To scope an ISO 27701 privacy information management system, decide whether you act as a controller, a processor or both, list the personal data processing activities inside the boundary, align the boundary with your ISO 27001 scope, and record exclusions with reasons. Roles and data flows drive everything else.
What is the scope question here?
ISO/IEC 27701 extends the security management system of ISO 27001 with privacy requirements and guidance. The standard has been revised since its first edition, and later editions may stand alone, so confirm which edition your certification body audits against. The ISO page returned a 403 on our fetch, so this guide stays general.
For security, scope asks which systems you protect. For privacy it asks a different question: which personal data do you process, in what role, and under which obligations. Two companies with identical infrastructure can have different scopes because one is a processor for customer data and the other is a controller of consumer data.
What goes into the scope decision?
- Your role per activity. Controller for your staff and marketing data, processor for customer content you host. Many software companies are both. Write the role per processing activity.
- Processing activities. A list drawn from product, HR, finance, support, marketing and security tooling. Each one gets a purpose, data categories, data subjects, recipients, retention and any transfer outside the country or region.
- Systems and locations. The systems that hold or move the personal data, which usually overlap with your ISO 27001 scope but not always. Marketing tools and HR systems are often outside the security scope yet full of personal data.
- Legal context. The privacy laws and contract terms that apply, such as customer data processing agreements. List them, because controls trace to them.
- Third parties. Processors, sub-processors and joint controllers, with the contract that governs each.
- Exclusions. Any processing outside scope, with the reason and how it is kept separate.
How does it relate to the ISO 27001 scope?
A privacy scope that reaches past the security scope will leave activities protected by controls nobody audits. The tidy approach is to define the privacy scope first as a list of processing activities, then check that every system touching them sits within the ISMS boundary, and extend the ISMS if it does not.
What does a defensible scope look like?
It is short, written, approved by top management and testable. An auditor should be able to pick a processing activity, find it in the register, find the system, find the role and find the controls. If any link breaks, the scope has a hole.
What mistakes are common?
- Declaring only one role when you play both.
- Leaving out HR, recruiting and marketing data because they are not the product.
- Treating anonymised data as out of scope without testing whether it can be re-identified.
- Missing sub-processors that process data on your behalf.
- A scope sentence that does not mention the places where data is stored.
How do you test the scope before you commit?
Trace three real cases end to end: one customer data flow where you act as processor, one employee data flow where you act as controller, and one marketing flow with a third party tool. For each, name the register entry, the system, the owner, the contract and the control. Any step you cannot name is a gap in the scope or the records, and cheaper to find now than at audit.
What to do
- Interview product, HR, support and marketing for what personal data they process.
- Build the processing activity list with role, purpose, data and recipients.
- Map each activity to systems and check they are inside the ISMS.
- List laws, contracts and third parties that apply to each activity.
- Draft the scope statement and exclusions, then have top management approve it.
- Review scope whenever you launch a feature, enter a market or add a vendor.
Quick check
Do I need ISO 27001 before ISO 27701?
ISO 27701 was designed to extend ISO 27001, so a common route is to have both. Confirm with your certification body how the edition you use treats this.
Can one company be both controller and processor?
Yes. Record the role for each processing activity separately.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires. Once scope is decided, evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between audits. For the technical half of the map, which services and dependencies sit around personal data, Safeguard uses scans, SBOMs and reachability on your real code. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Certification is a separate audit by a certification body. Safeguard helps you prepare and keep evidence ready. Book a call to see it.
Sources
- ISO/IEC 27701 page on iso.org, not retrievable on 18 October 2026, so claims are kept general
Last reviewed: 18 October 2026.
