Is ISO 27701 mandatory?
No, ISO 27701 is not required by law. No Dutch or European law prescribes the standard or a certificate. The GDPR does require you to take appropriate measures and to demonstrate compliance, but it leaves the way you demonstrate that up to you. Article 42 GDPR even states explicitly that certification is voluntary. In business, ISO 27701 is increasingly a requirement, because customers, public tender bodies and partners include it in their procurement terms.
So in practice, mandatory usually means this: your client or public tender body requires it. The sections below explain how to recognise that. The basics of the standard are on what is ISO 27701, and the legal background is on GDPR and ISO 27701.
What does the law say?
The GDPR contains an accountability obligation (Article 5(2)): you must be able to show that you comply with the rules. This includes a register of processing activities (Article 30), a procedure for requests from data subjects, appropriate security (Article 32) and, where necessary, a DPIA (Article 35). DPIA stands for data protection impact assessment, a risk analysis carried out in advance. These obligations apply to organisations that process personal data, whether or not a standard applies. For the register there is an exemption for small organisations (fewer than 250 employees), but it lapses if the processing is not occasional or carries risks. In practice, almost everyone therefore needs a register.
What the law does not do is prescribe a specific certificate. Article 42 GDPR does provide a framework for GDPR certification mechanisms, with criteria approved by a supervisory authority or the European Data Protection Board (EDPB). One example is the European data protection seal Europrivacy. ISO 27701 is not an approved mechanism under that article. An ISO 27701 certificate is therefore not legal proof of GDPR compliance. It is an externally confirmed management system, nothing more.
What is mandatory regardless of ISO 27701: in most cases, a register of processing activities (processing register), a data processing agreement as soon as another party processes personal data on your behalf (data processing agreement), and a notification in the event of a data breach (reporting a data breach).
When does it become mandatory in practice?
These are the situations in which ISO 27701 comes up in practice. None of them arises from the law.
| Situation | What happens | Is it mandatory? |
|---|---|---|
| A tender or procurement terms ask for an ISO 27701 certificate | You must show the certificate, or you are disqualified | Yes, within that contract or relationship |
| A client asks you to answer questions in a vendor assessment | You must demonstrate privacy measures, but the certificate is one of several ways to do that | No, your own description or the client’s audit can also suffice |
| A partner in a regulated sector requires privacy measures | Often via a checklist or a contract clause | No, unless the contract names a certificate |
| You process data on behalf of a client | A data processing agreement is mandatory | The agreement is, ISO 27701 is not |
| No client or procurement requirement | You comply with the GDPR without a certificate | No |
The second and third rows are the most common pitfall. A client who asks “how do you ensure privacy” usually wants a clear answer and evidence, not necessarily a certificate.
How do you recognise a real requirement?
Read the wording of the requirement yourself, not the summary from your salesperson or account manager. Three questions help:
- Does it say “certificate” or “demonstrably comply with”? The first is a hard requirement. The second usually leaves room for other forms of evidence.
- Does it name a version or standard? A requirement for “ISO 27701:2019” is different from one for the 2025 version. See moving to the 2025 version if you need to understand that.
- Is an alternative mentioned? Think of your own audit report, a self-assessment based on the standard, or another recognised certificate.
Questions to ask the buyer
| Question | Why |
|---|---|
| Is a certificate required, or is demonstrable compliance enough? | Determines whether you really need ISO 27701 |
| Which version: 2019 or 2025? | Determines which measures the auditor will check |
| Does the requirement apply to the whole company or to one service? | Determines the scope of your project |
| By when must it be in place? | Determines the planning and the budget |
| Will you accept a certificate from another accreditation body? | Avoids a second project |
When is it not necessary?
For many smaller processors without a procurement requirement, a certificate is not necessary at this time. In that case it is enough to have the basics in order: a processing register, agreements with suppliers, a working procedure for requests, and a plan for data breaches.
An alternative, if you want to use the standard but do not yet need a certificate: work with the requirements as an internal checklist. That gives you the same structure, without the cost of an external audit. You can find a practical list on the ISO 27701 checklist.
Avoid saying “we are GDPR-certified” if you only have ISO 27701. An ISO 27701 certificate is not a GDPR certificate within the meaning of Article 42. Use the precise wording: “ISO/IEC 27701 certified for scope X”.
Common mistakes
Getting certified because it “has to be done”, without reading the requirement. That costs a project of months for something a client may only have wanted as a self-assessment.
Thinking ISO 27001 covers the same ground. An ISO 27001 certificate covers information security. It does not automatically cover the privacy measures in ISO 27701. Read the difference on ISO 27701 vs ISO 27001.
Assuming a requirement applies to the whole company. A procurement requirement may be limited to the service the client buys. That determines your scope and therefore your costs.
Presenting a self-declaration as a certificate. A self-assessment is useful, but it is not a certificate. Describe it as such.
Example: two companies, two outcomes
Consider two fictional SaaS companies that both process customers’ personal data. The first is a small accounting tool with ten clients, all small and medium-sized businesses. The second is a personnel administration platform whose clients include public tender bodies in healthcare.
The first company receives no certificate requirement from any client. Its clients do ask for a data processing agreement and an answer to a questionnaire. The company records its processing register, carries out a DPIA for the payroll integration and uses the checklist as an internal test. For this company, a certificate is not necessary at this time.
The second company finds the requirement “ISO/IEC 27701 certificate, valid on the date of award” in the tender documents. Here it is mandatory, within that contract. The company starts with a baseline assessment, chooses an accredited certification body and schedules the audit well before the award.
The same GDPR, two different answers. The difference lies in the client’s requirement, not in the law.
If you are unsure whether your client really requires a certificate, ask them directly. A short email asking “Is an ISO 27701 certificate a hard requirement, or do you also accept a self-assessment?” usually produces a clear answer. Keep that answer with your contract.
Frequently asked questions about mandatory status
May I say we are GDPR-compliant without a certificate? You may, but be specific about what you have done. Name your measures, your register and your procedures. A general claim of compliance without evidence is a risk, especially towards clients.
Does an ISO 27001 certificate count as evidence for privacy? Partly. ISO 27001 concerns information security. Privacy-specific measures such as data subjects’ rights and retention periods do not automatically fall under it. The difference is set out on ISO 27701 vs ISO 27001.
Do I need to obtain a certificate for a tender that asks for “privacy certified”? Read the exact wording in the tender first. If in doubt, ask the contracting authority in writing which standard and which version they mean. That prevents you from starting a project that was not requested.
Next steps
If there is a genuine requirement, start with the baseline assessment and then move on to costs and timeline. Have you not yet read the requirement? Do that first. Many projects start too early because nobody has read the requirement texts.
You will find more questions that often come up together on frequently asked questions.
Sources
- Article 42 GDPR (gdpr-info.eu) – on voluntary certification
- Dutch Data Protection Authority (Autoriteit Persoonsgegevens) – the GDPR in brief
- NEN – the Dutch standards publisher for ISO 27701