The ISO 27701 certification process, step by step, from scope and role to certificate

How ISO 27701 certification works, and who does what

Four parties take part, each with a fixed role. Your organisation designs and runs the privacy information management system (PIMS) and answers for it. A consultancy helps you build and prepare it but cannot audit or certify it. The certification body audits the PIMS and decides whether to grant the certificate. An accreditation body assesses the certification body, and that accreditation is what lets a client, regulator or procurement team rely on your certificate.

Two sets of rules govern the certification body. ISO/IEC 17021-1 applies to every accredited management system certification: a two-stage initial audit, annual surveillance and a three-year cycle. ISO/IEC 27706:2025, published alongside the new edition of ISO/IEC 27701 and replacing ISO/IEC TS 27006-2, adds the requirements specific to bodies that certify a PIMS. The process below has nine steps: five on your side, four on the certification body's.

Steps 1 to 5: preparing the PIMS for audit

Step 1: fix the scope and the role on the certificate

The certificate states what was audited, so the scope should follow the reason for certifying. A processor answering a client's due diligence usually needs the client-facing service and the teams and systems behind it; a controller facing a regulator may need its whole customer or employee data lifecycle. Decide whether you certify as a PII controller, a PII processor or both, because that decides which parts of Annex A apply. The PII controller or PII processor guide covers this in depth.

Step 2: run the gap analysis

Sterling's gap analysis sets your notices, policies, data processing agreements, registers and records against clauses 4 to 10 of the 2025 edition and the Annex A controls for your role, keeps what works and turns the rest into a dated plan. It is not the free readiness check, a short self-assessment, and not the certification body's Stage 1, which comes months later.

Step 3: map the data and put the controls to work

This is the heaviest step. You inventory the personal data you hold and the processing behind it, assess privacy risks to the organisation and to the individuals concerned, choose the controls that treat them and record why any are excluded. Then the processes must run: access and deletion requests, impact assessments, sub-processor approval, transfer safeguards, retention, breach response and security. With an ISO/IEC 27001 system in place, its risk method, document control and audit programme carry over and the new work is the privacy layer.

Step 4: operate long enough to have evidence

An auditor judges a PIMS by its records, not its policies. Requests answered, impact assessments completed, deletions logged and training delivered all need to exist before Stage 2 is booked. A system switched on the week before the audit produces findings about missing evidence, not a certificate.

Step 5: complete internal audit and management review

Clause 9 requires an internal audit programme and a management review, and the certification body expects a completed cycle of each before the certification audit. The internal audit should cover the clauses and every Annex A control you apply, carried out by people who do not audit their own work; our ISO/IEC 27701 internal audit guide explains how. Management review then weighs the results, incidents, request performance and objectives, and records decisions.

Step 6: select and apply to a certification body

Confirm three things before you sign. Accreditation: the body should be accredited for PIMS certification by an accreditation body recognised through Global ACI, which replaced the IAF MLA and ILAC MRA in January 2026; check the accreditation body's own directory, not a logo. Edition: certification bodies must transition their own accreditation to ISO/IEC 27701:2025 and ISO/IEC 27706, so ask whether the body can audit the 2025 edition now. Audit programme: the quotation should state audit days for Stage 1, Stage 2 and each surveillance visit for your scope, roles, headcount and locations, and whether the PIMS is audited together with an ISMS. Our guide on choosing a credible ISO/IEC 27701 provider lists the questions to ask.

Apply while implementation is still under way; the application review fixes the audit dates.

Steps 7 and 8: the Stage 1 and Stage 2 audits

Stage 1 is the certification body's readiness review. The auditor reads your scope and role statement, the privacy risk assessment and treatment decisions, key policies and records of processing, and confirms that internal audit and management review have happened. The output is a list of concerns and the Stage 2 plan. Close each concern with evidence; it is a finding in waiting.

Stage 2 tests whether the PIMS is implemented and effective across the scope. Expect the audit team to follow one processing activity end to end: the lawful basis or client instruction, the notice the individual saw, the entry in the records of processing, the sub-processors, the transfer safeguard, the retention period and the deletion log. They will ask the people who handle requests how they verify identity and meet deadlines. Findings are graded as major or minor nonconformities or opportunities for improvement, and the closing meeting ends with a recommendation.

Step 9: closing findings and the certification decision

For each nonconformity you send a correction, the root cause and a corrective action within the period the certification body sets. A major nonconformity must be closed and verified, sometimes on a follow-up visit, before a certificate can be granted; a minor one is normally accepted on the plan and checked at the next surveillance audit. The decision is then taken inside the certification body by people who were not on the audit team.

The certificate names your organisation, scope, sites, the edition of ISO/IEC 27701 and your role, and runs for three years subject to surveillance. It shows that an accredited body found your PIMS conforming; it is not a declaration of compliance with the GDPR or any other data protection law, and should never be presented to clients as one.

After the certificate: surveillance, recertification and the 2019 transition

The certification body returns at least once a year, the first surveillance audit no later than twelve months after the decision, and recertifies in the third year. Surveillance samples the PIMS but always looks at internal audits, management review, corrective actions, changes and use of the certificate. Report changes to scope, sites, legal entity or role between visits; a new processor service can change what the certificate should say.

A 2019 certificate was issued as an extension of an ISO/IEC 27001 certificate. It stays valid during the transition if maintained, and accreditation bodies including ANAB and UKAS have set the end of that transition at 31 October 2028. How and when the transition audit happens is the certification body's decision, so agree it early; our guide to the 2025 changes explains how to plan the work.

How long the ISO 27701 certification process takes

Most programmes take three to eight months from kick-off to the certification decision. An organisation with a certified ISO/IEC 27001 system that already knows what personal data it holds sits near the short end. A standalone PIMS starting from a privacy notice sits near the long end: the data must be mapped, contracts and notices corrected, and the request, breach and deletion processes run long enough to leave records. On the certification body's side, pace depends on its calendar, its readiness for the 2025 edition, the interval between the stages and the time you need to close findings. The cost guide shows how the same factors move the price.

ISO 27701 certification process: questions buyers ask