ISO 27701 for service companies

A service company rarely owns the data it works with. The payroll belongs to the client, the applicant files belong to the client, and so do the ticket histories in the support queue. The client stays responsible for that data and has to prove that its supplier treats it properly.

This is why the question appears in supplier questionnaires, in tender documents and in the onboarding checklist of the purchasing department. Some ask for a certificate outright. Others ask for a description of your privacy management and accept a certificate as the shortest answer.

A certificate with a number and a QR code on the PDF saves the back and forth. The client scans the code, lands on the public verification page and sees that the certificate exists and is valid. Nobody has to wait for a reply from your office.

• ISO 27701 at a glance

ISO 27701 describes a privacy information management system. It asks where personal data enters your company, who touches it, where it goes and when it is deleted. The following areas come up most often in service businesses.

Payroll and HR services

Salary data, bank details and absence records of your clients' employees. Risk: wrong recipients, open mailboxes, files kept after the contract ends.

Staffing and temporary work

CVs, references and work permits of candidates. Risk: candidate files passed to clients without a clear basis and stored far longer than needed.

Consulting and fiduciary work

Client documents shared by email and cloud folders. Risk: former team members who still have access to project folders.

Customer support and call centres

Call recordings, ticket histories and identity checks. Risk: agents see more customer data than the task requires.

Facility and field services

Key lists, visitor logs and access badges at client sites. Risk: lists on paper or in private chats with no retention rule.

Marketing and communication agencies

Address lists, campaign data and survey results. Risk: lists reused for a second client or kept after the campaign.

The standard follows the usual management system structure: context, leadership, planning, support, operation, performance evaluation and improvement. The six requirements below are the ones where service companies most often have work to do.

Most service companies are both. When you process data on behalf of a client and follow its instructions, you act as processor. When you recruit your own staff, run your own newsletter or manage your own customers, you act as controller. The standard has requirements for each role, and your documentation should show which one applies to which activity.

As processor you also need clear contracts with your clients and a list of the subcontractors you use, such as a hosting provider or a call overflow partner. Clients often ask for exactly this list. Put it together once and keep it current.

Before you start the self-assessment, these four steps give you the material to answer the questions without guessing.

1. 01

   List your services and your role

   For each service, note whether you act as controller or processor and which client contracts apply.

2. 02

   Draft the record of processing activities

   One line per processing activity, with data categories, recipients, storage location and deletion period.

3. 03

   Write down two short procedures

   One for requests from data subjects and one for personal data breaches. One page each is enough if people follow it.

4. 04

   Check access rights

   Compare who has access to client folders and systems with who works on the account today.

You start with an online self-assessment of 42 yes/no questions. Fifteen of them are must-meet questions of the assessment and must all be answered yes. Of the other 27 questions, at least 18 need a yes. The assessment is free and needs no registration.

After you pass and pay, the certificate is issued usually within 4 hours. Zertify issues it under licence from SICE, and SICE reviews every assessment before the certificate is released. There is no on-site audit. Each year a short online re-audit confirms that your answers still hold.

The price is CHF 799 in the first year, then CHF 529 per year including the yearly online re-audit. The certificate is valid for 3 years. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein.

• Start the free self-assessment
• See pricing
• How it works

The 2019 edition of ISO 27701 was an extension of ISO 27001 and could only be certified together with an existing information security management system. The 2025 edition is a stand-alone standard. A service company without ISO 27001 can therefore certify its privacy management directly. If you already run an ISO 27001 system, much of your documentation carries over, in particular risk assessment, internal audit and management review.

The classic route means an on-site audit by a certification body, with its own scheduling and audit days. It suits companies whose clients explicitly require it. If your clients want a verifiable certificate and a clear description of your privacy management, the online route is shorter. The guide on the certification routes sets both side by side.

• Compare the certification routes
• Certification without an on-site audit
• Certification cost explained