ISO/IEC 27701:2025
ISO 27701 without audit: certificate based on an online self-assessment
You answer 42 yes/no questions online instead of hosting an auditor at your premises. SICE reviews every assessment, and Zertify issues the certificate under licence from SICE once you have passed. You get a document you can attach to a supplier questionnaire, a quote or a tender.
01: Principle
How does an ISO 27701 certificate work without an on-site audit?
In the classic route, an auditor comes to your office, interviews staff and reads your records. With Zertify, the same subject matter is put to you as a self-assessment. You answer on the basis of what your company actually does with personal data.
The questions follow the standard. Of the 42, fifteen are mandatory requirements and all of them must be answered yes. Among the other 27, at least 18 yes answers are needed to pass.
Your answers are not taken at face value. SICE reviews every assessment before a certificate is issued. The self-assessment replaces the visit and the scheduling. It does not replace the work: you still need to know your processing activities, your role and your procedures for data subject requests.
02: Content
What does the self-assessment ask about?
The questions are grouped around the core requirements of a privacy information management system. These six areas carry the most weight:
- Controller or processor
- You state which role your company plays for each type of personal data, since the obligations differ.
- Privacy risks
- You assess risks to the people whose data you handle and decide how to treat them.
- Record of processing activities
- You keep a current record of what data is processed, why, and who receives it.
- Data subject rights
- Requests for access, correction or deletion are answered within the deadline, and you can show how.
- Privacy by design and by default
- New products, forms and systems start with the least data needed.
- Personal data breaches
- You can detect an incident and notify the right parties in time.
The 2025 edition of ISO/IEC 27701 stands on its own. You do not need an ISO 27001 certificate to be certified against it.
03: Certificate
What does the certificate confirm?
It confirms that, based on your self-assessment as reviewed by SICE, your organisation meets the requirements of ISO/IEC 27701:2025 for a privacy information management system. The PDF carries a certificate number and a QR code. A customer or purchasing department scans the code and lands on the public verification page.
The certificate is valid for 3 years. Each year a short online re-audit confirms that your answers still hold.
What it does not do: it is not a legal opinion. It documents that you run a structured system for handling personal data, which helps you show accountability under the revFADP and the GDPR. Specific legal questions still belong with your lawyer or data protection adviser.
04: Fit
Which companies suit a certificate without an on-site audit?
The route fits small and medium businesses that are asked for proof of privacy management, usually by a customer, and want it in days rather than months. These groups ask for it most often:
- SaaS and cloud providers
- Customers want evidence before they upload their own client data.
- IT service providers
- Outsourcing partners answer privacy sections in almost every supplier questionnaire.
- Healthcare and laboratories
- Patient and test data call for documented handling and clear responsibilities.
- HR, payroll and staffing
- You process employee data on behalf of other companies.
- Banks, insurers and fiduciaries
- Clients expect documented controls over financial and personal records.
- Companies with an ISO 27001 system
- You already have the security side and add the privacy layer.
If a contract explicitly requires an on-site audit by a certification body, check that clause before you buy. Whether a particular customer accepts a certificate is the customer's decision.
05: Comparison
ISO 27701 without audit or with the classic audit: time and cost
The classic route gives you an external auditor on site, which some contracts require. The Zertify route gives you a verifiable certificate at a fraction of the effort. Your customers and contracts decide which one you need.
| Criterion | Zertify | Classic route |
|---|---|---|
| Method | Online self-assessment, reviewed by SICE | On-site audit by a certification body, usually in two stages |
| Time to certificate | Within 4 hours after passing and payment | Indicative: several weeks to several months from booking |
| Cost | CHF 799 in the first year, then CHF 529 per year including the yearly online re-audit | Indicative: several thousand francs for audit days and certificate, plus internal time |
| Your effort | Answer 42 questions, no visit to host | Audit dates, interviews, accompanying the auditor |
| Yearly check | Short online re-audit | Surveillance audit during the certificate cycle |
| Verification | Public page by number and QR code | Depends on the certification body |
06: Zertify
How Zertify issues the ISO 27701 certificate
Zertify issues the certificate under licence from SICE. The process has four steps:
Start the self-assessment
It is free and needs no registration. You can see the questions before you decide.
Answer the 42 questions
All 15 mandatory requirements must be yes, plus at least 18 yes among the other 27.
Pay and wait for the review
SICE reviews the assessment. After you have passed and paid, the certificate follows within 4 hours.
Use the certificate
Send the PDF with its number and QR code to customers, or link to the verification page.
Billing is a yearly subscription with no account needed to buy. Multi-standard discounts apply if you certify against more than one standard. The standard page lists the requirements in detail.
07: FAQ
Questions about ISO 27701 without audit
08: Guide
Related pages
Check whether your company passes
Answer the 42 questions for ISO 27701 and see your result before you pay anything.
Free and without registration.