ISO 27701 first timer mistakes: seven PIMS gaps to avoid

The usual first time ISO 27701 mistakes are building to the withdrawn 2019 edition, never deciding whether you act as a PII controller or processor, mapping data too thinly, mismatching PIMS and ISMS scope, skipping internal audit, and treating the certificate as proof of privacy law compliance. Each is cheap to fix early.

Mistake 1: working from the old edition

ISO's catalogue lists ISO/IEC 27701:2025 as edition 2 and shows the 2019 edition as withdrawn. The 2019 text was an extension to ISO/IEC 27001 and 27002. A public summary of the 2025 edition describes it as a standalone standard that can be implemented and certified without a separate 27001 certificate, aligned to the 2022 versions of 27001 and 27002. The standard is paid and ISO's own page blocks automated reading, so confirm the structure with your certification body and buy the current edition before you write anything. Old blog posts and templates may follow the 2019 layout.

Mistake 2: not deciding your role

The standard speaks to organisations acting as PII controllers, PII processors, or both. A SaaS company is often a processor for customer data and a controller for its own employee and marketing data. Controls differ by role, so write the role down per processing activity. Skipping this makes your control list either too long or quietly incomplete.

Mistake 3: a data map that stops at databases

A privacy management system needs to know what personal data you process, why, where it goes and who else touches it. First timers list production databases and forget logs, analytics tools, support systems, backups, test data and AI tools staff paste text into. Build the map from systems, interviews and vendor lists together, and give each entry an owner.

Mistake 4: PIMS scope that does not match the ISMS

Your security management scope and your privacy management scope should line up, and the gaps should be deliberate. A common slip is certifying the product but leaving out the HR or support systems that hold the same kind of personal data. Write the scope statement once, with locations, systems, roles and exclusions, and get top management to approve it.

Mistake 5: assuming a certificate equals legal compliance

ISO 27701 is a management system standard. It helps you organise privacy work and show evidence to customers and auditors. It does not replace obligations under GDPR or any other law, and a certification body does not rule on whether you meet them. Keep a legal register of the laws that apply and link each to the controls you rely on.

Mistake 6: no tested process for individual requests

Written procedures for access, correction and deletion requests are not enough. Run a dry request end to end, including systems that hold copies, and record the time it took. Under GDPR a controller must act on a request within one month of receipt, extendable in some cases, so a process you have never run is a risk.

Mistake 7: skipping the management system rhythm

Certification bodies look for internal audit, management review, corrective actions and continual improvement. Teams that build controls but never hold a management review find out in the audit. Put the first internal audit and review on the calendar when you set the scope.

What to do

1. Buy the current edition and confirm the structure with a certification body.
2. Record your role (controller, processor, both) per activity.
3. Build the data map from systems, people and suppliers.
4. Write one scope statement and have management sign it.
5. Create a legal register and link laws to controls.
6. Run a trial individual rights request and a trial breach drill.
7. Hold an internal audit and a management review before the external audit.

Quick check

How Safeguard helps automate this

Privacy work breaks down when evidence is stale. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between audits. For the data map, your code and dependency inventory shows which libraries and services touch your product, and technical evidence from scans, SBOMs and reachability supports the security side of your controls. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Certification stays with your independent certification body. Book a call for a walkthrough.

Sources

• ISO, ISO/IEC 27701:2025 catalogue entry (fetched via an archived copy because iso.org blocks direct access)
• ISO, ISO/IEC 27701:2019 catalogue entry
• Wikipedia, ISO/IEC 27701 (secondary summary of the 2025 edition)
• EUR-Lex, GDPR Article 12

Last reviewed: 18 October 2026.