ISO 27701 requirements, clause by clause

ISO/IEC 27701 describes a privacy information management system, short PIMS. It defines how you handle personal data traceably, how you manage risks to the people behind the data and how you demonstrate accountability under the Swiss revFADP and the EU GDPR.

The 2025 edition is a stand-alone management system standard. You can certify against it without ISO 27001. The 2019 edition was an extension of an existing ISMS and required ISO 27001. When a supplier questionnaire asks for ISO 27701, check which edition the customer means.

The requirements apply to controllers and processors alike. A payroll provider is a processor for the salary data of its clients and a controller for the data of its own employees. Both roles can sit in one company, and the standard expects you to name which one applies to which activity.

• Compare the routes to certification

The management system clauses follow the high level structure used by ISO 9001 and ISO 27001. Clauses 1 to 3 cover scope, references and terms. The requirements you have to meet are in clauses 4 to 10.

Clause 4, Context

Define the scope of the PIMS, the parties with an interest in your data handling and the privacy laws that apply to you. Decide per processing activity whether you act as controller or processor. Typically documented: scope statement, list of roles, register of applicable laws such as revFADP and GDPR.

Clause 5, Leadership

Management takes ownership. It approves a privacy policy and assigns responsibilities. Typically documented: privacy policy signed by management, description of the role of the privacy lead or data protection advisor.

Clause 6, Planning

Identify risks to data subjects, decide how to treat them and set privacy objectives. The question is what could happen to the person whose data you hold, not only to your company. Typically documented: risk assessment, risk treatment plan, objectives.

Clause 7, Support

Provide people, time and budget, make sure staff know what to do with personal data and control your documents. Typically documented: training and awareness records, competence evidence, document control rules.

Clause 8, Operation

Run the processes you planned. This is where the daily work sits: record of processing activities, data subject requests, privacy by design, processor contracts and breach handling. Typically documented: the record itself, a request log, a breach log, data processing agreements.

Clause 9, Performance evaluation

Measure whether the system works. Run an internal audit and hold a management review. Typically documented: internal audit report, management review minutes, simple indicators such as the time taken to answer access requests.

Clause 10, Improvement

Correct what went wrong and improve the system. Typically documented: list of nonconformities with the corrective action taken and the date it was closed.

Behind the clauses, six topics carry most of the weight. They also decide whether a customer's data protection officer is satisfied with your answers.

Most small companies already do part of this work without writing it down. The gap is usually the paperwork, not the practice.

1. 01

   Map your personal data

   List which systems hold personal data, whose data it is, and which suppliers receive it. A spreadsheet is enough.

2. 02

   Fix your roles

   Mark each activity as controller or processor and check that the contracts with clients and suppliers say the same.

3. 03

   Write the core documents

   Privacy policy, record of processing activities, risk assessment. Keep them short and name an owner for each.

4. 04

   Test the procedures once

   Run a mock access request and a mock breach. Note how long each took and who was involved. The result also feeds your first internal audit.

• What certification costs

The Zertify certificate for ISO 27701:2025 rests on an online self-assessment with 42 yes/no questions. 15 of them are mandatory requirements of the standard, and all 15 must be answered yes. Of the other 27 questions, at least 18 must be answered yes. Answer yes only where the document or process exists in your company. SICE reviews every assessment, and Zertify issues the certificate under licence from SICE.

After you pass and pay, the certificate arrives within 4 hours. It carries a number and a QR code, and anyone can check it on the public verification page. The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years.

• Start the free self-assessment
• ISO 27701 certificate at Zertify
• See pricing