Implementation walkthrough
How to implement ISO/IEC 27701: video walkthrough
A walkthrough of implementing an ISO/IEC 27701 privacy information management system, from the role the certificate must state to the independent audit.
Key takeaways
- Decide first whether the certificate covers you as a PII controller, a PII processor or both.
- Data mapping, the record of what you hold and why, comes before the controls.
- Annex A controls are grouped for controllers, for processors and for both roles.
- The 2025 edition is a standalone management system standard.
- An independent, accredited certification body audits the PIMS and decides.
Turning privacy promises into an operated system
ISO/IEC 27701 is the international standard for a privacy information management system, or PIMS: a governed, auditable way of managing personally identifiable information from the decision to collect it to its deletion. It is written for the two roles data protection law recognises, the PII controller that decides why and how personal data is processed and the PII processor that handles it for a controller, and for the many organisations that are both.
Most organisations already have a privacy notice and a policy. What they usually lack is a system that records what personal data they hold and why, answers requests within a deadline, controls sub-processors and transfers, and proves it. This short film walks through how that system is built and prepared for certification.
The ISO/IEC 27701 implementation path
Start with the scope and the role the certificate must state: the processing activities, services, sites and systems covered, and whether you are certified as a controller, a processor or both, matched to the contract or regulator behind the project. A gap analysis then reviews existing notices, policies, contracts, registers and records against clauses 4 to 10 and the Annex A controls for your role, keeps what works and sets a plan with owners and dates.
The build begins with mapping the personal data you hold and the purposes behind it, then puts the controls for your role into operation, from request handling to sub-processor control and transfers, with records accumulating as the system runs. Internal audit and management review test what has been built before an independent certification body, accredited for PIMS certification, audits the system and decides.
ISO/IEC 27701:2025, published on 14 October 2025, is a standalone management system standard, so it can be implemented on its own or integrated with ISO/IEC 27001. Sterling's expert and experienced consultants build the PIMS with your privacy, legal, technology and operations teams under Sterling OS™, guided or fully managed, with the evidence held in Effivity.
ISO/IEC 27701 at a glance
- Purpose
- Privacy information management: governing how personally identifiable information (PII) is collected, used, shared, retained and deleted, as a controller, a processor or both
- Relevant to
- Any organisation that processes personal data: software and SaaS, BPO, healthcare, financial services, HR and payroll, e-commerce, and every processor serving clients
- Edition
- ISO/IEC 27701:2025, published 14 October 2025, a standalone management system standard; 2019 certificates transition on the timetable your certification body confirms, expected to close on 31 October 2028
- Certification
- Assessed and decided by an independent certification body accredited under ISO/IEC 17021-1 and ISO/IEC 27706
- Sterling's role
- Consulting with your team, Effivity, training, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for an ISO/IEC 27701 PIMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 8 months
ISO/IEC 27701: questions people ask
Do we need ISO/IEC 27001 before we can be certified to ISO/IEC 27701?
Not any more. The 2019 edition could only be certified as an extension of an ISO/IEC 27001 certificate. ISO/IEC 27701:2025 is an independent management system standard and can be certified on its own. It still contains information security controls, so a standalone PIMS has to operate them; where an ISO/IEC 27001 system exists, integrate the two.
Are we a PII controller or a PII processor?
Usually both. You are a controller for the personal data of your own employees, customers and contacts, and a processor for the data you handle on a client's instructions. The role is determined activity by activity; the certificate scope states the roles covered, which decides which controls apply.
Does ISO/IEC 27701 certification mean we comply with the GDPR or our national data protection law?
No. The certificate confirms that an accredited body found your PIMS conforming to the standard. Laws such as the EU GDPR, the Philippine Data Privacy Act, India's Digital Personal Data Protection Act and the UAE Personal Data Protection Law have their own requirements, which your legal advisers interpret; the PIMS gives you organised, audited evidence of how you meet them.
What changed between ISO/IEC 27701:2019 and 2025, and when must we transition?
The 2025 edition is a standalone management system standard with its own clauses 4 to 10 and a consolidated Annex A of controller, processor and information security controls, with guidance in Annex B. Accreditation bodies have published a three-year transition ending on 31 October 2028; 2019 certificates remain valid until then if maintained. Certification bodies are completing their own accreditation transitions first, so agree your audit date early.
Does Sterling issue the ISO/IEC 27701 certificate?
No. Sterling builds, trains and prepares. An independent certification body accredited for PIMS certification under ISO/IEC 17021-1 and ISO/IEC 27706 audits the PIMS in two stages and decides. A provider that offers the consulting and the certificate on one invoice is selling paper.
Keep exploring
Related to this video
Read next
The complete guide
Everything on ISO/IEC 27701
Start with the ISO/IEC 27701 page, or go straight to the guide you need.
On the ISO/IEC 27701 page
- What are the main ISO/IEC 27701 requirements?
- How do you get ISO/IEC 27701 certified?
- How much does ISO/IEC 27701 certification cost?
- How long does ISO/IEC 27701 certification take?
- Who needs ISO/IEC 27701 certification?
- How ISO/IEC 27701 turns privacy obligations into a working system
- Frequently asked questions about ISO/IEC 27701
Guides
- ISO 27701:2025 transition
- ISO 27701 Annex A controls explained
- The ISO 27701 certification process, step by step, from scope and role to certificate
- ISO 27701 PII controller or processor
- ISO 27701 certification cost
- ISO 27701 and GDPR
- Effivity ISO 27701 guide
- ISO 27701 internal audit
- ISO 27701 requirements explained
- ISO 27701 vs ISO 27001
Often combined with ISO/IEC 27701
More videos: Privacy and data protection
- How to comply with GDPRCompliance walkthrough · 3 min 24 s
- GDPR requirements explainedTwo-minute brief · 2 min
- How to comply with the Philippine Data Privacy ActCompliance walkthrough · 3 min 15 s
- Philippine Data Privacy Act requirements explainedTwo-minute brief · 2 min
- How to comply with India's DPDP Act 2023Compliance walkthrough · 3 min 15 s
- India's DPDP Act 2023 requirements explainedTwo-minute brief · 2 min
- How to comply with Singapore's PDPACompliance walkthrough · 3 min 15 s
- Singapore PDPA requirements explainedTwo-minute brief · 2 min
- How to comply with Saudi Arabia's PDPLCompliance walkthrough · 3 min 15 s
Talk to a consultant
Plan your ISO/IEC 27701 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice