ISO 27701 certification
Is ISO 27701 mandatory?
No law requires you to hold an ISO 27701 certificate. It becomes mandatory in practice when a customer, a tender or a supplier questionnaire asks for it. If that has just happened to you, you can take the self-assessment online and receive the certificate usually within 4 hours of passing and payment.
01: Legal position
Does the law require ISO 27701?
ISO certification is voluntary. ISO/IEC 27701 is a management system standard, not a statute, and no authority obliges a company to hold it. The Swiss revFADP and the EU GDPR set the legal duties for handling personal data. Neither text names an ISO 27701 certificate as a condition for doing business.
What the law does expect is that you know how you handle personal data. Who is controller and who is processor, what you process, how you answer a data subject, what you do after a breach. ISO 27701 describes one way to organise exactly that, which is why customers use it as a yardstick.
02: De facto required
When does ISO 27701 become mandatory in practice?
The obligation usually arrives as one sentence in somebody else's document. Five situations come up most often.
- Supplier questionnaire
- A larger customer sends its yearly questionnaire. One line asks whether you hold ISO 27701 or an equivalent. A no leads to follow-up questions you would rather avoid.
- Tender
- The tender documents list certificates as an exclusion or scoring criterion. Depending on how the buyer wrote it, you either cannot submit or you lose points.
- Customer audit
- A customer announces an audit of your processing activities. A certificate does not replace the audit, but it shows that a privacy management system exists.
- Processing agreement
- The data processing agreement or framework contract names ISO 27701 as proof of your technical and organisational measures. Signature depends on it.
- Industry expectation
- In healthcare, finance, HR services and IT outsourcing, buyers ask about privacy management as a matter of routine. Nobody has written it down as a rule, yet the question always comes.
03: Who is asked
Which businesses are asked for ISO 27701 first?
The more personal data of other people you process for a client, the sooner the request reaches you.
| Business | Why customers ask | Where the request appears |
|---|---|---|
| SaaS and cloud providers | They process customer data on behalf of others | Supplier questionnaire, security review |
| IT service providers and outsourcing partners | They have access to client systems and the personal data on them | Outsourcing contract, tender |
| Healthcare and laboratories | They handle health data | Partner onboarding, customer audit |
| HR, payroll and staffing providers | They process employee data of their clients | Data processing agreement |
| Banks, insurers and fiduciaries | They hold financial data about clients and are checked by their own partners | Due diligence, supplier assessment |
| Companies with an ISO 27001 ISMS | Security is covered, the customer now wants privacy covered too | Request to extend the existing proof |
04: Editions
Which edition of ISO 27701 applies, and what does it require?
Two editions are in circulation. The 2019 edition extends an existing ISO 27001 management system and cannot be certified without it. The 2025 edition is a stand-alone management system standard and can be certified without ISO 27001.
Zertify issues the certificate against ISO 27701:2025. If a customer's wording points to the 2019 version, a short email to the buyer clarifies whether they need a working privacy management system or an extension of an ISO 27001 certificate. Under the 2025 edition, six requirements carry most of the weight.
Determine your role
Decide for each processing activity whether you act as controller or processor. The other duties follow from that.
Assess and treat privacy risks
Identify the risks to the people whose data you hold and document how you treat them.
Maintain a record of processing activities
List what you process, for what purpose, where the data goes and how long you keep it.
Fulfil data subject rights on time
Requests for access, correction or deletion need an owner and a deadline.
Implement privacy by design and by default
New products and default settings start with the least data necessary.
Detect and notify personal data breaches
You need a way to notice a breach and to inform the right parties.
05: With Zertify
How to get ISO 27701 quickly when a customer asks
Zertify issues the certificate under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is issued. The basis is an online self-assessment, there is no on-site audit.
The certificate costs CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. It is valid for 3 years. If you also need ISO 27001, the multi-standard discount is 20% for two standards and 30% for three or more, also on the yearly fee.
Take the self-assessment
42 yes/no questions. 15 of them are mandatory requirements of the standard and must all be answered yes. Of the other 27, at least 18 must be yes.
Pass and pay
No account is needed to buy. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein.
Receive the certificate
The PDF arrives usually within 4 hours after passing and payment. It carries a certificate number and a QR code.
Send it to your customer
Purchasing can check the number or the QR code on the public verification page. No phone call to you is necessary.
06: Other route
Self-assessment or on-site audit: what to tell your customer
Some buyers expect the classic route with an on-site audit by a certification body. Read the requirement closely before you decide. If it asks for ISO 27701 certification without naming a method, a publicly verifiable certificate with a number and QR code can answer it. If it names a method, ask the buyer what they accept.
Your reply to the questionnaire can be short: the certificate number, the link to the verification page and the edition it covers. The guides below set the routes side by side.
07: FAQ
Questions about ISO 27701 being mandatory
08: Guide
Related pages
Check where you stand against ISO 27701
Answer 42 yes/no questions and see whether your privacy management meets the standard.
Free and without registration.