ISO 27701 Privacy Information Management
ISO 27701 for education: show how you handle student data
Schools, training providers and learning platforms hold grades, attendance records and photos of minors. ISO 27701 is the standard that documents how you protect that data. With Zertify you take an online self-assessment and receive the certificate within 4 hours after passing and payment.
01: Demand
Why do schools and training providers ask for ISO 27701?
Education organisations hold data that most businesses never see: grades, attendance, learning support needs, parents' contact details, photos of minors. When a school group, a university department or a corporate training buyer selects a provider, a data protection questionnaire arrives with the tender documents.
A learning platform or exam service usually processes student data on behalf of the school. The school remains responsible for that data and has to show that it chose a supplier with controlled processes. ISO 27701 gives you a recognised answer to the question "How do you handle personal data?", instead of a free-text reply that purchasing cannot compare.
The standard is built around accountability under the Swiss revFADP and the EU GDPR. A certificate does not replace legal advice. It gives the purchasing department a documented basis for its supplier file.
02: Data
Which personal data in education does the standard cover?
ISO 27701 does not care whether you teach adults or children. It asks that every kind of personal data you process is known, justified and protected. In education, these are the usual categories:
- Student records
- Enrolment forms, ID copies, grades, attendance lists and certificates of completion.
- Sensitive pupil information
- Learning support needs, medical notes for school trips, counselling notes.
- Data of minors
- Class photos on the website, messages in class chats, parental consent forms.
- Online learning and exams
- Platform login logs, recorded online exams, webcam images from remote proctoring.
- Staff and trainer data
- Employment contracts, payroll, applications for teaching posts, qualification files.
- Alumni and marketing data
- Newsletter lists, open day registrations, donor and alumni contacts.
Each of these categories becomes an entry in your record of processing activities, with purpose, recipients and retention period.
03: Requirements
How does an education provider meet the key requirements?
The requirements of the standard are abstract. In a school or training company they translate into a few concrete routines.
| Requirement | Example in education |
|---|---|
| Determine your role | A private school is controller for its pupil records. A learning platform vendor is processor for the school's classes, but controller for its own marketing contacts. |
| Assess and treat privacy risks | Before a remote proctoring tool goes live, you document what it records, who can view it and how long recordings are kept. |
| Maintain a record of processing | One entry per activity: enrolment, grading, class photos, alumni newsletter. Each with purpose, recipients and retention. |
| Fulfil data subject rights on time | A former student asks for their file. A named person, a deadline, a reply template and a log of the request are in place. |
| Privacy by design and by default | A new class chat tool is configured with parents' contacts hidden, photo sharing off and the shortest retention period. |
| Detect and notify breaches | A teacher emails the grade list to the wrong class. The reporting route, the risk assessment and the decision on notification are documented. |
In the structure shared by ISO management standards, risk assessment belongs to clause 6 Planning, the running of these routines to clause 8 Operation, and the yearly check to clause 9 Performance evaluation.
04: Roles
Controller or processor: where does your organisation stand?
The answer decides which duties apply to you and what a customer expects to see. A school, a university of applied sciences or a language academy is normally the controller for its students. A provider of school administration software, an exam platform or a tutoring marketplace is often a processor for its customers and a controller for its own staff and sales data. Many organisations are both, and the standard asks you to state this per process.
The 2025 edition of ISO 27701 is a stand-alone management system standard. You can be certified without ISO 27001, which suits a small training provider or an edtech team without an existing security management system. The 2019 edition extends an ISO 27001 system and requires one. Check which edition your customer names in the questionnaire.
05: Zertify
How do you get ISO 27701 certified with Zertify?
Zertify issues the certificate under licence from SICE, the Swiss Institute of Certification and Education. It is based on an online self-assessment. There is no on-site audit.
Take the self-assessment
42 yes/no questions, no account needed. 15 are must-meet questions and all must be answered yes. Of the other 27, at least 18 must be yes. They cover the core of the assessment, not every requirement of the standard.
SICE reviews, you pay
SICE reviews every assessment before the certificate is issued. After you pass and pay, the certificate arrives within 4 hours.
Send it to your buyer
The PDF carries a QR code. A school's purchasing department scans it or enters the certificate number on the public verification page.
Confirm it every year
A short online re-audit confirms the certificate each year. It is valid for 3 years.
The price is CHF 799 in the first year, then CHF 529 per year including the online re-audit. Whoever certifies two standards pays 20% less, three or more 30% less, also on the yearly fee. If you want to compare this with the classic route with an on-site audit by a certification body, the routes guide sets them side by side.
06: Preparation
What should you prepare before the self-assessment?
Answer the questions against what your organisation really does. Start with four documents. The record of processing activities, even as a spreadsheet. A list of the tools that touch student data, such as the learning platform, cloud storage and video conferencing, each with a data processing agreement. The retention periods for student files and application documents. The route a teacher follows when something goes wrong with data.
If one of these is missing, write it first. The assessment then takes little time, and the answers hold up when a customer asks for details.
07: FAQ
Questions about ISO 27701 in education
ISO 27701 is voluntary. A certificate becomes relevant when a customer, a tender or a contract asks for evidence of your privacy management. Check the supplier questionnaire you received.
Yes, with the 2025 edition. It is a stand-alone management system standard. The 2019 edition extends an ISO 27001 system and requires one.
It documents that your privacy management meets the core requirements of the standard and can be verified publicly. A buyer may still ask about hosting location, subcontractors or retention periods. Answer those in the questionnaire as usual.
CHF 799 in the first year, then CHF 529 per year including the yearly online re-audit. The subscription renews automatically. You can cancel at any time in your customer account, to the end of the current year, and the certificate then ends with the paid year.
The certificate is issued within 4 hours after you pass the self-assessment and pay. How long the assessment takes you depends on how well your records of processing and supplier agreements are prepared.
08: Guide
Related pages
Check whether your organisation passes
Answer 42 yes/no questions on privacy management and see at once whether you meet the requirements.
Free and without registration.