The ISO 27701 audit process
You get an ISO 27701 certificate from an external, accredited auditor who assesses your system in two stages. Stage 1 is a document review; stage 2 is a practical audit. After that come annual surveillance audits, and after three years a recertification. The Raad voor Accreditatie (Dutch Accreditation Council, RvA) accredits the certification bodies in the Netherlands. Active bodies include BSI , DNV and TÜV NORD . For how to prepare for the audit, see the step-by-step plan. For what the standard requires, see ISO 27701 requirements.
On this page
Consultant vs. certification body.
Who is involved?Stage 1 and stage 2 explained.
The certification auditPrivacy-specific points of focus.
What does the auditor check?Surveillance audits and recertification.
After the auditWhat often goes wrong.
Common mistakesWho is involved?
Two types of parties are involved in certification, and you should not confuse them.
A consultant or implementation partner helps you build the system: baseline measurement, documentation, training, and audit preparation. This party does not issue a certificate and is preferably independent of the certification body.
A certification body (such as BSI, DNV or TÜV) carries out the audit and decides on the certificate. This body is accredited by the RvA or an equivalent European accreditation body. Without accreditation, the certificate has no market value.
The separation between consultant and auditor is deliberate. An auditor who has also advised you is not independent. Watch for this when you choose.
The certification audit in two stages
Stage 1: document review
In stage 1, the auditor reviews your documentation. Have you defined the scope clearly? Is the statement of applicability complete and internally consistent? Does the processing register match reality? Are the policy documents in place?
This is not a final verdict on the system. It is a readiness check. The auditor checks whether you are ready for stage 2. Findings from stage 1 must be fixed before the practical audit begins.
Stage 1 usually takes half a day to one day. The auditor often does this remotely, through shared documents.
Stage 2: implementation in practice
In stage 2, the auditor visits your organisation (or works fully remotely for smaller projects). The auditor speaks with employees, looks at how processes work, and checks whether agreements are kept.
Typical questions in stage 2: “Show me how you handle a request for access from a data subject.” Or: “Which processing agreements do you have with your cloud providers?” Or: “How have your employees been trained on privacy awareness?”
The length of stage 2 depends on your organisation’s size and scope. A small company should expect one to two days. Larger organisations need more.
What the auditor specifically checks for ISO 27701
ISO 27701 has its own focus, alongside the usual management system requirements. The auditor checks at least:
| Component | What the auditor checks |
|---|---|
| Processing register | Complete, up to date, in line with reality |
| Role determination | Are you a processor, a controller, or both? Is the scope correct on this point? |
| Privacy risk assessment | Was it carried out from the perspective of the data subject? |
| Statement of applicability | Have the 78 controls been assessed and justified? |
| Procedures for data subjects | Does the procedure for access, correction and erasure work? |
| Processing agreements | Are they in place for all third parties that process personal data? |
| Incident procedure | Is there a procedure for data breaches, and has it been tested? |
| Awareness | Have employees been trained on privacy? |
For a standalone certification, the auditor also checks the 29 shared information security controls. In the 2025 version, these are mandatory for both processors and controllers. If you start without ISO 27001, this is an extra point of assessment.
Types of findings
The auditor works with three categories:
| Finding | Meaning |
|---|---|
| Major nonconformity | A serious deviation. The certificate is not issued until this is resolved. |
| Minor nonconformity | A smaller deviation. You record a correction plan and resolve it in the surveillance audit. |
| Observation | A point of attention or an improvement suggestion. No mandatory action, but do not ignore it. |
A major nonconformity is not a disaster, but it does mean an extra round of work. You draw up an action plan, make the improvements, and the auditor assesses the result. Sometimes a small extra audit follows.
After the audit: annual surveillance and recertification
After the certification audit, you receive a certificate that is valid for three years. In years one and two, an annual surveillance audit follows. It is smaller than the certification audit, but it is not optional.
In the surveillance audit, the auditor checks whether the system still works. Have there been incidents? How were they handled? Is the processing register up to date? Have the objectives been met?
In year three comes recertification: a complete new audit, comparable to the first. So keep your system in order on an ongoing basis. A privacy information management system (PIMS) that sits unchanged in a drawer for three years will not survive recertification. For what the validity of your certificate means exactly, see ISO 27701 certificate: validity.
Common mistakes in the audit
Organisations regularly run into the same problems:
- The processing register does not match practice. The register was drawn up once but never updated after new services were added.
- The statement of applicability and the system contradict each other. A control is marked as “applicable”, but nothing has been done for it.
- Employees do not know the procedures. The auditor asks an employee to describe the privacy policy, and nobody knows it.
- Processing agreements are missing. Cloud services, HR tools and other suppliers process personal data, but nothing is recorded.
- The privacy risk assessment misses the data subject’s perspective. Only technical risks were considered, not the impact on individuals.
Read how to implement the standard correctly in ISO 27701 requirements and processor or controller.
Next steps
How do you reach the audit?
Step-by-step planWhat does the standard require, exactly?
Requirements of the standardWhat do the audit days cost?
Costs and timelineThe same mechanism for information security.
ISO 27001 audit processOverview of ISO 27701.
Back to the hubSources
- Raad voor Accreditatie (RvA) : accreditation of certification bodies in the Netherlands
- ISO/IEC 27701 at ISO : International Organization for Standardization
- BSI: ISO 27701 in the Netherlands : certification body