ISO 27701 Privacy Information Management
ISO 27701 consulting: what a consultant does and when you can go without
A consultant builds your privacy information management system and prepares you for the audit. You need one if you start with no documented processes and no capacity in-house. If your handling of personal data is already under control, the Zertify self-assessment certifies you to ISO 27701:2025 online.
01: Short answer
Do you need a consultant for ISO 27701?
No standard requires one. ISO 27701 asks for a working privacy information management system, not for outside help in building it. Who writes the documents is your decision.
The starting point matters more than the size of the company. The 2025 edition is a stand-alone management system standard and can be certified without ISO 27001. The 2019 edition extends an existing ISMS and requires one. If you already run an ISO 27001 ISMS, the management framework is in place: context, leadership, internal audit, corrective action. What remains is the privacy content.
A company with no record of processing activities, no defined role as controller or processor and no breach procedure has more to build. That is where consultants earn their fee.
02: Consultant tasks
What an ISO 27701 consultant actually does
A typical project follows the structure of the standard and the order in which gaps appear.
- Gap analysis
- Compares your current practice with the requirements and lists what is missing. This takes the first days of a project.
- Role determination
- Decides for each processing activity whether you act as controller or processor, and documents it for customer and supplier contracts.
- Record of processing activities
- Interviews the departments and writes the record: purposes, data categories, recipients, retention periods, transfers.
- Privacy risk assessment
- Assesses the risk for the people whose data you process and defines treatment measures.
- Procedures
- Drafts the processes for data subject requests, privacy by design and by default, and detection and notification of breaches.
- Training and internal audit
- Briefs staff, runs the internal audit and the management review (clause 9) and tracks corrective actions (clause 10).
- Audit support
- Collects the evidence and accompanies the certification audit if you take the classic route.
Most of the output is documents and evidence. The decisions behind them stay with your people: who owns which data, how long it is kept, who answers a data subject.
03: Cost
Typical scope and indicative day rates
The figures below are indicative ranges, not quotes. They vary by consultant, region and the state of your documentation. Day rates for privacy and information security consultants in Switzerland are indicatively CHF 1,200 to 2,000.
Fees of a certification body for an on-site audit come on top and are not part of these ranges. When you compare offers, ask which documents are delivered, how many interviews are planned and whether the internal audit is included.
| Starting point | Indicative effort | Indicative fees |
|---|---|---|
| Existing ISO 27001 ISMS, one site, small team | 5 to 10 days | CHF 6,000 to 20,000 |
| No ISMS, SME with 20 to 100 employees | 15 to 30 days | CHF 18,000 to 60,000 |
| Processor with many customers and cross-border transfers | 30 to 50 days | CHF 36,000 to 100,000 |
04: Decision
When a consultant makes sense and when it does not
Four situations come up most often among small and medium businesses.
You start from zero
No ISO 27001 ISMS, no record of processing, no breach procedure. A consultant saves months and avoids documents that nobody follows.
A tender demands the classic route
If a customer's tender explicitly asks for an on-site audit by a certification body, the self-assessment route does not meet that requirement.
Your processing is complex
Special categories of data, many sub-processors or transfers to several countries call for legal and technical advice, not only a checklist.
You already run an ISMS and have a data protection lead
The structure exists and the knowledge is in the house. A consultant adds cost here without adding much.
05: Zertify
How Zertify certifies you without a consulting project
The Zertify self-assessment for ISO 27701:2025 has 42 yes/no questions. 15 of them are mandatory requirements of the standard and must all be answered yes. Of the other 27, at least 18 must be yes. The questions follow the standard: your role as controller or processor, privacy risks, the record of processing, data subject rights, privacy by design and by default, breach detection and notification.
SICE reviews every assessment. Once you have passed and paid, Zertify issues the certificate within 4 hours, under licence from SICE. There is no on-site audit. The PDF carries a number and a QR code, so a purchasing department that sent you a supplier questionnaire can check it on the public verification page. A short online re-audit each year confirms the certificate, which is valid for 3 years.
The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the online re-audit. It is a yearly subscription. You can cancel at any time in the customer account to the end of the current year, and the certificate then ends with the paid year. Two standards get 20% off, three or more 30%, also on the yearly fee. You do not need an account to buy. For customers in Switzerland and Liechtenstein the prices include 8.1% VAT.
The assessment is a statement about your own organisation. Answer yes only where the process exists and you can show it. If the gaps are real, close them first, with a consultant if you need one, and take the assessment afterwards.
06: FAQ
Questions about ISO 27701 consulting
07: Guide
Related pages
Check where you stand on ISO 27701
Answer 42 yes/no questions and see whether your privacy management meets the standard.
Free and without registration.