ISO 27701 checklist for small and medium businesses

ISO/IEC 27701 describes a privacy information management system (PIMS). The 2025 edition stands on its own and can be certified without ISO 27001. The 2019 edition extends an existing ISO 27001 ISMS and requires one. Check which edition your customer or tender refers to before you start.

The list below follows the high level structure of the standard, clauses 4 to 10. Each point names the evidence companies usually hold. If you can hand that document to a purchasing department or a customer audit today, tick the point. If you cannot, it goes on your work list.

• Compare the certification routes

These clauses decide what the system covers and who answers for it. Most gaps here are missing decisions, not missing tools.

1. 01

   Role as controller or processor

   Record for each service whether you act as controller or processor. Evidence: a role table per processing activity and the data processing agreements you signed with customers.

2. 02

   Scope of the PIMS

   State which services, locations and data flows the system covers. Evidence: a scope statement and a list of the services in scope.

3. 03

   Legal and contractual requirements

   List what applies to you: the revFADP, the GDPR, sector rules and customer clauses. Evidence: a requirements register with a named owner and a review date.

4. 04

   Privacy policy and responsibility

   Management approves a privacy policy and names the person responsible. Evidence: the signed policy and the appointment of the privacy lead or data protection advisor.

5. 05

   Privacy risk assessment

   Assess the risks to the data subjects, then those to your company, and decide on treatment. Evidence: a risk register with likelihood, impact and treatment decision per risk.

6. 06

   Privacy objectives

   Set objectives you can measure, such as the time taken to answer access requests. Evidence: an objectives list with owner, target and date.

Clause 8 is the longest part of the checklist, because it covers the daily handling of personal data. Auditors and customers look here first.

1. 01

   Competence and awareness

   Everyone who handles personal data knows the rules. Evidence: training attendance lists, an onboarding checklist and signed confidentiality undertakings.

2. 02

   Controlled documents

   Policies and procedures have an owner, a version and an approval. Evidence: a document register.

3. 03

   Record of processing activities

   Purposes, data categories, recipients, retention periods and transfers abroad are written down. Evidence: the record itself, updated within the last year.

4. 04

   Data subject rights

   Requests for access, correction and deletion are answered within the legal deadline. Evidence: a request log with dates received and answered, plus reply templates.

5. 05

   Privacy by design and by default

   New features and projects get a privacy review before release, and the default settings collect the minimum. Evidence: a design review checklist and impact assessments for higher-risk projects.

6. 06

   Processors and international transfers

   You know every processor and subprocessor and have contracts with each. Evidence: signed processing agreements, a subprocessor list and the transfer mechanism for data leaving Switzerland or the EU.

7. 07

   Breach detection and notification

   Staff know whom to tell, and someone decides whether to notify the authority and the data subjects. Evidence: an incident procedure, a breach register and a documented test run.

8. 08

   Retention and deletion

   Data is deleted when the retention period ends. Evidence: a retention schedule and deletion logs or ticket records.

A system that was set up once and never looked at again does not meet these clauses. They ask for dated records of review and correction.

1. 01

   Monitoring and measurement

   Track a few figures: response times for data subject requests, number of incidents, open risks. Evidence: a simple monitoring sheet filled in on a fixed rhythm.

2. 02

   Internal review

   Someone who did not write the procedures checks them against the standard. Evidence: a dated review report with findings.

3. 03

   Management review

   Management looks at results, incidents and objectives and decides on actions. Evidence: minutes of the meeting.

4. 04

   Corrective action

   Every finding and every breach leads to an action with a cause, an owner and a closing date. Evidence: an action list showing closed items.

Small companies often hold several of these in one file. A single privacy manual with a scope statement, role table and policy is enough if it is current and approved. What matters is that each document exists, has an owner and carries a date.

Once the checklist is worked through, the Zertify self-assessment is a short step. It has 42 yes/no questions on ISO 27701:2025. 15 of them are mandatory requirements of the standard and must all be answered yes. Among the other 27 you need at least 18 yes answers to pass.

After you pass and pay, the certificate arrives within 4 hours. It is issued by Zertify under licence from SICE, and SICE reviews every assessment before issue. There is no on-site audit. Each certificate can be verified publicly by number and QR code, which is what a customer or tender office will open.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years.

• Start the free self-assessment
• ISO 27701 certificate
• Pricing