An ISO 27701 auditor asks to see a working privacy information management system: your scope, your role as controller or processor, privacy risk records, the processing records and contracts behind your claims, and proof that you review and improve all of it. Expect samples, dates and named owners, not just policies.
Your certification body decides the exact list, so ask it for a document request before the audit. The checklist below is a planning aid based on how the 2025 edition is described by BSI, not a quote from the standard.
What changed that affects the evidence?
BSI describes BS EN ISO/IEC 27701:2025 as a stand-alone management system standard that no longer depends on ISO/IEC 27001 or 27002. Privacy risk assessment and treatment are embedded in the core management system clauses, and the controller, processor and subcontractor requirements sit in a consolidated annex structure. So an auditor will look at two things together: the management system and the privacy controls for your role.
If you hold an earlier certificate against the 2019 edition, ask how your certification body handles transition before assuming old evidence maps one to one. BSI notes that numbering and layout changed.
The evidence checklist
Scope and context
- A scope statement naming the services, locations and data flows covered.
- A statement of your role for each service: controller, processor or both, including where you act as a subcontractor.
- A list of laws and contracts that set privacy obligations for you.
- Freshness: reviewed at least annually, and when a service changes.
Leadership and roles
- A privacy policy approved by leadership.
- Named owners, with a description of who handles data subject requests, incidents and supplier reviews.
- Training records with dates and attendees.
Privacy risk
- A privacy risk method that explains how you rate likelihood and impact on people, not only on the company.
- A risk register with treatment decisions and owners.
- Records of risk review, with dates.
Processing records
- A record of processing activities: purposes, data categories, recipients and retention.
- Data flow diagrams that match what engineers say in interviews.
- A sample of how a retention rule is enforced, such as a deletion job log.
Supplier and subcontractor management
- A list of processors and subprocessors with services, data types and locations.
- Contracts or data processing terms for a sample of them.
- Evidence of due diligence: questionnaires, reports and review dates.
Operations and security
- Access control records for systems that hold personal data: who has access, when it was last reviewed.
- Vulnerability and patch records for those systems.
- Logging and monitoring evidence, and an incident procedure with a test record.
- Records of handled data subject requests, with timestamps.
Checking and improvement
- An internal audit report, performed by someone independent of the area audited.
- Minutes from a management review, with decisions.
- A corrective action log showing cause, fix and closure.
Where does software evidence fit?
The engineering evidence sits mainly in the operations group. A software bill of materials per service shows what components exist. Scan results with dates show what was found and when it was fixed. An exception log shows who accepted which risk. Auditors tend to sample, so a clean, dated trail for a few items beats a large unstructured dump.
Safeguard's documentation lists ISO/IEC 27701 in its framework library and says each framework page states which requirements a scan can decide and which need your evidence. Treat that as help in collecting facts. Safeguard does not certify anyone for ISO 27701, and only a certification body can.
What trips teams up?
- Records that exist but are undated.
- A processing record that does not match how the system actually behaves.
- A processor list that stops at the first tier.
- An internal audit done by the person who built the system.
- Management review minutes that record attendance and nothing else.
What to do
- Ask your certification body for its document request list and the sampling approach.
- Build an evidence index: item, owner, source system, last updated, location.
- Mark anything older than twelve months, and refresh it.
- Reconcile the processing record with engineering reality in a joint session with product and engineering.
- Schedule the internal audit with someone independent, and book the management review.
- Run a mock request: have someone outside the project ask for ten items and time how long each takes.
Quick check
Will policies alone satisfy the auditor?
No. Policies show intent. Auditors look for records that show the policy operating, with dates and owners.
Do I need separate evidence for controller and processor roles?
Where you hold both roles, you should be ready to show the duties that belong to each. Confirm with your certification body how it will scope the audit.
Sources
- BSI, Reimagining data privacy compliance with BS EN ISO/IEC 27701:2025
- Safeguard docs: All frameworks
Last reviewed: 18 October 2026.
