ISO 27701 for IT companies

An IT company rarely owns the personal data it works with. It belongs to its customers: their employees, their patients, their own clients. The customer remains responsible for that data, so the purchasing department wants to know what happens to it once it sits on your servers or in your support tool.

That is why supplier questionnaires keep growing. They ask for your record of processing activities, your list of subprocessors, your deletion rules and your procedure for reporting a breach. Answering these by hand for every new customer takes days of a senior person's time. A certificate with a number and a QR code on the PDF replaces a good part of that exchange: the customer scans it and lands on a public verification page.

Tenders follow the same logic. Some invitations to tender ask for proof of a privacy management system, others award points for it. If you act as a processor, your customer also has to show that it chose a provider with adequate safeguards under the Swiss revFADP or the EU GDPR. Your certificate is a document the customer can put in its own file.

• ISO 27701 at a glance

The standard looks at the places where personal data enters, moves through and leaves your systems. In an IT company these are fairly predictable.

The standard has six requirements that matter most in practice. Each one translates into something your team can show.

Role as controller or processor

A SaaS provider is a processor for its customers' data but a controller for its own staff and website visitors. Write down which role applies to which processing, and apply the matching obligations.

Privacy risk assessment and treatment

Assess what could go wrong for the people behind the data, not only for your systems. A misconfigured storage bucket is an IT incident, and for the data subject it is also an exposure of their personal details.

Record of processing activities

A maintained table of services, data categories, purposes, recipients and retention periods. For a managed service provider it usually has one entry per service offered.

Data subject rights on time

As a processor you must be able to pass a customer's access or deletion request through to the right system quickly. Name an owner and a route, for example a ticket category that reaches the person who can search and delete.

Privacy by design and by default

New features start with the least data collection and the most protective settings. A review step in your release process, with a short privacy question for each change, is enough to show this.

Breach detection and notification

Monitoring that can recognise personal data exposure, and a written procedure with a named person who informs the affected customer without delay.

Many IT companies assume they must hold ISO 27001 first. That was true for the 2019 edition, which extends an existing information security management system. The 2025 edition is a stand-alone management system standard and can be certified on its own.

If you already run an ISMS, you have a head start: risk assessment, internal audit and management review (clauses 6, 9 and 10 of the high level structure) exist, and you extend them to personal data. If you do not, you can still certify privacy first and add information security later.

• ISO 27001 for information security

The questions are yes or no, so you answer them faster if the facts are already on your desk.

1. 01

   List of services and data categories

   For each service, which personal data you handle and whether you act as controller or processor.

2. 02

   List of subprocessors

   Every hosting provider, support tool and subcontractor that touches customer data, with the contract that governs it.

3. 03

   Retention and deletion rule

   How long data, backups and logs stay, and who triggers deletion when a customer leaves.

4. 04

   Breach and request procedures

   One page each: who is told when personal data is exposed, and who handles an access or deletion request.

The self-assessment for ISO 27701 has 42 yes/no questions. Fifteen of them are mandatory requirements of the standard and all must be answered yes. Of the other 27, at least 18 must be yes. SICE reviews every assessment, and once you have passed and paid, Zertify issues your certificate within 4 hours.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription that you cancel in your customer account at any time, effective at the end of the current year. If you cancel, the certificate ends with the paid year. Holding two standards, for example ISO 27001 and ISO 27701, brings 20% off, also on the yearly fee. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein, and you do not need an account to buy.

There is no on-site audit. The certificate rests on your online self-assessment, is issued by Zertify under licence from SICE and is confirmed each year by a short online re-audit. Anyone can verify it by number or QR code. If you want to compare this with the classic route with an on-site audit by a certification body, the guide on routes sets them side by side.

• Start the free self-assessment
• See pricing
• Compare the certification routes