What does ISO 27701 cost? Costs and timeline
The costs of an ISO 27701 certificate vary widely. As an indication: a small company that already has ISO 27001 budgets €5,000 to €15,000. A company starting standalone, without an existing security system, is more likely to pay €12,000 to €30,000. Medium-sized and large organisations can reach €25,000 to €75,000 or more. Always ask for a quote from an accredited certification body such as BSI , DNV or TÜV . The amounts below are indications based on public information. There are no fixed rates for the Netherlands. The process is set out step by step in the step-by-step plan. You can find the standard itself at ISO .
All amounts on this page are indications. Certification bodies work with bespoke rates that depend on your organisation’s size, scope, number of locations and certification body. Always ask for a quote before you set a budget.
Indicative costs per situation
| Situation | Indicative total cost in year one |
|---|---|
| Small company, already ISO 27001 certified | €5,000 - €15,000 (extension) |
| Small company, standalone (without ISO 27001) | €12,000 - €30,000 |
| Medium-sized or large | €25,000 - €75,000+ |
With an extension to ISO 27001, the costs are lower because you reuse your existing processes, documentation and audits. You only add the privacy-specific parts. With a standalone process, you also build the security foundation from scratch.
Cost items broken down
| Cost item | Explanation |
|---|---|
| Preparation and advice | Baseline measurement, guidance, setting up PIMS documentation. Often the largest item. |
| Tooling (optional) | Software for the processing register and document control. Not mandatory. |
| Certification audit stage 1 | Document review by an accredited auditor. |
| Certification audit stage 2 | Assessment in practice, across several half-day sessions. |
| Annual surveillance audits | Years 1 and 2 after certification, smaller than the main audit. |
| Recertification (year 3) | New full audit, comparable to the first certification. |
The audit costs are set by the certification body and depend on your organisation’s size and the number of audit days. Advisory costs vary by firm and approach.
Why does ISO 27001 save so much?
With ISO 27001 you already have a working management system: internal audit, management review, risk analysis, statement of applicability and document control. You do not need to set these up again.
For ISO 27701, you add: the processing register, the privacy risk analysis, procedures for data subjects, and the privacy controls from Annex A. That is considerably less work than building everything from zero.
If you start standalone, you do not only build the privacy system. You also build the security foundation: the 29 information security controls that apply to both processors and controllers. That costs extra time and money. For how the two routes compare, see ISO 27701 vs. ISO 27001.
Timeline: how long does it take?
The lead time depends on three factors: your starting point, the size of your organisation and how quickly you free up internal capacity.
| Situation | Indicative lead time |
|---|---|
| Already ISO 27001, good privacy basis | 3-5 months |
| Already ISO 27001, limited privacy documentation | 4-7 months |
| Standalone, small company | 5-8 months |
| Standalone, medium-sized or large | 7-12 months |
The process cannot be rushed. The standard expects your system to have been running for some time before the auditor arrives. An internal audit and management review must have taken place. Plan for at least three months of operation after implementation.
Ongoing costs after certification
An ISO 27701 certificate is valid for three years. But every year, an auditor comes to check your system. Those costs are lower than the first certification, but they are not zero.
Plan for two to three audit days per year for a small company. Medium-sized organisations need more. Add the internal effort to keep the register, policy and risk analysis up to date.
After three years, recertification follows. This is comparable to the original certification audit. Plan extra budget for this in year three.
Which certification bodies are active in the Netherlands?
Accredited bodies that carry out ISO 27701 in the Netherlands include BSI , DNV , TÜV NORD , Kiwa and DEKRA . Ask for at least two quotes. Audit day rates and scope interpretations can differ.
The certification body must be accredited by the Raad voor Accreditatie (RvA, Dutch Accreditation Council) or an equivalent European accreditation body. A certificate from a non-accredited body has no market value. For how to check a body’s accreditation, see accreditation of certification bodies.
What should you ask in a quote?
Ask certification bodies for a specification per audit day and per stage. That way you can compare quotes. Relevant questions: how many audit days do they plan for stage 1 and stage 2, what does a surveillance audit cost in years 1 and 2, and what is their experience in your sector? A consultant who guides you and the certification body are different parties. Do not combine them to save costs. Independence is a requirement.
For the organisations for whom ISO 27701 is relevant, see who is ISO 27701 for. The full implementation process is in the step-by-step plan.
Next steps
The full process, step by step.
Step-by-step planWhich parts of the process take the most audit days?
The audit processIs ISO 27701 relevant for your organisation?
Who is it for?Comparison with ISO 27001 costs.
ISO 27001 costsOverview of ISO 27701.
Back to the hubSources
- BSI, ISO 27701 in the Netherlands : certification body
- DNV, certification : certification body
- TÜV NORD Netherlands : certification body
- NEN, information security and privacy : Netherlands Standardisation Institute (NEN)