In the first 90 days of ISO 27701, a startup should set the scope, map personal data, decide whether it acts as controller or processor, name owners, assess gaps against the controls and start the records. Certification is a separate step done by an accredited body, and its timing depends on you.
What changed in the 2025 edition?
DNV reports that ISO/IEC 27701 was republished on 14 October 2025 as a standalone standard for a privacy information management system, replacing the 2019 version. Earlier, it was an extension of ISO/IEC 27001. The new text draws on elements of 27701:2019, ISO/IEC 27001:2022 and ISO/IEC 27002:2022, and it has controls for both controllers and processors of personal data.
DNV also says the transition rules for existing certificates were still awaited from the International Accreditation Forum when it published its page, so check with your certification body for current timelines before you commit to a plan.
Who is this for?
It suits companies that handle personal data and need to show customers a structured privacy program, especially when buyers send privacy questionnaires. It is not a law. It will not make you compliant with GDPR or any other regulation by itself. It gives you a management system that supports compliance work.
How do the 90 days break down?
Days 1 to 30: scope and map. Decide which products, teams and locations are in scope. List the personal data you handle, where it comes from, where it is stored, which vendors touch it, and who can access it. For each flow, decide whether you act as a controller, a processor, or both. That answer drives which controls apply.
Days 31 to 60: owners and gap review. Name a privacy lead and an executive sponsor. Read the controls and mark each one as in place, partly in place or missing. Do not write new policies yet. Evidence you already have, such as a data processing agreement template or an access review, counts for a lot.
Days 61 to 90: fill and record. Close the cheapest gaps first. Write the policies that are missing. Start keeping records you will need later, such as requests from individuals, vendor reviews, incident logs and training attendance. Run one internal review and note what you found.
The date at the end is a checkpoint, not a finish line.
How does this fit with security work you already do?
Because the 2025 edition integrates elements of ISO/IEC 27001 and 27002, a team with an information security management system already has much of the structure. If you do not have one, plan more time, since access control, supplier management and incident response all need to exist.
Software inventories help. Knowing which libraries and services touch personal data makes the data map faster, and it is the same list you need for vendor reviews.
What to do
- Write the scope statement and get the founder to approve it.
- Build the personal data map, with owners for each system.
- Record whether you act as controller or processor for each flow.
- Name the privacy lead and sponsor.
- Do the gap review and rank gaps by effort.
- Fix the cheap gaps and begin record keeping.
- Ask a certification body about scope, the transition rules and how they audit, before you set a target date.
Quick check
Do we need ISO 27001 first?
Under the 2025 edition the standard stands on its own. You may still want an information security management system, since the controls overlap. Ask your certification body.
Does ISO 27701 make us GDPR compliant?
No. It supports a privacy program, but legal compliance is assessed against the law itself.
Sources
- DNV: Revision of ISO/IEC 27701, fetched 18 October 2026
Last reviewed: 18 October 2026.
