Who is ISO 27701 relevant for?
ISO 27701 is intended for organisations that process personal data on a structural basis and need to demonstrate that they do so. Think of SaaS companies that process customer data in the cloud, hosting providers that manage data on behalf of others, or HR service providers that process payslips for thousands of people. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) expects such organisations to be able to substantiate their privacy compliance. You can find the standard itself at ISO and via NEN . To find out which role you have in the processing, read processor or controller.
Target groups by type of organisation
| Type of organisation | Typical role | Why ISO 27701 helps |
|---|---|---|
| SaaS and software companies | Processor for customer data | Demonstrates compliance in enterprise deals and tenders |
| Hosting and cloud providers | Processor | Meets data processing agreements and Article 28 GDPR |
| Healthcare IT and care providers | Controller and/or processor | Health data, can be combined with NEN 7510 |
| Marketing and HR service providers | Controller or processor | Large volumes of personal data, builds client trust |
| Payroll service providers | Processor | Provable processing of payroll data |
| Organisations in tenders | Processor or controller | Privacy requirements in vendor assessments and tenders |
SaaS and software companies
SaaS companies are processors for their customers’ data. Enterprise customers and government buyers increasingly set requirements for privacy certification. An ISO 27701 certificate shortens the conversation in a sales process: you do not have to complete an extensive questionnaire every quarter. Your certificate speaks for itself.
In addition, Article 28 of the GDPR requires the controller to work only with processors that provide “sufficient guarantees”. An ISO 27701 certificate is a strong way to give that guarantee.
Processors and hosting providers
Data centres, cloud providers and hosting companies process data for dozens or hundreds of clients. Those clients must be able to show that they work with reliable processors. An accredited ISO 27701 certificate gives them that assurance.
Read more about the obligations that come with your role as a processor on processor or controller.
Healthcare IT and care providers
Health data is a special category of data under the GDPR. The risk of high fines after a leak is greater, and so is the care that is expected. Healthcare IT companies often combine ISO 27701 with NEN 7510, the Dutch standard for information security in healthcare.
ISO 27701 then adds the privacy dimension: not only security, but also lawful processing, patients’ rights and transparency. In the 2025 version, health data and biometric data are explicitly included in the scope of the standard.
If you work in healthcare and handle information security and privacy, an integrated system with NEN 7510, ISO 27001 and ISO 27701 is more efficient than three separate projects. The standards share the same basic structure.
Marketing and HR service providers
Agencies that recruit for clients, temporary employment agencies, payroll administrators and HR platform providers process large amounts of personal data. Names, citizen service numbers, salary data and sometimes health data. Their clients are controllers who must be able to show that their processors are reliable.
ISO 27701 gives HR and marketing service providers independent confirmation that their privacy house is in order. That is a sales argument and a protection in the event of incidents.
Organisations in tenders and vendor assessments
Suppliers to government, banks and other regulated sectors increasingly receive questionnaires about privacy management. An ISO 27701 certificate replaces or simplifies those questions. In European tenders, it is accepted as evidence of “appropriate technical and organisational measures”.
When is ISO 27701 not (yet) necessary?
To be honest, not every organisation needs it.
- You process little personal data, and it is not sensitive data about your own staff and a small customer list.
- You face no external pressure: no clients asking for it, and no tenders requiring it.
- You are a sole trader or a small agency with limited data flows.
In such cases, GDPR compliance can be arranged well without certification. The standard helps when you want to demonstrate compliance to third parties, not as an internal management tool.
ISO 27701 is not a legal GDPR certificate. It demonstrates that privacy is structured in a verifiable way, but it does not take over your legal responsibility. Read how this works exactly on GDPR and ISO 27701.
ISO 27701 has become more accessible
Before 2025, you first had to hold ISO 27001 to be able to obtain ISO 27701. That made the threshold high. Since the 2025 version, ISO 27701 is a standalone standard. You can start directly. That makes it relevant for a broader group, including organisations that do not need an extensive information security system.
Read on costs and timeline whether ISO 27701 also fits your budget.
Next steps
Which role do you have?
Processor or controller?How does the standard relate to the GDPR?
GDPR and ISO 27701What does the certificate cost?
Costs and timelineCombining with information security.
ISO 27001 (hub)For healthcare organisations.
NEN 7510 (hub)Overview of ISO 27701.
Back to the hubSources
- Dutch Data Protection Authority (Autoriteit Persoonsgegevens) – Dutch supervisory authority for personal data
- NEN – Information security and privacy – Netherlands Standardization Institute
- ISO/IEC 27701 at ISO – International Organization for Standardization