ISO 27701

Privacy Information Management System

An extension to ISO 27001, use this Standard to ensure the privacy of the personal information you process.

Build confidence within and outside your business with ISO 27701. 

As an internationally recognised Standard, ISO 27701 demonstrates to staff, suppliers, contractors and customers that you have processes in place to help you comply with privacy laws when processing personal information or PII (personally identifiable information).

Based on the requirements of ISO 27001, it includes a set of privacy-specific requirements and controls that help you to create a Privacy Information Management System that will ensure your business is fully equipped to safely manage, process and control personal information.

A silver laptop with black keys

What is ISO 27701?

ISO 27701 has been created as an extension to the Information Security Management Standard (ISO 27001) and specifically looks at the protection of privacy and how businesses manage personal information. 

With a wider application compared to other Standards, such as BS 10012, it helps businesses to comply with multiple privacy regulations, such as the EU GDPR (General Information Protection Regulation).

It acts as an enhancement to ISO 27001, enabling businesses to put in place a system that will help them assess, react to, and reduce risks that are linked to the collection, management and processing of personal information. When combined in this way, the two Standards create a Privacy Information Management System (PIMS).

The benefits of ISO 27701

Protecting personally identifiable information (PII) is extremely important. Everyone now has the right to decide how their personal information is managed and organisations have a legal obligation to respond. Technology also makes it easier to transfer such information, making it more readily available – and vulnerable. 

ISO 27701 strengthens confidence in a business’ privacy management both inside and outside the business, enhancing its reputation and helping it to avoid large fines for breaches.

ISO 27701 also brings the following benefits:

  1. Supports compliance with a range of privacy regulations, such as the EU GDPR and UK DPA (Data Protection Act) 2018
  2. Defines key roles and responsibilities among those who create, collect and process personal information (data controllers and data processors)
  3. Facilitates the secure transfer of information and PII between different organisations and countries
  4. Builds trust among customers, suppliers and stakeholders for closer and more effective business agreements
  5. Ensures the context of PII processing is understood and accounted for in order to aid organisations in responding to relevant jurisdictional differences
  6. Thanks to its common framework, it can be easily integrated with other popular systems, such as the Business Continuity Standard (ISO 22301)
  7. Reduces the likelihood of expensive fines for breaches of privacy laws
  8. Enhances a business’ global reputation

Unlike the UK-centric BS 10012, the international recognition of this Standard also means that it can help to ensure compliance in any geographic location. So, if your business is active across the globe, ISO 27701 will equip you with the right framework to meet all kinds of privacy laws.

How much does ISO 27701 cost?

The cost of ISO 27701 depends on several factors. These include your sector, annual turnover, and the number of offices and employees you have.

The price will also depend on whether you have already implemented and achieved certification to ISO 27001. This is because ISO 27701 is an extension of this Standard and the requirements for ISO 27701 go across eight different clauses and six annexes.

If you don’t already have an ISO 27001 information security management system in place, this does not mean you cannot achieve certification. You simply need to implement it at the same time as the ISO 27701, forming a combined ISO 27001/ISO 27701 management system. 

To get an idea of price, add your details to our free quote calculator.

  • Product of Interest

  • Company Information

  • Contact Details

    • Please fill this in
      • Other Products

    • Annual Turnover
      Please fill this in
      £0 to £75,000
    • Company Name
      Please fill this in
    • Sector
      Please fill this in
    • Total Staff
      Please fill this in
      0 to 5
    • Number of Offices
      Please fill this in

    • First Name
      Please fill this in
    • Last Name
      Please fill this in
    • Phone Number
      Please fill this in
    • Your Email Address
      Please fill this in

By submitting this form, you are agreeing for QMS to retain the information provided and to contact you about this quotation. Learn more

The requirements of ISO 27701

ISO 27701 has an Annex SL structure, which means it has a structure of 10 clauses that form the following requirements when grouped together.

  1. Management responsibility – The areas your management team need to focus on and be accountable for within the Privacy Information Management System.
  2. Resource management – How your business’ resources can be used to ensure the best performance.
  3. Privacy security – How your business will control and process personal information to ensure it remains protected.
  4. Measurement, monitoring and improvement – How you can check that your Privacy Information Management System is working and how you can ensure improvements are made.

Frequently Asked Questions

Can I get ISO 27701 as a standalone product?

Will I have to have separate audits for ISO 27001 and ISO 27701?

Do I have to have ISO 27001 in place before I can get ISO 27701?

Does it confirm legal compliance to GDPR?

Who needs ISO 27701?

How much does ISO 27701 cost?

Why is ISO 27701 certification important?

How long will the ISO 27701 certification process take?

Is ISO 27701 a legal requirement?

Why was ISO 27701 created?

Why should I apply for ISO 27701 certification?

I have ISO 27001, but it wasn’t created by QMS. Can I still get ISO 27701?

ISO 27701 Certification Process

Becoming certified to ISO 27701 is a straightforward process, whether you are adding it to your existing ISO 27001 system or are implementing both.

If you already have ISO 27001, the process will be a little quicker as you will already have some supportive frameworks in place. However, you will still go through the same three-step process as businesses that are implementing both Standards at once.

During the process, our consultant will also identify your business and team members as information controllers, processors or both. This will depend on whether you are the person (or business) who determines the purposes for which, and the way in which, personal information is processed, or the person (or business) who processes personal information on behalf of the information controller. This early classification will remove unnecessary complexity.

    Gap Analysis

    A QMS Consultant will visit your Organisation to review and document your current processes and procedures, highlighting any areas that do not meet the requirements of the Standard.

    3 Step Certification


    Now its time to make sure any required process or procedural changes are made, as highlighted in the Review. QMS can provide templates to assist you in doing this.

    3 Step Certification


    An Auditor must now visit your Organisation to check that the documented processed are being followed and that the necessary changes have been made. Once they are satisfied, you will be rewarded with your certification.

    3 Step Certification

Once you have achieved certification the certification cycle will commence. This is made up of surveillance and re-certification audits, one of which must take place each year, around the anniversary of your certification. These visits confirm your continued compliance with the Standard and verify the validity of your certification.

Get connected 24/7

Our digital management platform, QMS Connect, means that you can take control of your management systems at any time, in any place.

Equipped with simple navigation, real-time reporting and a collection of guides and videos to help you, QMS Connect is a secure and convenient platform for uploading and amending documents, assigning tasks and accessing a helpdesk ticketing system.

It also helps you engage your teams, capturing information that can hone your business decisions for more repeat customers and better customer satisfaction.

A screenshot of the QMS Connect system on various platforms from desktop to mobile

Latest ISO 27701 news

At QMS we are constantly updating our approach and process to meet the latest changes in how ISO 27701 works.

    What should be included in an information security policy?

    Information security policies form the foundation of an organisation’s security and are featured as part of ISO 27001’s controls. But what are they and what should they include?


    How does ISO 27001 help to protect your organisation?

    ISO 27001 is the international Standard for information security but how does it work to protect your organisation and its information?


    Our SME cyber security report is live!

    With cyber security becoming a hot topic due to the rise in remote working, we set out at the beginning of 2021 to find out how vulnerable SMEs are to cyber-attack, and what they are doing to protect themselves.



QMS International use cookies to provide you with a better site experience, enable features and to help us understand how our website is being used.

By continuing, you consent to the use of cookies in accordance with our Cookie Policy

Allow All Cookies

Allow Strictly Necessary Cookies Only