ISO 27701:2019
ISO 27701 certification online: Privacy Information Management by self-assessment
With the ISO 27701 certificate from Zertify you show your management system to customers and purchasing teams. ISO 27701 certification works by self-assessment, with no on-site audit. It costs CHF 799 in the first year, then CHF 529 per year with an online re-audit.
- Questions
- 38
- Mandatory requirements
- all 13
- Other questions
- min. 17 of 25
- Validity
- 3 years
- First-year price
- CHF 799
01: Overview
What is ISO 27701?
ISO/IEC 27701:2019 extends an existing ISO 27001 and ISO 27002 information security management system into a privacy information management system (PIMS). The standard defines how organisations acting as controllers or processors handle personal data traceably, manage risks to data subjects and demonstrate their accountability under the Swiss revFADP and the EU GDPR.
02: Benefits
What it gives you
- Demonstrable accountability towards customers and authorities
- Structured day-to-day implementation of the revFADP and GDPR
- Faster vendor assessments and privacy questionnaires
- Clear roles as controller and processor
- Lower risk from personal data breaches
- Builds on the existing ISMS instead of a parallel system
03: Who it is for
Who is ISO 27701 for?
- SaaS and cloud providers handling customer data
- IT service providers and outsourcing partners
- Healthcare and laboratories
- HR, payroll and staffing service providers
- Banks, insurers and fiduciaries
- Companies with an existing ISO 27001 ISMS
04: Requirements
Key requirements
Determine the role as controller or processor
Assess and treat privacy risks
Maintain a record of processing activities
Fulfil data subject rights on time
Implement privacy by design and by default
Detect and notify personal data breaches
05: Demand
Who asks for ISO 27701?
ISO 27701 is asked for when customers or partners want evidence that you handle personal data in an orderly way. The standard is not legally required, but it helps demonstrate accountability under the revFADP and the GDPR.
- Corporate customers with data processing agreements
- Large companies and public buyers assess suppliers with privacy questionnaires. A documented PIMS answers many of these questions at once.
- SaaS providers and processors
- Anyone processing personal data on behalf of customers has to evidence instructions, sub-processors and deletion. The standard organises these duties in a management system.
- Sectors with sensitive data
- Healthcare, HR, finance and insurance process sensitive personal data. Customers and supervisors expect a traceable handling of risks and data subject rights.
06: Cost
What does ISO 27701 cost? Audit, consulting or self-assessment
An accredited ISO 27701 certification is audited together with ISO 27001. The figures below describe the effort for an SME with 10 to 50 employees.
| Route | Indicative range | What is behind it |
|---|---|---|
| Accredited audit | As an extension of ISO 27001, CHF 3,000 to 8,000 on top | The surcharge comes from extra audit days for privacy roles, records, data subject rights and contracts. If ISO 27001 is missing, its cost is added. |
| Consulting and implementation | CHF 8,000 to 20,000 one-off | Role clarification, record of processing activities, DPIA templates, privacy notices, processing agreements and a deletion concept. |
| Zertify self-assessment | CHF 799 in year 1, then CHF 529 per year | You check whether roles, lawful bases, records, data subject rights, notification procedures and processor duties are demonstrably settled. It does not replace legal advice in the individual case. |
All amounts are non-binding indicative ranges for Swiss SMEs, not quotes. The offers of the individual providers are what counts.
07: Duration
How long does ISO 27701 take?
With an existing ISMS you usually add ISO 27701 within a few months. Most of the effort goes into taking stock of your processing activities.
| Phase | Accredited | Zertify |
|---|---|---|
| Build up privacy management | 3 to 6 months for roles, records, DPIA, contracts and request handling | None. You rate the current state of your privacy management |
| Assessment | Extra audit days within the ISO 27001 audit, with samples from records and requests | About 30 to 40 minutes online, scored immediately |
| Certificate | Release after 2 to 6 weeks, valid within the ISO 27001 certification cycle | PDF with QR verification within 4 hours |
08: Sample questions
Sample questions from the ISO 27701 assessment
Four of 38 questions from the catalogue, and why they count.
Do you maintain a current record of processing activities with purposes, data categories, recipients and retention periods?
The record of processing activities is the basis for everything else. Without an overview of purposes and recipients, neither risks nor requests can be handled properly.
Is a data protection impact assessment (DPIA) carried out in advance for processing likely to result in a high risk?
For high-risk processing the revFADP and the GDPR require a prior impact assessment. It shows that risks were assessed before going live.
Is there a procedure to handle requests for access, rectification, erasure and data portability on time?
Access requests arrive unannounced and come with deadlines. A defined procedure keeps requests from being left unanswered.
Is there a procedure to notify personal data breaches on time to the FDPIC or the supervisory authority and to the data subjects?
After a personal data breach every hour counts. If responsibilities and reporting channels are clear beforehand, you notify on time and completely.
09: Assessment
How the assessment works
The assessment has 38 yes/no questions, online and at your own pace. 13 of them are mandatory requirements of the standard and must all be answered yes. Of the other 25 questions you need at least 17 yes.
| The questions fall into these topics: | Questions | Mandatory |
|---|---|---|
| PIMS context and scope | 4 questions | 3 |
| Privacy risks and treatment planning | 3 questions | 3 |
| Policies, roles and awareness | 3 questions | 1 |
| Protection of personal data | 5 questions | 0 |
| Incidents and suppliers | 3 questions | 1 |
| Lawfulness and accountability as controller | 6 questions | 2 |
| Data subject rights | 3 questions | 0 |
| Privacy by design and by default | 3 questions | 0 |
| Obligations as processor | 5 questions | 0 |
| Evaluation and improvement | 3 questions | 3 |
10: Price
Price and validity
First-year price
CHF 799
- From year 2
- CHF 529 per year
- Validity
- 3 years
Your customer requires an audit or an accredited certification? Clarify requirements
Included in the price
- Online assessment with 38 questions
- Certificate as PDF, issued under licence from SICE
- QR code on the PDF and a public verification page
- 3 years of validity
- Yearly online re-audit
- Support by email
The verification page shows the status, standard and validity of every certificate. Read more in the FAQ
See the sample and assessment methodChecklist
ISO 27701:2019 checklist by email
All 38 questions of the ISO 27701 self-assessment as a PDF to tick off, ordered by topic. Free, by email.
11: More standards
More standards
Many companies combine several standards. Two or more earn a discount.
- ISO 27001:2022: View standard
Information Security Management
ISO 27701 builds on the ISMS. Risk analysis, security controls and internal audits come from ISO 27001.
from CHF 849
- ISO 27018:2019: View standard
Cloud Privacy
Cloud providers that process personal data for customers complement the PIMS with the cloud-specific controls of ISO 27018.
from CHF 799
- ISO 42001:2023: View standard
AI Management System
If you train or operate AI systems with personal data, you combine privacy management with a management system for artificial intelligence.
from CHF 849
13: Questions
Frequently asked questions about ISO 27701
ISO 27701 certificate within 4 hours.
The assessment is free. You pay only once you have passed.
The verification page shows the status, standard and validity of every certificate.