ISO 27701 checklist: all the parts to check

An ISO 27701 checklist runs through the management requirements (clauses 4 to 10) and the privacy controls in Annex A. For each item, you ask two things: is it documented, and is it also done in practice? The auditor looks at the second. This checklist is a working document: for each line, you record what you have and what evidence exists. The exact text of the requirements is in the standard itself, which you buy from NEN (Dutch standards institute) . For the story behind the requirements, read the ISO 27701 requirements.

Use the checklist before you do a baseline measurement. Then you see straight away where your gaps are.

Part 1: management requirements (clauses 4 to 10)

These items apply to any management system built on the High Level Structure (HLS). They form the skeleton of your PIMS (privacy information management system).

Clause	Topic	Question to ask yourself	Evidence for the auditor
4	Context and scope	Which personal data do you process, and which role do you have: controller, processor or both?	Scope document, processing register
5	Leadership	Has management adopted and communicated a privacy policy?	Signed policy, minutes of the decision
6	Planning	Have you carried out a privacy risk assessment and set objectives?	Risk assessment, list of objectives and measures
7	Support	Do employees know what they must do, and is that recorded?	Training records, document control, competences
8	Operation	Do the processes work as described?	DPIAs, processing agreements, handled requests
9	Performance evaluation	Do you review the system critically yourself?	Internal audit report, management review report
10	Improvement	Do you address nonconformities and incidents in a structured way?	Register of nonconformities with corrective actions

An example of a completed row

Clause 8 covers operation. Suppose you run a webshop with customer data. Then you ask: “How do we handle a request for access?” The answer is a procedure with a template and a log of requests received. The evidence is the log, with the date of receipt and the date of completion. Have you never had a request? Then you show the procedure and the test you carried out. That test is also evidence.

Part 2: privacy controls per theme

In the 2025 version, Annex A contains 78 controls: 31 for controllers, 18 for processors and 29 shared security controls. Which ones you need depends on your role. The checklist below groups them by theme. Which controls apply to you depends on your role. For this, read processor or controller.

Theme	Question to ask yourself	Evidence for the auditor
Lawful basis and purpose	Can you say, for each processing activity, why you use the data?	Processing register with purpose and lawful basis per entry
Transparency	Do data subjects know which data you process and why?	Privacy statement, and the date you last updated it
Rights of data subjects	How do you handle access, correction and erasure?	Procedure, template, log of requests
Retention periods	Do you know how long you keep each category and why?	Retention schedule, and proof that old data is actually deleted
Sharing with third parties	Do you know who you pass data on to?	List of recipients, processing agreements
Processors (if you are a processor)	Do you follow your client’s instructions, and can you show it?	Instructions per client, processing agreement
Security (the 29 shared controls)	Is personal data protected against unauthorised access?	Your security policy and access rules, for example through ISO 27001
Data breaches	Does everyone know what must happen if a breach occurs?	Procedure, breach register, and reporting to the AP (Dutch Data Protection Authority)

Many organisations think a policy document is enough. The auditor wants to see that the policy works in practice. A processing register that has not been updated for years is noticed at first glance.

How do you use the checklist?

Work in three rounds. That stops you from getting stuck halfway.

First, only record whether it exists. Yes, partly or no. That is about an hour’s work per theme, and it gives you an honest picture.
Then check the evidence. For every yes, ask: where is that written down, and who works with it? If it is not on paper, it is not yet a yes.
Then prioritise the gaps. Start with the gaps that hit your clients or the AVG (Algemene Verordening Gegevensbescherming, General Data Protection Regulation) hardest: rights of data subjects, data breaches and the processing register.

Already have ISO 27001? Then you can reuse a lot. The security rows are often already filled in for you. For this, read ISO 27701 vs. ISO 27001.

Common mistakes

The scope is too narrow. Your checklist covers the whole organisation, but you have only described the client portal. The auditor will then ask: what about the HR software?

The policy exists, but nobody knows it. The auditor asks an employee about the data breach process. If the answer is unclear, the policy has not been put into practice.

The evidence is missing. You have a procedure for access requests, but not a single log. That means you have never tested the procedure, or that you do not use it.

The checklist is a one-off. A checklist you fill in once and file away does not help at the annual surveillance audit. Update it every quarter.

How often do you update the checklist?

A checklist goes out of date. A new processing activity, a new supplier or a new service makes some answers wrong. So update the checklist at three moments:

with every change in scope, for example a new product line or a new location
every quarter, as a fixed reminder for the owner of the privacy system
just before the surveillance audit, as a final check of the evidence

Record for each change what changed and who approved it. That log is itself evidence of a working system.

Example: a completed row for an HR module

A SaaS company adds an HR module. It processes salary data, and the company’s clients are themselves employers. Under the lawful basis theme, the company fills in:

Question	Answer	Evidence
Can we say, for each processing activity, why we use the data?	Yes, for the payroll module: performance of the contract with the employer	Entry in the processing register, with the role of processor
Is the processing covered by your client’s instructions?	Partly: the client has not explicitly described the module	Open action point with a date and an owner

The second row is useful. An honest open point, with an owner and a date, builds more trust than a tick without evidence. The auditor sees that the system works, even where it is not finished yet.

Next steps

With the checklist in view, you can make a realistic plan. Read the step-by-step plan for the order, and costs and timeline for what it costs. Want to know how the auditor tests the checklist? That is covered in the audit process.

Sources

ISO/IEC 27701 at ISO : the standard, the official text
NEN : Dutch publisher of the standard
Autoriteit Persoonsgegevens : the AVG in brief