When a questionnaire asks about ISO 27701, answer with one of three exact states: certified, with the certificate and scope; implemented but not certified, with what you did; or not pursuing it, with what you do instead. Do not blur them. ISO 27701 is a privacy management standard, not a general security badge.
This post explains what the 2025 edition is, what buyers are really asking and how to word answers truthfully. It is not legal advice, and it does not claim Safeguard holds this certification.
What is ISO 27701?
It is the ISO standard for a privacy information management system, or PIMS. The 2025 edition changed its relationship to ISO 27001. Per a certification body's summary of the release, it is no longer an add-on to ISO 27001. It is "a full, standalone standard" with its own title, and "an ISO 27001 certificate is no longer a prerequisite for certification." It follows the updated ISO 27000 family structure, which makes integration with other management systems easier.
We read that from a certification body's news item, not from ISO's own page, which blocked our fetch. Before you cite edition details, check the standard on ISO's site.
What is the buyer actually asking?
Behind the line "Do you hold ISO 27701?" there are usually three concerns:
- Do you have a managed process for handling personal data, not just ad hoc rules?
- Can you split your duties as a controller from your duties as a processor, and which are you for this service? The 2025 guidance covers the separation of responsibilities between PII controllers and processors.
- Can you show evidence, such as records, audits and incident handling for privacy events?
Answer those directly, even when the certificate answer is no.
How do you word each status?
Certified. Give the certification body, the certificate number, the scope statement, the edition and the expiry date. Attach the certificate. Confirm the scope covers the service the customer is buying.
Implemented, not certified. Say so in those words: "We operate a privacy management process aligned to ISO 27701. We are not certified." Then list what exists: data inventory, records of processing, retention rules, subject request procedure, processor agreements and breach procedure.
In progress. Give the stage and the target date as a plan, not a promise, for example "gap assessment complete, certification audit not yet scheduled." Update it when it changes.
Not pursuing. Say what you use instead, such as a GDPR compliance program, and offer a data protection addendum and your list of sub-processors.
What mistakes should you avoid?
- Writing "compliant with ISO 27701." The standard is something you can be certified against, or implement. Compliance language invites a follow-up request for a certificate.
- Using an ISO 27001 certificate as an answer. It is a different standard with a different scope.
- Quoting an old edition without noting it.
- Answering for the company when the certificate covers one entity or site.
- Treating privacy as the security team's job alone. Privacy answers need input from legal and product.
How does software supply chain work relate?
A PIMS cares about where personal data goes, which includes third party components and services in your stack. A current inventory of dependencies and sub-processors, and a way to learn about vulnerabilities in the software that touches personal data, support those answers. The inventory is evidence. It is not the certification.
What to do
- Decide your exact status today: certified, implemented, in progress or not pursuing.
- Write one approved sentence for that status, and reuse it everywhere.
- If certified, keep the certificate, scope statement and expiry date in a shared folder.
- List your data inventory, processing records and sub-processors, and keep them current.
- Map your controller and processor roles per service.
- Ask sales and legal to use the approved sentence and nothing stronger.
- Review quarterly, and update the sentence when anything changes.
Quick check
Do I need ISO 27001 before ISO 27701?
Not under the 2025 edition, per the summary we read. It describes ISO 27701 as standalone, with ISO 27001 no longer a prerequisite for certification.
Can I say I am compliant with ISO 27701?
Avoid it. Say certified, implemented but not certified, in progress or not pursuing, and give the evidence for the state you choose.
Sources
Last reviewed: 18 October 2026.
