ISO 27701 compliance guide: how to achieve compliance?

What is ISO 27701?

ISO 27701 extends the information security management system (ISO 27001) to the domain of privacy. It adds requirements and controls specific to the protection of personal data (PII), constituting a PIMS: a management system dedicated to privacy protection.

Its logic is that of an extension: it reuses the framework of ISO 27001 and adds controls specific to controllers and processors. It therefore cannot be certified in isolation: it builds on an ISO 27001 ISMS, either existing or constructed at the same time.

Its key value is transforming a regulatory obligation (GDPR) into a structured, measurable and certifiable management system, with an explicit mapping to GDPR articles.

The roles: controller and processor

ISO 27701 organises its controls according to the role played with respect to personal data, mirroring the GDPR.

Who is affected?

ISO 27701 is aimed at organisations that want to structure and demonstrate their privacy compliance, particularly those already engaged in an ISO 27001 approach.

• SaaS publishers and service providers processing their customers' personal data.
• Organisations already certified to ISO 27001 wishing to demonstrate their GDPR compliance.
• Data processors seeking to reassure their clients as data controllers.
• International groups looking for a globally recognised privacy framework.

ISO 27701 and GDPR

ISO 27701 and GDPR are mutually reinforcing: the standard helps implement the regulation and demonstrate compliance with it.

• GDPR sets the legal obligations; ISO 27701 provides the management system to fulfil them.
• The standard offers a mapping to GDPR articles, useful for charting compliance.
• ISO 27701 certification is not legally equivalent to GDPR compliance, but constitutes strong evidence of it.
• The DPO and the PIMS complement each other: human governance and management system.

What penalties apply in the event of non-compliance?

ISO 27701 is a voluntary standard: no fines of its own, but a strong commercial differentiator and a key support for avoiding GDPR penalties, which are very much real.

How to achieve compliance: the 6-step roadmap

Step 1 — Establish an ISO 27001 Foundation

Since ISO 27701 is an extension, ensure an ISO 27001 ISMS is in place, or build both simultaneously. This is the non-negotiable prerequisite.

The PIMS scope must be consistent with the ISMS scope.

• Implement or consolidate the ISO 27001 ISMS.
• Align the PIMS scope with the ISMS scope.
• Reuse existing security controls.

Step 2 — Determine Your PII Roles

For each processing activity, identify whether you act as a PII controller, PII processor, or both. This determines which controls apply.

This qualification directly maps to your GDPR analysis.

• Qualify each processing activity (controller / processor).
• Link these roles to your GDPR register.
• Select the corresponding controls.

Step 3 — Deploy Privacy Controls

Implement the PIMS-specific controls: legal bases, information notices, data subject rights, minimisation, retention periods, sub-processing, transfers, and breach management.

These controls embed GDPR requirements within a structured management system.

• Deploy controller and/or processor controls.
• Link each control to the relevant GDPR requirements.
• Document implementation and supporting evidence.

Step 4 — Map to GDPR

Use the ISO 27701 / GDPR mapping to chart your compliance and identify any gaps. This strengthens your credibility with clients and supervisory authorities.

This mapping is a highly valued deliverable in B2B contexts.

• Establish the PIMS / GDPR article correspondence.
• Identify and close any gaps.
• Leverage the mapping as a client-facing asset.

Step 5 — Audit and Achieve Certification

Conduct internal audits, a management review, and then undergo certification (typically combined with ISO 27001) with an accredited certification body.

Certification provides third-party verified evidence of privacy maturity.

• Conduct internal audits and a management review.
• Pursue certification, often combined with ISO 27001.
• Maintain it through surveillance audits.

Step 6 — Maintain and Improve

Keep the PIMS alive: monitor regulatory developments, review processing activities, and pursue continuous improvement. Privacy protection is an ongoing process.

A well-maintained PIMS remains a lasting commercial asset.

• Monitor regulatory developments and processing activities.
• Continuously improve the PIMS.
• Re-evaluate the scope whenever changes occur.

Common mistakes to avoid

• Seeking ISO 27701 certification without an ISO 27001 foundation, which is not possible.
• Believing that ISO 27701 is legally equivalent to GDPR compliance (it constitutes evidence of compliance, not equivalence).
• Incorrectly qualifying roles (controller / processor), which skews the selection of controls.
• Neglecting the mapping to the GDPR, which is nonetheless highly useful in a B2B context.
• Treating the PIMS as a documentation project without real practices.
• Failing to keep the system active after certification.