ISO 27701 step-by-step plan: from zero to certificate

1. Baseline measurement and gap analysis

Start with an honest baseline measurement. What do you already have? A processing register? A privacy policy? Agreements with suppliers? Compare your current situation with the requirements of ISO 27701. That tells you what is still missing.

Also determine your role in this phase: are you a controller, a processor, or both? Your role determines which of the 78 controls apply to you. Getting the role wrong means you build the wrong things.

Do you already have ISO 27001? Then ask your adviser to also check which security processes you can reuse. You then do not need to rebuild the internal audit, the risk process or the management review.

2. Define scope and context

Clause 4 of the standard asks you to describe what falls within the scope of your PIMS. Which personal data do you process, for whom, and for what purpose? A payroll processor writes: wage data of employees of clients, processed on their behalf as a processor.

Be specific. “All personal data in our organisation” is too vague and makes certification harder. Define your scope and justify that choice. The standard also asks you to describe the internal and external factors that affect your privacy processing, such as supervisory authority policy or client contract requirements.

3. Build the processing register

The processing register is mandatory under the Algemene Verordening Gegevensbescherming (AVG, General Data Protection Regulation), Article 30, and is a core part of your PIMS. For each processing activity, you record: which data, what purpose, which lawful basis, how long you keep it, who has access, and whether processors are involved.

Keep it manageable. A simple spreadsheet or a lightweight tool works fine. Four processing activities documented well are better than twenty kept half-heartedly. The register is also a living document: update it when you launch new services or when processes change. A completed example is on processing register with example.

4. Privacy risk analysis and DPIA alignment

In clause 6 you carry out a privacy risk analysis. It looks different from a standard security analysis: you place the data subject at the centre. What are the consequences if data leaks, for the people behind the data? What if you keep data for too long?

For high-risk processing, the GDPR also requires a data protection impact assessment (DPIA). ISO 27701 deliberately aligns with that. If you carry out a DPIA as part of your implementation, it meets the requirements of the standard at the same time. You can read when a DPIA is mandatory and how to build one on carrying out a DPIA. You can read more about the relationship between a DPIA and ISO 27701 on GDPR and ISO 27701.

5. Choose controls and write the statement of applicability

Annex A of ISO 27701 contains 78 controls, split into three groups: 31 for controllers, 18 for processors, and 29 for both. Based on your role and the risk analysis, you choose which controls apply and how you implement them.

You record this in a statement of applicability: for each control, you justify whether you apply it, in what form, and why. This is also how it works for ISO 27001. The auditor uses this document as a guide, so make sure it matches practice.

Read the full requirements per group of controls on requirements of ISO 27701.

6. Implement the PIMS and let it run

Now you put the agreed processes into practice. Is the privacy policy published? Are the procedures for data subject requests documented and tested? Are supplier agreements (processor agreements) in order? Has training been given to staff?

Make sure the system has been running for at least a few months before the external auditor arrives. You then have something to show: meetings, incident records, management decisions. A PIMS that is one week old will not survive the audit.

7. Internal audit and management review

Carry out an internal audit: check whether the system works as intended. Record findings, not to hide them, but to resolve them. The auditor wants to see that the organisation can correct itself.

Then hold a management review. Management discusses the results of the audit, how the system performs and the objectives for the coming year. This is an ISO requirement, not a formality. Record the discussions.

8. Certification audit stage 1 and stage 2

The certification audit has two stages. In stage 1, the auditor reviews your documentation: are the requirements understood, is the scope clear, is the statement of applicability complete? This is a readiness check, not a final verdict.

In stage 2, the auditor checks whether the system works in practice. Are processes followed? Are staff aware of their privacy roles? Have findings from the internal audit been addressed? The full audit process is on the audit process for ISO 27701.

9. Maintenance and annual surveillance audit

You are not finished after certification. Every year the auditor returns for a surveillance audit. That is smaller than the certification audit, but it is serious. You show that the system keeps running.

After three years, recertification follows. Keep your register, policy and risk analysis up to date. Do you change your services or processing? Then update the documentation straight away. A system that stagnates will fail the surveillance audit.