ISO 27701:2025 Privacy Information Management
ISO 27701 online: your certificate without an on-site audit
You answer 42 yes/no questions in your browser. If you pass and pay, the certificate reaches you within 4 hours and anyone can verify it by number or QR code. This page explains each step and what to prepare.
01: Process
How to get an ISO 27701 certificate online
The whole route runs in a browser. Nobody visits your premises and you do not assemble a folder of evidence for an auditor. Five steps lead from the first question to a certificate you can send to customers.
Answer the self-assessment
You work through 42 yes/no questions on the privacy information management system. The assessment is free and needs no registration.
Read your result
The result shows at once whether you meet the pass rule. If you do not, you see which answers are missing.
Pay at checkout
You pay the first-year fee. You do not need to create an account to buy.
Receive the certificate
SICE reviews every assessment before the certificate is issued. After you have passed and paid, the PDF reaches you within 4 hours.
Share the verification
Every certificate has a number and a QR code. Both lead to a public verification page that confirms the company, the standard and the validity.
02: Preparation
What your company needs in place before you start
Check the edition first. ISO/IEC 27701:2025 is a stand-alone management system standard, so you can be certified without ISO 27001. The 2019 edition was an extension of an existing ISO 27001 system and required one. If you already run an ISO 27001 ISMS, you can build on it, but you no longer depend on it.
The standard asks how you handle personal data as a controller or processor, and whether you can show it. Six topics carry most of the weight:
- Your role
- Decide for each processing activity whether you act as controller or processor. A SaaS provider is often processor for customer data and controller for its own staff data.
- Privacy risks
- Assess the risks to data subjects, not only to your company, and decide how you treat them.
- Record of processing activities
- Keep a current list of what personal data you process, why, where it goes and how long you keep it.
- Data subject rights
- Have a defined way to answer requests for access, correction or deletion within the legal deadline.
- Privacy by design and by default
- New products and changes to existing ones are checked for privacy before launch, and the default settings collect as little as possible.
- Breach handling
- Know how you detect a personal data breach, who decides, and how you notify the authority and the people affected.
Answer the questions as your company works today. The certificate is confirmed every year by a short online re-audit, so an answer that was optimistic on day one will not hold.
03: Pass rule
How many questions do you have to answer yes?
The assessment has two parts. Fifteen questions are mandatory requirements of the standard, and every one of them must be answered yes. The other 27 questions allow some gaps.
| Part | Questions | Needed to pass |
|---|---|---|
| Mandatory requirements | 15 | All 15 answered yes |
| Other questions | 27 | At least 18 answered yes |
| Total | 42 | At least 33 yes, including all 15 mandatory |
A single no in the mandatory part means the assessment does not pass, however well the rest looks. Because the self-assessment is free, you can find the gap before you pay anything, close it, and answer again.
04: Comparison
Online certification compared with an on-site audit
The classic route means a certification body sends an auditor to your company. That has its place, but it costs calendar time and staff time before the first certificate exists. The online route removes the scheduling and the audit days.
The table sets out the differences that matter for a small or medium business.
| Aspect | Online with Zertify | Classic route with on-site audit |
|---|---|---|
| How answers are checked | Self-assessment, reviewed by SICE before issue | Auditor checks evidence and interviews staff on site |
| Time to certificate | Within 4 hours after passing and payment | Indicative range: several weeks to a few months, depending on audit dates |
| Effort in your company | One self-assessment, answered by the person who knows the processes | Audit preparation, audit days, staff taken from daily work |
| Cost structure | Published yearly price | Quoted individually; auditor days and travel vary widely |
| Yearly confirmation | Short online re-audit | Surveillance audits between certification cycles |
Some tenders and customers name a specific route in their documents. Read that wording before you decide.
05: Zertify
Where Zertify fits in and what it costs
The certificate is issued by Zertify under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is issued. The certificate is valid for 3 years and is confirmed each year by the online re-audit.
The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. Customers in Switzerland and Liechtenstein pay 8.1% Swiss VAT, which is included in these prices. If you certify two standards, you get 20% off, and 30% off from three standards, also on the yearly fee.
The fee renews automatically each year. You can cancel at any time in your customer account, effective at the end of the current year. If you cancel, the certificate ends with the year you have paid.
06: Use
Using the certificate with customers and purchasing departments
The certificate matters where someone asks for proof. A supplier questionnaire asks whether you hold a privacy certification. A tender requires evidence of how you handle customer data. A purchasing department wants to check the claim without writing to you.
Send the PDF, or send the verification link. The QR code on the PDF opens the public page for that certificate number, so the reader sees the status without asking you.
The certificate shows that your privacy information management system meets the standard. It does not replace your own duties under the revFADP or the GDPR, and it does not stop a customer from running its own audit.
07: FAQ
Questions about ISO 27701 online
08: Guide
Related pages
Check where you stand on ISO 27701
Answer the 42 questions and see at once whether your company meets the pass rule.
Free and without registration.