ISO 27701 accreditation: how do you check a certification body?
An ISO 27701 certificate only counts if the body that issues it is accredited for the standard. In the Netherlands, the Raad voor Accreditatie (Dutch Accreditation Council, RvA) does this, or an equivalent European accreditation body. Accreditation is a separate check on the certifier itself. The RvA has an assessment document for certification under ISO/IEC 27001 and ISO/IEC 27701 (ASR230, version of September 2024). You check the accreditation yourself in the public register of the RvA , and you do this before you sign a quote.
Why this matters: many clients and public tenderers do not accept a certificate from a non-accredited party as proof. For the basic story about the standard, see what is ISO 27701. For the costs of the process, see costs and timeline.
Why the scope of the accreditation matters
Accreditation is granted per standard. A body can be accredited for ISO 27001 and not for ISO 27701. This is a common source of confusion. An ISO 27001 accreditation says nothing about ISO 27701.
Also check the version. The 2019 version and the 2025 version of the standard differ, and certification bodies must update their accreditation to the 2025 version. Whether that has happened is shown in the register or follows from the scope of the accreditation. Ask the certification body for evidence that it is accredited for the version you want certified. If you already hold a 2019 certificate, read moving to the 2025 version.
A certification body without accreditation for ISO/IEC 27701 cannot issue a valid ISO 27701 certificate. Ask about this in the quote, in writing. A quote that talks around the question is a warning sign.
An accredited party answers these questions without hesitation. If you still have doubts after the answer, ask a second party the same questions and compare.
Checking step by step
Ask for the registration number
Ask the certification body for its RvA registration number and the name as it appears in the register. A serious party has this ready straight away.
Look it up in the RvA register
Search by name or registration number in the public register of the Raad voor Accreditatie . The register shows the accreditations per body.
Check the scope
Check whether the scope names ISO/IEC 27701, preferably with the correct version. If only ISO/IEC 27001 is listed, the body is not accredited for 27701.
Compare the scope with your project
Does the scope the body can cover fit your organisation and role? A processor and a controller are assessed against different controls (18 and 31 respectively, alongside 29 shared controls). Ask which role the auditor is used to auditing.
Example questions for the quote
These questions help you see the difference between a serious party and a seller who promises accreditation without evidence.
| Question | Good answer | Watch out for |
|---|---|---|
| Are you accredited for ISO/IEC 27701? | Yes, with registration number and scope | Only “we are accredited”, with no number |
| For which version? | The name of the version, and what that means for your project | No answer about the version |
| May I check the register myself? | Yes, straight away, with a link or number | Refusal or delay |
| How long does a project take with you? | An estimate with an explanation | A fixed price without first looking at your situation |
If you want to compare costs, ask for at least two quotes. Examples of parties that carry out ISO 27701 are listed on costs and timeline. The difference between quotes often lies in the scope the auditor applies, not in the price alone.
Common mistakes
Trusting a logo. A logo or a claim on a website says nothing. Check the register yourself.
Confusing ISO 27001 accreditation with 27701. This is the most common mistake. A body can be accredited for one standard and not the other.
Looking only at the price. A cheap certificate from a non-accredited party is money wasted. You will have to do it again.
Treating a consultant as the certification body. A consultancy that builds your system is usually not allowed to be your auditor at the same time. Ask whether the two parties are separate.
What happens after the choice?
Once you have chosen an accredited party, the certification audit follows in two stages. This is explained in the audit process. The step-by-step plan for preparation is at the step-by-step plan.
If you later want to switch certification body, the same check applies. For that, read the section on switching in ISO 27701 certificate: validity.
Example: checking a quote
A company receives three quotes for the certification audit. Two parties mention accreditation in one sentence. The third party gives the registration number and the scope.
The company checks all three in the register. The first party turns out to be accredited for ISO/IEC 27001, but not for 27701. The second party is not listed in the register under that name. The third party has a scope that names ISO/IEC 27701, in the version the company wants to certify.
Only the third quote is usable as a basis. That sounds obvious, but in practice the first mistake is the most common. A quote that looks good is only usable after it has been checked in the register.
A tip for the conversation with the certification body: ask which auditors they will deploy and whether those auditors have experience with your type of processing. An auditor who knows healthcare IT tests differently from someone who mainly works with manufacturing companies.
Frequently asked questions about accreditation
Is a European accreditation body the same as the RvA? Not the same, but equivalent under European agreements. Check the register of that body as well, and whether the scope names ISO/IEC 27701.
What if my certification body’s accreditation lapses during my project? Ask the certification body straight away what that means for your certificate. A certificate without valid accreditation will not help you with clients or tenderers. Keep a record of the question and the answer.
My certification body is not in the register. Can that still be correct? First check the name. Also search by the legal name of the entity, as it may differ from the trading name on the website. If there is still no result, the party is not accredited for the standard.
Should I keep a record of the check? Yes. Save a printout or a screenshot of the register entry, with the date of the check. That way you can show later that the certification body was accredited at that time.
Sources
- Raad voor Accreditatie (RvA) : the public accreditation register
- RvA: ASR230, certification under ISO/IEC 27001 and ISO/IEC 27701 : assessment document for certification bodies
- ISO/IEC 27701 at ISO : the standard