ISO 27701 certification cost: what moves the price of a privacy information management system

Who do you pay for ISO 27701 certification?

Two organisations send invoices, and accreditation rules keep them apart: a certification body is not allowed to offer management system consultancy, so the body that audits your PIMS cannot also be the one that designs it.

The consulting fee covers the work of turning a privacy programme into an operated system: the gap analysis against clauses 4 to 10 and the Annex A controls for your role, the data inventory and records of processing, the privacy risk assessment, the request, impact assessment, transfer, retention and breach processes, internal audit, management review and preparation for the audit. A consultant is optional; the fee reflects how much must be built and how much your team builds itself.

The certification body's fee pays for independent assessment: the Stage 1 readiness review, the Stage 2 audit and the certification decision, followed by a surveillance audit in each of the next two years and recertification in the third. It is driven by audit time, travel and the body's own charges.

Internal time is the cost most budgets miss. A PIMS draws on legal, IT, HR, marketing and operations owners for as long as the certificate is held.

What moves the price of a PIMS?

The same facts about your organisation move both fees, but in different ways: the consultant prices the building work, the certification body the time it needs to confirm the system works.

Processing that spans several countries, and so several privacy laws, adds effort to the register of legal and contractual requirements and to the transfer controls. The regulatory context is also one of the factors a certification body weighs when it sizes the audit.

How the certification body sets audit time

Audit time is not a number a salesperson picks. ISO/IEC 17021-1 requires an accredited body to have documented procedures for determining it, and ISO/IEC 27706, published in October 2025 to replace ISO/IEC TS 27006-2, adds the requirements specific to bodies that certify privacy information management systems.

Under ISO/IEC 17021-1, the body weighs, among other things, the requirements of the standard, the complexity of your organisation and its system, the technological and regulatory context, outsourcing, earlier audit results, the size, number and location of sites, the risks of your services and processes, and whether the audit is combined or integrated with another.

The duration and the reasoning behind it must be recorded. Ask each body for that record before comparing prices; far fewer days for the same scope means a different reading of your organisation, or a weaker method.

Check one more thing at this stage: whether the body holds accreditation for PIMS certification to the 2025 edition. Certification bodies are completing their own accreditation transitions, and a body that cannot yet audit the 2025 edition changes your calendar, and sometimes your cost.

Does an ISO/IEC 27001 certificate lower the cost?

Usually, yes, although it is no longer a condition. Under the 2019 edition a PIMS could be certified only as an extension of an ISO/IEC 27001 certificate; the 2025 edition stands alone, so an organisation without an ISMS can certify to ISO/IEC 27701 directly.

Where an ISMS exists, much of the management system is already paid for: the risk criteria, controlled documents, the internal audit programme, management review and corrective action. The consulting work concentrates on the privacy layer: the data inventory, risk to individuals, the role's controls and the records of requests, transfers and deletions. On the audit side, the body can plan the two systems together.

A standalone PIMS remains a sound choice; it simply carries the full cost of the management system, including the A.3 security controls that apply whatever the role.

Hidden costs to plan for

• A certificate that fails a client's check. A body without accreditation for PIMS certification may quote less, but when a client or regulator does not accept its certificate, the project is paid for twice.
• Contract and system changes. The gap analysis often finds data processing agreements, sub-processor terms or retention settings that must change. That remediation is rarely in any quotation.
• Legal advice. A PIMS helps you evidence accountability under the laws that apply to you, but it is not legal advice. Where the interpretation of a law is uncertain, your own advisers are a separate budget line.
• Findings that need another visit. A major nonconformity must be verified as closed before the certificate is issued; if that verification cannot happen in the period the body sets, Stage 2 may have to be repeated.
• The years after the certificate. Surveillance audits come every year and recertification in the third, and a quotation that stops at Stage 2 hides most of the cycle.

How to compare ISO 27701 quotations

Totals mean something only once every quotation describes the same scope, role and cycle.

From certification bodies, ask for

• the accreditation body, the accreditation for ISO/IEC 27701 under ISO/IEC 27706, and the edition the certificate will state;
• the scope, sites, headcount and role, identical across quotations;
• audit time for Stage 1, Stage 2, each surveillance audit and recertification, with the recorded justification;
• whether the PIMS is audited alone or with your ISMS, and how that changes the days;
• travel, certificate and annual charges, and the terms for follow-up visits.

From consultants, ask for

• an all-inclusive proposal against written deliverables, or an open rate by the day;
• which work your team does and which the consultant does;
• whether internal audit, management review, training and software are included;
• support through both audit stages, with certification-body fees shown separately. A single price covering consulting and the certificate together is a warning sign.

ISO 27701 certification cost: questions buyers ask