ISO 27701 duration: how long certification really takes

It depends on the route. The duration counts from the day you decide to certify until you hold a certificate you can send to a customer. Most of that time is not the audit itself. It is the work before it: writing procedures, collecting records and waiting for audit dates.

The classic route is measured in months. The Zertify route is measured in hours, because the assessment is online and no auditor travels to your office. The two routes differ in method, so compare them on what your customer or tender actually asks for.

• Compare the certification routes

The classic route follows a fixed sequence: preparation, documentation, a stage 1 audit and a stage 2 audit. A certification body carries out both audits, usually on site. The table shows each phase next to the Zertify route.

The durations for the classic route are indicative ranges for a company with up to a few dozen employees. Larger organisations or those with many processing activities need more time.

• What ISO certification costs

Two companies of the same size can end up months apart. These factors explain most of the difference.

Edition of the standard

The 2025 edition is a stand-alone management system standard and does not require ISO 27001. The 2019 edition extends an existing ISMS and needs one in place, which adds a whole project if you have none.

Existing ISO 27001 system

If you already run an ISMS, risk assessment, internal audit and management review exist. You add the privacy layer instead of starting from zero.

Number of processing activities

Every activity belongs in the record of processing activities. A fiduciary with a handful of client processes finishes sooner than a SaaS provider with many data flows.

Role as controller or processor

Processors need contracts and instructions from their customers in order. Chasing signed data processing agreements often takes longer than the writing.

Audit availability and findings

Certification bodies book their auditors in advance. Every nonconformity found at stage 1 or stage 2 adds a correction cycle.

Zertify replaces the on-site audit with an online self-assessment. The certificate is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before issue. The process has four steps.

1. 01

   Answer 42 yes/no questions

   The questions cover the ISO 27701:2025 requirements. Most companies need about an hour.

2. 02

   Meet the pass criteria

   15 of the questions are mandatory requirements of the standard and must all be answered yes. Among the other 27, at least 18 yes answers are needed.

3. 03

   Pay after passing

   You buy only once you have passed. No account is needed. The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit.

4. 04

   Receive the certificate

   The PDF arrives within 4 hours after passing and payment. It carries a certificate number and a QR code that leads to the public verification page.

• Start the free self-assessment
• ISO 27701 at Zertify
• See pricing

The hour of the assessment is only short if you know your own data handling. Before you begin, check six topics that the standard puts at its core: whether you act as controller or processor, how you assess and treat privacy risks, whether your record of processing activities is current, how you answer data subject requests on time, how privacy by design and by default is applied to new products, and how you detect and notify personal data breaches.

If one of these is missing, you will see it in the mandatory questions. You can start the assessment, find the gap, close it and answer again. On the classic route the same gap would surface at stage 1, weeks after you started.

The self-assessment is free and needs no registration, so you can use it as a first check without any commitment.

• ISO standards for small and medium businesses

A Zertify certificate is valid for 3 years. Each year a short online re-audit confirms that it still applies. It is included in the yearly fee.

Billing runs as an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year. Swiss and Liechtenstein customers pay prices that include 8.1% VAT. Holding two standards earns 20% off, three or more 30%, also on the yearly fee.

• How Zertify works