Frequently asked questions about ISO 27701
Below you will find answers to the most frequently asked questions about ISO 27701, from the relationship with the GDPR to costs, processor roles and the 2025 version. Many questions refer to deeper explanations on other pages in this cluster. Would you rather start with the basics? Go to the hub. The legal text of the Algemene Verordening Gegevensbescherming (AVG, General Data Protection Regulation) is on EUR-Lex. The standard itself is available from ISO and via NEN . For the official position of the Dutch supervisory authority, see Autoriteit Persoonsgegevens (Dutch Data Protection Authority) .
Is ISO 27701 a GDPR certificate?
No. This is the most persistent misconception. ISO 27701 is not a legal GDPR certification within the meaning of Article 42 of the GDPR. Such a recognised certification mechanism must be approved by the European Data Protection Board (EDPB) and does not yet exist in practice.
ISO 27701 is an ISO/IEC standard, developed by standards organisations. The Autoriteit Persoonsgegevens is not a party to the standard and does not approve the certificate as GDPR evidence.
What it does do is give you a structured way to demonstrate your privacy work, with a strong link to the GDPR through Annex D. The right message to clients is: “We are ISO 27701 certified and use it to demonstrably work on privacy and the GDPR in a structured way.” Not: “We are GDPR certified.”
The full explanation is on GDPR and ISO 27701.
Do I need ISO 27001 to obtain ISO 27701?
No, not any more. Before October 2025, ISO 27701 was an extension of ISO 27001. You needed a valid ISO 27001 certificate to obtain ISO 27701. That has changed.
Since the publication of ISO 27701:2025, the standard is standalone. You can start with ISO 27701 directly, without ISO 27001. The standard now has its own clauses 4 to 10.
That said: if you already have ISO 27001, the step to ISO 27701 is smaller. You reuse many processes and the lead time is shorter. Read the full difference on ISO 27701 vs. ISO 27001.
Is ISO 27701 mandatory?
Not legally. No law or regulation makes ISO 27701 mandatory. The GDPR requires you to take appropriate technical and organisational measures, but it does not prescribe a specific certification.
In practice, however, it can be required by contract or commercially. Enterprise clients, government buyers and partners in regulated sectors increasingly ask for it in tenders and vendor assessments. That makes it a commercial necessity for many processors and SaaS companies, even if it is not legally required. How to recognise that is explained on is ISO 27701 mandatory?.
What does ISO 27701 cost?
This depends strongly on your organisation’s size, your starting point and whether you already have ISO 27001. As an indication:
| Situation | Indication |
|---|---|
| Small, already ISO 27001 certified | €5,000 - €15,000 |
| Small, standalone without ISO 27001 | €12,000 - €30,000 |
| Medium to large | €25,000 - €75,000+ |
These are indications based on public information from certification bodies. There are no fixed rates for the Netherlands. Always ask for a quote from an accredited body.
The full cost overview is on costs and timeline.
How long does certification take?
Three to nine months, depending on your starting point. If you already have ISO 27001 and a reasonable privacy basis, you are at the lower end. If you start from scratch, you are closer to nine months.
A process cannot be rushed. The standard expects the system to have been running for some time before the audit. An internal audit and management review must have taken place. Plan for at least three months of an operational system.
The full process is on the step-by-step plan.
What is the difference between a processor and a controller?
A controller decides why and how personal data is processed. A processor does this on behalf of someone else, based on documented instructions.
Your role determines which of the 78 controls in Annex A apply to you. Many organisations are both at once: a SaaS company is a processor for customer data and a controller for its own staff and prospect data.
The decision tree and examples are on processor or controller.
What changed in the 2025 version?
The big change is that ISO 27701 is now standalone. In 2019 it was an extension of ISO 27001, so you had to hold an ISO 27001 certificate.
Other changes:
- Its own full structure (clauses 4 to 10)
- Controls for controllers and processors combined into one Annex A
- Annex B now contains implementation guidance (new)
- Broader scope: biometric data, health data, IoT and AI privacy explicitly included
- Updated mappings to the GDPR (Annex D), ISO 29100 (Annex C) and ISO 27018
Read the full comparison on ISO 27701 vs. ISO 27001.
How many controls does ISO 27701 have?
In the 2025 version there are 78 controls, split into three groups:
| Group | Number |
|---|---|
| Controls for controllers | 31 |
| Controls for processors | 18 |
| Shared information security controls | 29 |
| Total | 78 |
Not all 78 always apply to you. Which set applies depends on your role. If you are only a processor, the 18 plus the 29 shared controls apply.
Is there a transition period for 27701:2019?
Yes. Organisations with an ISO 27701:2019 certificate have a transition period of three years. The deadline for the transition to the 2025 version is October 2028.
Plan your transition audit in time. Most certification bodies expect you to have completed the process before that deadline, not to be finishing right on it. How to plan the switch is explained on moving to the 2025 version.
What is a PIMS?
PIMS stands for privacy information management system. It is not software, but a set of processes, roles and agreements that keep you in control of all personal data in your organisation. Think of a processing register, a privacy policy, procedures for data subjects, processor agreements and an incident procedure.
The system runs on the Plan-Do-Check-Act cycle: you plan, carry out, check and improve. It is a living system, not a document you create once.
The full explanation is on the PIMS explained.
Is ISO 27701 relevant for healthcare organisations?
Yes. The 2025 version explicitly includes health data and biometric data in its scope. That makes the standard directly relevant to care providers and healthcare IT.
In healthcare, you often combine ISO 27701 with NEN 7510, the Dutch standard for information security in healthcare. ISO 27701 adds the privacy dimension to the security foundation of NEN 7510.
May I say that we are GDPR certified?
No. “GDPR certified” is misleading. A legally recognised GDPR certification mechanism (Article 42 GDPR) does not yet exist in practice. You must not suggest that you hold such a certification.
The right wording: “We are ISO 27701 certified and use it to demonstrably work on privacy and the GDPR in a structured way.”
That is honest, correct and convincing. Clients and partners understand what it means. Read the full explanation on GDPR and ISO 27701.