ISO/IEC 27701
A practical, scoped engagement for organisations seeking ISO/IEC 27701 support.
How we work
We agree the engagement scope and adapt the activities to your environment, obligations and objectives.
- 01Identify processing roles, personal data and management-system scope.
- 02Assess privacy risks and applicable obligations.
- 03Map privacy controls to processing and supplier arrangements.
- 04Build operating procedures and evidence of their use.
- 05Review readiness and support independent assessment where applicable.
What you can expect
A documented scope, relevant findings or gaps, agreed actions and a clear record of ownership. Exact deliverables and timing are agreed for each engagement.
What we need to get started
Your objective, applicable locations or systems, current position, key stakeholders and any target date. Please avoid sending confidential information in the initial enquiry.
Privacy information management system (PIMS)
Build a privacy management system around the personally identifiable information your organisation controls or processes.
- 01ScopeMap processing and roles
- 02AssessReview privacy risks
- 03ImplementEmbed privacy controls
- 04ReviewValidate evidence and operation
- 05CertifySupport independent assessment
ISO/IEC 27701:2025: scope and objectives
Build a privacy management system around the personally identifiable information your organisation controls or processes.
ISO/IEC 27701:2025 is a standalone management system standard and can be integrated with an existing ISMS; an ISO/IEC 27001 certificate is not a prerequisite. Certification does not itself establish compliance with every privacy law.
Proposed scope of services
We agree the scope, delivery responsibilities and outputs for each engagement. The activities below describe a practical path and are tailored to your organisation.
| Engagement phase | Activities |
|---|---|
| Scope and processing roles | Identify processing activities, systems, locations, stakeholders and whether the organisation acts as a PII controller, processor or both. |
| Privacy governance | Define the PIMS scope, leadership responsibilities, policy, objectives and interfaces with existing information security arrangements. |
| Data inventory and flows | Map categories of personal data, purposes, collection points, recipients, retention, suppliers and cross-border flows relevant to the engagement. |
| Privacy risk and obligations | Identify privacy risks and applicable legal, regulatory and contractual obligations with appropriate legal input; prioritise treatment. |
| Controls and procedures | Develop or improve procedures for notices, requests, retention, deletion, incident handling, supplier oversight and other applicable privacy controls. |
| Controller and processor responsibilities | Clarify responsibilities and evidence across the organisation, customers and processors; review relevant agreements and operational handoffs. |
| Evidence and awareness | Organise the records supporting privacy decisions and operating controls, and brief responsible teams. |
| Internal audit and management review | Review implementation and evidence, document findings, and support leadership review and corrective action. |
| Independent assessment support | Support assessment planning, evidence requests and finding closure with an independent certification body. |
| Ongoing privacy management | Maintain ownership for changes to processing, suppliers, risk decisions and review activities. |
Readiness and certification path
We work with your team to establish the management system, operate the agreed processes, review evidence and address internal findings. The selected independent certification body determines its own audit scope and conducts the assessment. Initial certification commonly includes a Stage 1 readiness and planning review followed by a Stage 2 assessment of implementation and effectiveness. We can support coordination, responses and corrective actions; the independent body makes the certification decision.
Typical deliverables
- PIMS scope and responsibility matrix
- Personal data inventory, flow and supplier mapping
- Privacy risk and action register
- Policies, procedures and evidence tracker
- Internal audit, management review and assessment-support records
Our engagement approach
- Scope-led: tailor the management system to the organisation’s activities, boundaries and objectives.
- Evidence-driven: connect documented processes to responsible owners and evidence of operation.
- Practical implementation: prioritise gaps and improvements with agreed owners and timeframes.
- Independent assessment: support the audit process while preserving the certification body’s independent role.
- Continual improvement: hand over actions and review arrangements so the management system can continue to operate.
Reference: ISO guidance for ISO/IEC 27701:2025. The applicable edition, scope, assessment arrangements and deliverables are confirmed for each engagement.
Where an independent certification or attestation applies, the relevant independent body makes its own assessment and decision. Scope and availability are agreed individually.