ISO 27701 renewal: how the certificate stays valid

Zertify issues the certificate with a validity of 3 years. Within that period you confirm once a year that your privacy information management system still matches what the certificate says. The confirmation is a short online re-audit in your customer account. No auditor visits your premises.

Every certificate has a public verification page, reachable by certificate number or by the QR code on the PDF. A purchasing department that scans the code sees the status as it is today, not as it was on the day of issue.

Validity period

3 years. The certificate shows its dates, and the verification page shows the same dates.

Yearly re-audit

A short online check, done once a year and included in the yearly fee.

Edition

The 2025 edition is a stand-alone standard and does not require ISO 27001. The 2019 edition extends an existing ISO 27001 system and requires one.

• ISO 27701 certificate

The re-audit asks whether your privacy management still works as described. It does not ask for new paperwork. Go through the points below a few weeks ahead, so that you can answer from facts and not from memory.

In terms of the standard, this is clause 9 (performance evaluation) and clause 10 (improvement) applied to your own year: what did you check, what did you find, what did you change.

1. 01

   Your role

   Check whether you still act as controller, as processor, or as both. A new product or a new customer contract can change this.

2. 02

   Privacy risks

   Review the risk assessment. Add risks from new systems, new suppliers and new data categories, and note how each one is treated.

3. 03

   Record of processing activities

   Compare the record with what is actually running. Every new tool that touches personal data needs an entry.

4. 04

   Data subject requests

   Look at the requests received during the year and at how long each one took. Late answers are a finding you should deal with yourself.

5. 05

   Privacy by design and by default

   Check that new projects went through a privacy review before launch and that default settings collect only what is needed.

6. 06

   Personal data breaches

   Read the incident log. Confirm that every breach was detected, assessed and, where required, notified in time.

Treat the due date as fixed. The certificate is meant to show that your system was confirmed within the last year, and the verification page is public. A customer who checks it during a tender sees the status as it stands.

Zertify does not promise a grace period, so do not plan around one. If you have missed a date, do the re-audit at once and contact support before you hand the certificate to a customer.

Cancelling is a different case. If you cancel the subscription in your customer account, the certificate ends with the paid year. Cancellation is possible at any time, effective at the end of the current year.

On the classic route with an on-site audit by a certification body, the three-year cycle has two kinds of audit. Surveillance audits take place in the years between, and a recertification audit closes the cycle. Each one is scheduled with the certification body and carried out by an auditor on site or remotely.

The table sets the two routes side by side. Effort on the classic route depends on company size and on the body you choose, so the figure is an indicative range.

• Compare the certification routes
• Certification without an on-site audit

Zertify issues the certificate under licence from SICE, and SICE reviews every assessment before the certificate is issued. You start with the online self-assessment for ISO 27701: 42 yes/no questions. All 15 mandatory questions must be answered yes, and at least 18 of the other 27 must be yes. After you pass and pay, the certificate arrives within 4 hours.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. Prices for customers in Switzerland and Liechtenstein include 8.1% VAT. If you hold two or three standards with Zertify, the multi-standard discount of 20% or 30% also applies to the yearly fee.

No account is needed to buy. The subscription renews automatically each year and you can cancel it in your customer account at any time.

• Start the free self-assessment
• See pricing
• About ISO 27701

Some events should not wait for the re-audit. A new sub-processor, a new product that handles customer data, a change of hosting location or a serious incident each alter the picture your certificate describes. Update the record of processing activities and the risk assessment when the change happens.

Someone also needs to own the topic. Name one person who keeps the incident log, the request log and the supplier list. In a company of twenty people, an hour per quarter is usually enough to keep these three documents current.

• ISO standards for small and medium businesses