ISO 27701 cost: what you pay and where it comes from

ISO 27701 has no list price. The total depends on where your company starts and on the route you choose. Five factors move the figure most.

Existing ISO 27001 system

The standard extends an ISO 27001 and ISO 27002 management system. If you already run one, you add privacy controls. If not, you build the security base first, and that is the largest single cost block.

Role as controller or processor

A SaaS provider acting as processor documents different obligations than a fiduciary acting as controller. Many companies are both, which widens the scope.

Number of processing activities

Every activity goes into the record of processing activities and the risk assessment. Payroll, customer support and a hosted application each take their own time.

Company size and sites

Certification bodies price their audits by headcount and number of sites. A team of 20 on one site is cheaper to audit than 200 people on three.

Consultant or in-house

External support shortens the project but adds a daily rate. Doing it alone saves the fee and costs more of your own time.

• What ISO 27701 requires

The classic route means a consultant or an internal project team, followed by a stage 1 and stage 2 audit by a certification body at your premises. The ranges below are indicative only. Quotes vary by certification body, headcount, number of sites and whether the audit is combined with ISO 27001. Ask for at least two written offers.

• Compare the certification routes

Invoices are easy to compare. Staff hours are not, yet for a small company they often outweigh the audit fee. The work falls on a few people who also run daily business.

1. 01

   Clarify roles and scope

   Decide for each service whether you act as controller or processor, and which systems and teams are in scope.

2. 02

   Build the record of processing activities

   Interview each department, list the data categories, recipients, retention periods and transfers. This takes longer than most owners expect.

3. 03

   Assess and treat privacy risks

   Rate the risks to data subjects, not only to your company, and define measures with owners and deadlines.

4. 04

   Set up data subject requests and breach handling

   Write the procedures, name responsible people and test them once with a mock request and a mock incident.

A certificate from a certification body runs for three years, but it is not paid for once. Surveillance audits fall in the years between, and recertification closes the cycle. Over a full cycle, audit fees alone can reach the mid four-digit range or more, before any consulting or internal time.

Add the upkeep that sits behind the audits: reviewing the record of processing activities, repeating the risk assessment, running an internal audit and a management review (clauses 9 and 10 of the high level structure). None of this appears on an invoice, but it takes calendar time every year.

Zertify issues the certificate through an online self-assessment. There is no on-site audit and no consultant. You answer 38 yes/no questions. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Of the other 25, at least 17 must be yes. SICE reviews every assessment, and G6 Agency AG issues the certificate under licence from SICE within 4 hours after you pass and pay.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. Over the three years of validity that adds up to CHF 1,857 (€1,857). Billing is an automatic yearly subscription. You cancel in your customer account at any time, effective at the end of the paid year, and the certificate ends with that year. Swiss and Liechtenstein customers pay 8.1% VAT, already included. You do not need an account to buy.

Combining standards lowers the price: 20% off for two standards, 30% off for three or more, also on the yearly fee. Every certificate can be checked by anyone on the verification page, by number or by the QR code on the PDF, which is what a purchasing department or a customer auditor will use.

• ISO 27701 at Zertify
• Pricing and multi-standard discount
• Start the free self-assessment

Some tenders and supplier questionnaires ask explicitly for an on-site audit by a certification body. If a customer writes that into the contract, the classic route is the answer, and the budget above applies. Read the requirement closely before you decide.

If the request is simply for an ISO 27701 certificate you can show and a buyer can verify, the online route covers it at a fraction of the cost and effort. You can also start with the self-assessment to see how far your privacy practice already goes. It is free and shows which of the 13 mandatory requirements you still miss.

• Certification without an on-site audit
• ISO certification cost in general