ISO 27701 certificate: how long is it valid?
An ISO 27701 certificate is usually valid for three years. In years one and two, an annual surveillance audit follows. In year three, a full recertification takes place. If your system stays in order, the certificate continues. If something goes wrong, the certification body can suspend or withdraw it. So validity depends not only on the date, but on what you do in the meantime.
Always check the conditions of your own certification body, as they may set out details differently. This is the usual cycle for management system certificates under ISO/IEC 17021-1, the standard for certification bodies. You can read about the audit process itself at the ISO 27701 audit process. You can check whether a certification body is valid in the Raad voor Accreditatie (Dutch Accreditation Council, RvA) register . See accreditation of certification bodies.
The cycle at a glance
| Year | What happens | What you need to show |
|---|---|---|
| 0 | Certification audit, in two stages | A complete PIMS (privacy information management system), working in practice |
| 1 | Annual surveillance audit | The system still works, nonconformities resolved, processing register up to date |
| 2 | Annual surveillance audit | The same, plus any changes in scope or processes |
| 3 | Recertification | A complete new audit, comparable to the first |
The certificate is tied to a scope: which organisation, which services, which locations. A surveillance audit is smaller than the first audit, but it is not optional. The auditor checks whether the system still works and whether complaints and incidents have been handled.
Start planning recertification in the second year. That gives you time to fix the shortcomings from the surveillance audits. If you only start in year three, you run a high risk of a negative outcome.
What happens with a nonconformity?
An auditor can identify nonconformities. There are two types. A minor nonconformity (often called “minor”) must be resolved, but it does not immediately threaten the certificate. A major nonconformity (often called “major”) is more serious: for example, a structurally missing component, or processing without a legal basis that you have not addressed.
With a major nonconformity, you get a deadline to resolve it. If you do not manage that, suspension or withdrawal usually follows. The exact deadlines are set out in the conditions of your certification body. You may not use a suspended certificate as valid. That is a reason to inform clients straight away if something is going on.
You can read how to deal with findings in the section on types of findings in the audit process.
What if your scope changes?
If your services or locations change, you must report this to the certification body. Think of a new product line with different personal data, or a department moving to another country. That can trigger an interim audit, depending on the size of the change.
Example: a SaaS company adds an HR module to the scope. That module processes salary data. That is a material change, and your certification body will want to assess it before it is added to the scope. A small wording change in a privacy statement usually is not.
Switching to another certification body
You may switch certification body, for example because another party suits your sector or price better. This is called a transfer of the certificate. The new certification body must:
- check the validity of the current certificate
- review the most recent audit report
- assess whether the scope and the accreditation fit
Pay attention to accreditation. A certificate only counts if the new body is accredited for ISO/IEC 27701. You can read how to check this at accreditation of certification bodies.
Switching in the middle of a cycle is not the same as starting a new process. The new certification body decides for itself whether it wants a full audit or accepts a limited assessment. Ask for this in writing in advance.
What if the certificate expires?
If the certificate expires because you did not get recertified, you start again. You then repeat the certification audit, with all its stages. That costs more than maintaining the system, so plan recertification in time. You can read the costs of a new process at costs and timeline.
How do you state a certificate correctly?
A certificate is proof of a scope at a point in time. State it that way. Use the following wording:
- “ISO/IEC 27701 certified for [scope], valid until [date].”
And not:
- “AVG certified.” That is incorrect. See AVG (Algemene Verordening Gegevensbescherming, General Data Protection Regulation) and ISO 27701.
- “ISO 27701 certified” without a scope. A client then does not know what exactly is certified.
Do you hold a certificate to the 2019 version? It remains valid until the transition deadline in October 2028, provided you continue to meet the requirements. Read moving to the 2025 version.
Common mistakes
Seeing the certificate as the end point. A certificate is the start of a cycle of maintenance. If you stop working on the system after the first audit, you will have a problem at the surveillance audit.
Misreading the date. The validity is stated on the certificate, but the surveillance audits determine whether it stays valid. Put the audit dates in your calendar.
Forgetting to report a scope change. This can lead to a certificate that no longer covers what you do. That is a risk for your clients and for you.
Example: a scope change mid-cycle
A company is in year two of the cycle. The certificate covers its client administration. The company starts using a second product, a marketing tool that processes the email addresses of its clients’ customers. That falls outside the current scope.
The company does four things. It reports the change in writing to the certification body. It carries out a privacy risk assessment for the new tool and records it in the processing register. It signs a processing agreement with the tool’s supplier. It asks the certification body which assessment applies to this change.
The certification body can extend the scope after a limited assessment, or include the change in the next surveillance audit. The certification body decides which route applies. Ask before you put the new tool live.
The example shows why reporting matters. A tool that falls outside the scope but still processes personal data is a fault in the system, even if the certificate remains valid.
Frequently asked questions about validity
Can I show my certificate on my website? Yes, with the scope and the validity date included. Check the usage rules of your certification body. They often state how you may use the logo and text.
Can a client check my certificate themselves? Often, yes. Ask your certification body about a verification option or a public list. A client who wants to check the certificate will usually get that information quickly.
What if my certificate expires by accident? Contact your certification body straight away. Whether and how you can restore the certificate depends on the situation and the conditions. In any case, expect that you may need to start again.
Next steps
Plan your first certification with the step-by-step plan. Read the costs and timeline for the ongoing costs after certification. And if you are looking for a valid certification body, see accreditation of certification bodies.
Sources
- ISO/IEC 27701 at ISO : the standard
- Raad voor Accreditatie (Dutch Accreditation Council, RvA) : the register of accredited bodies
- Autoriteit Persoonsgegevens (Dutch Data Protection Authority) : the AVG in brief