ISO 27701 for retail and trade

A supplier questionnaire from a larger buyer often contains a block on data protection. Who processes customer data on your behalf? How do you answer an access request? How quickly do you report a breach? Each of these needs more than one sentence. A certificate against ISO 27701 answers them with a single reference.

Trade companies sit in the middle of data flows. A webshop passes addresses to carriers, payment references to a payment provider and email addresses to a newsletter tool. A wholesaler holds the contact lists of its resellers. At every handover the purchasing department of your customer wants to know who is responsible for the data.

In a tender, the certificate sits next to your references and your price. It is evidence that privacy is managed as a system and not left to whoever happens to answer the questionnaire.

The 2025 edition of ISO/IEC 27701 is a stand-alone standard. You do not need an ISO 27001 certificate first, which the 2019 edition required. A retailer without an information security management system can certify directly.

• The ISO 27701 standard in detail

The standard looks at every place where personal data enters, moves through or leaves your business. In retail and trade that is a longer list than most owners expect.

Webshop accounts and orders

Name, delivery address, order history and saved payment references. Questions: how long do you keep inactive accounts, and who in the team can see order data?

Loyalty programme

Purchase profiles linked to a card or app. The risk lies in profiling and in keeping data long after a customer stops buying.

Newsletter and marketing

Consents, opt-outs and the lists you export to a mailing tool. A customer who unsubscribes must disappear from every list.

Payment and returns

Bank details for refunds, payment references from the provider, return slips with names and addresses.

In-store video surveillance

Recordings of customers and staff. You define the retention period and who may view the footage.

B2B customer accounts

Contact persons at business customers and resellers, price agreements linked to named people.

Carriers and fulfilment partners

A third-party warehouse or parcel service receives names and addresses. These partners process data on your behalf and need a clear agreement.

Staff and temporary workers

Shift plans, time recording and payroll data for shop and warehouse employees, including seasonal staff.

The standard has six core requirements. Here is what each looks like in a trading business.

1. 01

   Determine your role

   You decide per activity whether you act as controller or processor. A webshop is controller for its customers. A company that runs a checkout system for other retailers is processor.

2. 02

   Assess and treat privacy risks

   You list what could go wrong for the customer: a leaked order history, a wrongly merged loyalty profile, a returns form left at the counter. Each risk gets a measure and an owner.

3. 03

   Maintain a record of processing activities

   One table with webshop, loyalty, newsletter, video, payroll and the other processes. For each: purpose, data categories, recipients, retention period.

4. 04

   Fulfil data subject rights on time

   A named person receives access, correction and deletion requests, checks identity and answers within the deadline. The shop system must be able to export and delete one customer.

5. 05

   Implement privacy by design and by default

   A new checkout field, a new loyalty feature or a new marketing tool is reviewed before launch. Optional fields stay empty and newsletter boxes stay unticked.

6. 06

   Detect and notify personal data breaches

   Staff know whom to call when a laptop with customer lists is lost or a shop account is hacked. You decide within the deadline whether the breach must be reported.

The role determines which duties you carry. Many trading companies take both roles in the same week, depending on the activity. The table shows typical cases. For some the answer depends on the contract or the set-up, and you settle it in writing.

Zertify issues the certificate under licence from SICE, the Swiss Institute of Certification and Education. There is no on-site audit. You complete an online self-assessment, and SICE reviews every assessment before the certificate is issued. You do not need an account to buy.

The assessment for ISO 27701:2025 has 42 yes/no questions. Fifteen of them are must-meet questions, the core of the assessment, and all must be answered yes. Of the remaining 27 questions, at least 18 need a yes. These questions cover the core of the assessment, not every requirement of the standard.

The price is CHF 799 in the first year, then CHF 529 per year including the yearly online re-audit. The certificate is valid for 3 years. The yearly subscription renews automatically and can be cancelled at any time in your customer account, effective at the end of the paid year. If you cancel, the certificate ends with that year. Two standards earn a 20% discount, three or more 30%, also on the yearly fee. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein.

Every certificate can be checked publicly by number and QR code. A buyer who receives your PDF scans the code and lands on the verification page.

• Start the free self-assessment
• See pricing
• How the process works

Collect four documents: your list of processes that touch personal data, the contracts with carriers, warehouses and software providers, the privacy notice of your webshop, and the internal rule on who answers data subject requests. If one of them does not exist, write it first. That is usually a matter of days, not weeks.

If the buyer's tender names a specific route, such as an on-site audit by a certification body, check the wording before you decide. The guide on certification routes explains the differences. The guide on cost compares the Zertify price with indicative ranges for the classic route.

Smaller trading companies can read how the same logic applies to ISO standards in general in the guide for small and medium businesses.

• Compare the certification routes
• Guide on certification cost
• ISO for small and medium businesses