ISO 27701: what does a first security hire need to know?

ISO/IEC 27701 is a standard for a privacy information management system: how an organization governs personal data, not only how it secures it. If you are the first security hire, treat it as an option to evaluate, not a task to inherit by default.

What does ISO 27701 cover?

Where ISO 27001 manages information security risk in general, 27701 adds privacy: controls for organizations that decide why and how personal data is processed (controllers) and those that process it for others (processors). Think consent handling, retention, data subject requests, and records of processing.

One caution. The standard was first published as an add on to 27001, and a later revision was reported to make it standalone. ISO's pages blocked our fetch, so confirm the current edition and its prerequisites with a certification body before planning.

How does it differ from a privacy law?

A law such as the GDPR is binding and enforced by regulators. The European Data Protection Board's guide for small businesses lists the basics: be clear on purposes, have a legal basis, keep data accurate, secure and delete it when no longer necessary. ISO 27701 is a voluntary management system that can help you organize that work, but a certificate is not a legal safe harbor.

Article 5 of the GDPR sets the principles, including storage limitation: keep data in identifiable form no longer than necessary. A 27701 program would give you a documented way to apply that, with owners and evidence.

What should a first hire ask on day one?

Start with questions, not frameworks.

• Where does personal data live? If nobody can name the systems, no standard will help yet.
• Who answers a deletion request today, and how long does it take?
• Which vendors process personal data on our behalf, and do we have agreements?
• Has a customer or contract asked for 27701 by name?
• Do we already hold a certified information security management system we can build on?

A constructed example: a ten person analytics startup with EU customers gets a questionnaire asking for a "privacy certification." The founder assumes 27701. You find that the buyer mainly wants a data processing agreement, a subprocessor list and a deletion process. You deliver those in two weeks. Certification can wait.

What does the work involve?

Plan for a data inventory, a record of processing, role clarity (controller or processor), privacy risk assessment, supplier controls, and an incident process that includes personal data breach handling. You will also need internal audit and management review, which are the parts small teams underestimate.

How to decide and start

1. Build a one page data map first.
2. Write down which laws apply by customer geography.
3. Check whether any contract names 27701.
4. Confirm the current edition of the standard and whether it needs a 27001 certificate.
5. Fix the basics (deletion, vendor list, breach process) before paying for an audit.
6. Re-evaluate after the first enterprise deal that asks.

Safeguard offers compliance automation that can help track controls and evidence for frameworks you choose. It does not certify you, and the audit comes from an accredited body.

What mistakes do new hires make?

The usual one is starting with a standard instead of a data map. Another is treating privacy as security's job alone; product, legal, support and marketing all create and use personal data. A third is promising a certification date before an auditor has confirmed scope. Finally, many first hires skip the dull wins: a current vendor list, a retention schedule and a tested deletion process. Those are what customers and regulators ask about most. Put a quarterly check on the calendar so the records do not go stale, and keep a short log of why each kind of data is collected, since that log is what you reach for when questions arrive.

Quick check

Sources

• EDPB SME guide, data protection basics
• GDPR Article 5, principles
• ISO/IEC 27701 text is sold by ISO and was not fetched; verify edition details there.

Last reviewed: 18 October 2026.