ISO/IEC 27701 specifies requirements for a privacy information management system, a structured way to manage how personal data is collected, used and protected. It was designed to extend an ISO 27001 information security system. A founder should consider it when enterprise buyers ask for privacy assurance beyond security.
What does ISO 27701 cover?
The standard sets out requirements and guidance for managing personal data, with roles for organisations acting as controllers (who decide why and how data is processed) and processors (who process on behalf of someone else). Topics include purposes and lawful basis, transparency, data subject requests, retention, sharing with third parties and records of processing. It maps to privacy laws such as the GDPR conceptually, but a certificate is not a legal finding of compliance.
ISO has revised the standard recently. The scope, structure and relationship with ISO 27001 changed between editions, so read the current text and ask your certification body how it applies before you plan. This page could not be fetched automatically when we reviewed sources, so treat the edition details as something to confirm.
Who asks for it?
Typically enterprise procurement teams in Europe and regulated sectors, and data processors that handle a lot of customer personal data on behalf of others. If your buyers only ask for a SOC 2 report or a GDPR data processing agreement, an ISO 27701 certificate may add little.
How is it different from a GDPR programme?
GDPR is a law with duties and penalties. ISO 27701 is a voluntary management system standard. Doing the work for one helps the other: a record of processing, a retention schedule, a process for access and deletion requests and a vendor register serve both. But satisfying the standard does not prove you comply with the law, and you can comply with the law without the certificate.
What does it cost a small team?
The cost is mostly attention. You need a defined scope, named roles, a risk approach for privacy, documented procedures that people actually follow, internal audit and management review, and an external audit. If you do not already run an ISO 27001 system, check the current requirements: you may need to build the security management base first.
A constructed example: a ten person analytics startup processes event data for retail customers as a processor. Four of its top prospects send a privacy questionnaire with 80 questions. Building a records-of-processing document, a deletion procedure and a sub-processor list answers most of them without certification. If a fifth asks for ISO 27701 by name, then the system is worth planning.
What should a founder decide?
- Are you mostly a controller, a processor or both? It changes which controls apply.
- Do you already have or plan ISO 27001?
- Which buyers have asked for this specific standard, and by when?
- Who owns privacy internally?
What to do
- Write a one page map of personal data you process, why, and where it goes.
- Decide whether you are a controller, a processor or both for each flow.
- Build the basics: sub-processor list, retention schedule, request handling procedure.
- Check whether ISO 27001 must come first under the current edition.
- Ask a certification body for the scope and effort in writing.
- Hold off on certification until a buyer asks for it by name.
Quick check
Does ISO 27701 make us GDPR compliant?
No. It is a voluntary standard. It supports a GDPR programme, but a certificate is not a legal finding.
Do we need ISO 27001 first?
Historically it was designed as an extension to ISO 27001, and later editions changed that relationship. Check the current edition with your certification body.
Sources
Last reviewed: 18 October 2026.
