a call.
Last reviewed: 18 October 2026.
