Effivity ISO 27701 guide: how the software runs your PIMS, from records of processing to the audit

What a PIMS auditor wants to see, and where Effivity fits

An ISO/IEC 27701 auditor is not interested in which privacy management software you use. The question at Stage 2 is whether the privacy information management system operates: whether records match real processing, requests were answered on time, sub-processors were assessed before use and retention periods led to deletion.

Auditors pick one case and follow it: an entry in the records of processing to its lawful basis, notice, retention period and last deletion; a request to its identity check, the systems searched and the date answered. Where privacy lives in legal inboxes, security in IT tickets and contracts in a shared drive, these threads break at the hand-offs.

Effivity gives each of those steps a place and an owner in one system, with reminders as due dates approach. Nothing in ISO/IEC 27701 requires software. What changes is how quickly your owners can show one complete, dated thread.

Effivity modules mapped to ISO/IEC 27701

The table maps the clauses of the 2025 edition, and the Annex A work that sits under them, to Effivity's own module names. Where no dedicated module exists, Sterling configures a workflow with a form, an owner and a due date. The clauses and controls themselves are explained in the requirements guide and the Annex A guide.

Dashboards and alerts show the measures you monitor: request turnaround, overdue impact assessments, open breach actions and training coverage.

A worked trace: one request for access

A former customer e-mails asking for a copy of everything held about her. The service desk logs the request that day in the request workflow, which starts the response clock set by the applicable law. The handler verifies her identity and uses the records of processing to list the systems to search; the marketing owner finds her in a newsletter tool the inventory omits. The response goes out before the deadline, and the gap becomes a nonconformity in Non-Conformance: the tool is added to the inventory, its retention period set, its supplier assessed in Purchase and the privacy risk revisited. An auditor sampling that request finds every step dated and owned, and a PIMS that corrected itself.

What Sterling configures at the start

Effivity, Sterling's ISO and GRC software, used in 50+ countries, is set up in the first weeks of an ISO/IEC 27701 engagement, so the PIMS is built where it will run.

• Role and scope first. Controller, processor or both decides which Annex A controls and workflows apply, so it is recorded before anything else; PII controller or PII processor: scoping your PIMS explains how to make it.
• The inventory is built with the people who process the data. HR, sales, marketing, support and IT owners each record their own processing activities, rather than leaving a questionnaire with legal.
• Risk criteria agreed before risks are rated. Top management sets how harm to individuals and to the organisation is scored; owners then rate and treat their risks.
• Workflows for recurring privacy work. Requests, impact assessments, sub-processor approval, transfers, retention reviews and breach response each get a form, an owner and reminders.
• Existing documents are sorted, not copied. Notices, policies and agreements that match practice move into Documented Information; the rest are rewritten from Effivity's pre-built templates.

The internal audit programme is then scheduled in Internal Audit and findings are closed through Non-Conformance before the certification body's Stage 1 readiness review; ISO/IEC 27701 internal audit: planning, conduct and reporting covers the audit itself.

Adding a PIMS to an ISMS already in Effivity, or running it standalone

Many organisations reach ISO/IEC 27701 with an ISO/IEC 27001 system already in place. Where that system runs in Effivity, the shared machinery is used once: document control, competence records, the internal audit programme, management review and corrective action. The privacy layer is added beside it, with privacy risks rated against their own criteria. A system holding personal data should appear in both the asset register and the records of processing.

Since the 2025 edition can be certified on its own, a PIMS can also run in Effivity without an ISMS. The A.3 security controls then need their own evidence. Holders of a 2019 certificate keep their records and rework them to the new structure; see the transition guide.

Surveillance, recertification and Sustain™

After the certificate, the certification body returns for surveillance audits each year and a recertification audit in the third year. Surveillance looks for a PIMS that kept moving: records updated when a product or supplier changed, impact assessments done before launch, deletions carried out, and internal audit and management review held as planned.

Privacy records age fastest where the business changes fastest. A new marketing tool or an offshore support team should reach the inventory, the risk register and the sub-processor list within weeks, prompted by reminders rather than one person's memory. Under Sustain™, Sterling continues with internal audits, refreshed records of processing, new-joiner awareness and surveillance readiness in the same Effivity system.

What Effivity does not do

Effivity manages the PIMS; it does not process your customers' or employees' personal data on your behalf. It does not capture consent, discover personal data across your systems or delete data from your applications; those actions happen in your own technology, whose logs remain primary evidence, while Effivity holds the decision, the owner and the confirmation. Interpreting the GDPR or a national law stays with your advisers; the data protection law guide explains how the two meet.

Three habits weaken an otherwise sound set-up:

• An inventory written once. Records of processing never touched after implementation are the first thing surveillance finds.
• Personal data copied into the system. Request records need dates, decisions and references, not the individual's documents.
• Deletion recorded as policy, not as action. A retention schedule without deletion records shows intent, not practice.

Effivity for ISO/IEC 27701: questions buyers ask