ISO 27701 benefits for your business

A customer who hands you personal data wants to know who is responsible for what. That data may be payroll files, patient records or user accounts. The certificate answers with a standard instead of a promise. It shows that you have determined whether you act as controller or processor, assessed the risks to the people behind the data and set up a way to deal with their requests.

The people who read it differ from company to company, and so does what they look for.

Purchasing department

Wants a document it can file with the supplier record. A certificate with a number is easier to file than a paragraph in an email.

Data protection officer

Looks for evidence that your role, your risk assessment and your breach process exist. The certificate points to a system, not to a single policy.

Customer audit

Starts with the question of whether a recognised privacy standard is in place. A valid certificate lets the auditor skip the basics and go to the details.

• About ISO 27701

Privacy questions come back in the same form every time: a supplier questionnaire, a tender criterion, a data processing agreement that needs annexes. Without a certificate, each one means writing a fresh answer and often a fresh round of clarification. With one, you attach the certificate and the verification link and answer the remaining questions on the specifics.

The certificate does not win a tender by itself. It removes a reason to be ranked lower.

• ISO for small and medium businesses

Working through the standard forces decisions that many companies postpone. Who answers when a customer asks for their data? Where is it written down which systems process which data? The six core requirements each remove a recurring source of rework.

1. 01

   Role as controller or processor

   Once set, it decides which contracts you need and who instructs whom. You stop renegotiating the same point with every customer.

2. 02

   Risk assessment and treatment

   Privacy risks are listed once, rated and given an owner. New projects start from this list instead of from zero.

3. 03

   Record of processing activities

   One maintained record replaces the scattered spreadsheets that surface when a customer or authority asks.

4. 04

   Data subject rights on time

   A defined path for access and deletion requests means the person who receives the email knows what to do next.

5. 05

   Privacy by design and by default

   Product, IT and HR check privacy at the start of a change, not after the release.

6. 06

   Breach detection and notification

   Staff know what counts as a breach, whom to tell and how fast. The clock does not start with a search for responsibilities.

It reduces the risk of improvised handling. Privacy incidents tend to get worse when nobody knows who decides, which data is affected or when the notification is due. The standard puts those answers in writing before anything happens.

The standard is built to help organisations demonstrate accountability under the Swiss revFADP and the EU GDPR. It does not replace legal advice, and a certificate is not a statement that every processing operation in your company is lawful. What it gives you is a traceable system and records that show how you decided.

The 2025 edition is a stand-alone management system standard. You can certify against it without ISO 27001. If you already run an ISO 27001 ISMS, the two fit together, because both follow the same high level structure from clause 4 Context to clause 10 Improvement.

• ISO 27001 information security

Every Zertify certificate carries a number and a QR code on the PDF. Anyone who scans the code or enters the number lands on a public verification page that confirms the certificate is valid. This is what makes the document usable outside your own website: a reader does not have to trust your PDF, they can check it.

Put it where privacy questions arise. Add the certificate to quotes and tender annexes, link the verification page from your trust or security page, and mention the number in the footer of your standard data processing agreement. In an email signature, a short line with the link is enough.

Use the wording as it stands: certified under ISO 27701:2025 by Zertify. Do not imply a different issuer or a broader scope than the assessment covered.

You complete an online self-assessment with 42 yes/no questions. Fifteen of them are mandatory requirements of the standard and must all be answered yes. Of the other 27, at least 18 must be yes. There is no on-site audit. SICE reviews every assessment, and Zertify issues the certificate under licence from SICE. It arrives within 4 hours of passing and payment.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years and confirmed every year by that short re-audit. The subscription renews automatically and can be cancelled at any time to the end of the current year in your customer account. Cancel, and the certificate ends with the paid year. Taking 2 standards earns 20% off, and 3 or more earn 30%, also on the yearly fee. You do not need an account to buy.

Some buyers insist on an on-site audit by a certification body. If your customers are among them, compare the routes before you decide.

• Start the free self-assessment
• See pricing
• Compare the certification routes