ISO 27701 for product managers: privacy management and your features

ISO/IEC 27701 specifies a privacy information management system. It helps an organization show how it manages personal data, whether as a controller deciding why data is processed or as a processor handling it for someone else. A product manager's decisions are whether buyers need it, which role applies, and which features create privacy duties.

What is it and which edition applies?

ISO/IEC 27701 began as an extension to ISO 27001 and 27002 for privacy. I could not retrieve ISO's own page for this post, and my understanding is that a newer edition now stands as an independent standard. Confirm the current edition, and what your auditor and customers expect, before you plan. The standards are sold by ISO and national bodies, so this post covers the concepts only.

Like ISO 27001, it certifies a management system, not a product. A certificate is issued by an accredited certification body after audit.

Controller or processor?

This distinction drives your obligations. A controller determines the purposes and means of processing. A processor processes personal data on a controller's behalf. A B2B SaaS company is often a processor for customer data and a controller for its own account data, marketing contacts and product analytics. You can be both in one product.

A constructed example: a recruiting platform stores candidate data for employers. For that data it is a processor. It also uses behavioral analytics on how recruiters use the platform. For that data, it may be a controller. Each role needs its own records, notices and contracts.

Which product decisions matter?

Think in features, not clauses.

• Data collection. What does each feature collect, why, and is each field necessary? A field no one can justify is a liability.
• Retention and deletion. How long is data kept and can a person's data be found and deleted across systems, including backups and analytics?
• Subprocessors. Which vendors touch the data? Customers will ask for a list and for notice of changes.
• Individual requests. Can customers support access, correction and deletion requests through your product or API?
• Cross-border transfers. Where is data stored and processed, and under what legal mechanism does it move?

Is it worth it?

It depends on buyers. If customers in privacy-sensitive sectors ask for it or if you want one framework to organize privacy work, it can be useful. If they only need a data processing agreement and a clear subprocessor list, you may not need a certificate yet. Ask three customers before you commit.

How do privacy decisions show up in the roadmap?

Add a privacy check to feature intake. For every new feature that touches personal data, record what is collected, why, how long it is kept and who receives it, before design starts. Features that fail to justify a field should lose the field. This habit costs minutes per feature and produces the records an auditor will ask for, with no separate documentation project.

Also schedule privacy work as first-class backlog items: deletion support for a new datastore, export for a new data type, notice updates when a new subprocessor is added. If these only happen when a customer complains, the management system exists on paper only, and an audit will notice the gap.

How to check or apply this

1. Ask target customers whether they require ISO 27701 or accept other evidence.
2. Decide your role per data set: controller, processor, or both.
3. Build a feature-level data inventory: fields, purpose, retention, recipients.
4. Maintain a subprocessor list with a change notice process.
5. Make access, correction and deletion workable for customers.
6. Confirm the current edition and scope with a certification body.
7. Have counsel review how the standard maps to the privacy laws that apply to you.

Safeguard's compliance automation can organize evidence and tasks, but privacy law decisions and certification belong to counsel and auditors.

Quick check

Sources

• ISO/IEC 27701, published by ISO and national standards bodies (paywalled; ISO's page could not be fetched here, so edition and clause details need checking).

Last reviewed: 18 October 2026.