ISO 27701:2025
ISO 27701 process: from self-assessment to certificate
You answer 42 yes/no questions online. Once you have passed, SICE reviews the assessment and you receive a certificate that anyone can verify. There is no on-site audit and no audit date to wait for. This page walks through each step and compares the route with the classic one.
01: Steps
The ISO 27701 process in six steps
The whole process runs online. Nobody visits your office, and you need no account to buy.
Start the self-assessment
Open the questionnaire for ISO 27701:2025. It is free and needs no registration.
Answer 42 yes/no questions
Each question refers to a requirement of the standard. Answer from your actual practice, not from what you plan to introduce.
Meet the pass rule
All 15 mandatory requirements need a yes. Of the other 27 questions, at least 18 need a yes.
SICE reviews the assessment
SICE checks every assessment before a certificate is issued. A certificate is never issued automatically on the strength of the answers alone.
Pay and receive the certificate
After you have passed and paid, G6 Agency AG issues the certificate under licence from SICE. It arrives as a PDF with a certificate number and a QR code.
Share it and keep it valid
Attach the PDF to quotes and supplier questionnaires. Each year a short online re-audit confirms the certificate.
02: Assessment
What the self-assessment asks
The questions follow the structure of the standard, from context in clause 4 to improvement in clause 10. They apply whether your company acts as a controller or as a processor of personal data. The core topics are these:
- Role
- You have determined whether you act as controller, processor or both for each processing activity.
- Privacy risks
- You assess risks to the data subjects and decide on treatment measures.
- Record of processing
- You maintain a current record of processing activities.
- Data subject rights
- Requests for access, correction or deletion are answered on time.
- Privacy by design and by default
- New systems and processes start with the most protective settings and a minimum of data.
- Personal data breaches
- You can detect a breach and notify the right parties.
A yes should be a statement you could back with a document, a log or a written procedure. If you would hesitate to show the evidence to a customer, answer no and close the gap first.
03: Preparation
What to prepare before you start
Decide first which edition applies. ISO 27701:2025 is a stand-alone management system standard, so you do not need an ISO 27001 ISMS. The 2019 edition only extended an existing ISO 27001 system and required one. Zertify certifies against the 2025 edition.
Settle your role next. A payroll provider that handles client employee data acts as processor. The same company acts as controller for its own staff data. Both roles can apply to one organisation, and the answers differ for each.
Then gather the documents the questions refer to: the record of processing activities, the contracts with your processors, the procedure for data subject requests, the steps of your breach response and your latest privacy risk assessment. Work through them before you open the questionnaire. Answering then takes less time than looking for papers.
04: Zertify
Where Zertify fits into the process
Zertify provides the online route described above. The certificate is issued by G6 Agency AG under licence from SICE and is based on your self-assessment, not on an on-site audit. The standard itself is explained on the ISO 27701 page.
The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. Customers in Switzerland and Liechtenstein pay 8.1% Swiss VAT, which is included in these prices. The yearly subscription renews automatically. You can cancel it at any time in the customer account to the end of the current year, and the certificate then ends with the paid year.
If you certify several standards, the price falls: 20% for two standards, 30% for three or more, also on the yearly fee.
05: Verification
How the certificate is verified and kept valid
Every certificate carries a number and a QR code on the PDF. A purchasing department or an auditor scans the code or enters the number on the public verification page and sees whether the certificate is valid. Nobody has to ask you for a copy or a confirmation.
The certificate is valid for 3 years. A short online re-audit confirms it every year and is included in the yearly fee. If you cancel, the certificate ends with the year you have paid.
06: Comparison
ISO 27701 process compared with the classic audit route
The classic route means an on-site audit by a certification body. It suits companies whose customers or tenders explicitly ask for it. The figures for the classic route are indicative and vary by provider and company size.
| Aspect | Zertify | Classic route |
|---|---|---|
| Basis | Online self-assessment with 42 questions | On-site audit by a certification body |
| Review | SICE reviews every assessment | Auditors examine documents and interview staff on site |
| Time to certificate | Within 4 hours after passing and payment | Several weeks to months (indicative) |
| Cost | Published prices, first year and yearly fee | Individual quote, usually in the thousands of francs (indicative) |
| Yearly follow-up | Short online re-audit | Surveillance audits by the certification body |
| Verification | Public page by number and QR code | Depends on the certification body |
Which route fits depends on what your customers require. The guides below set out the differences in detail.
07: FAQ
Questions about the ISO 27701 process
08: Guide
Related pages
Check your ISO 27701 readiness
Answer the 42 questions and see whether you meet the pass rule.
Free and without registration.