ISO/IEC 27701
ISO/IEC 27701 privacy information management
Make your handling of personal data demonstrable. Aegentra implements an ISO/IEC 27701 privacy information management system (PIMS), stand-alone or integrated with an existing ISO/IEC 27001 ISMS, and organises the evidence that supports accountability under the GDPR, with consultants based in Europe working remotely and on site in Germany.
What we deliver
What the implementation produces
Your written scope sets the deliverables and who owns each one. The programme is built around these outputs.
- PIMS scope
- The processing activities, systems and entities in scope, and whether the PIMS stands alone or extends an existing ISMS.
- Controller and processor roles
- Your role determined per processing activity, which decides the controls that apply.
- Records of processing
- Processing records aligned with what Article 30 of the GDPR expects, kept in a form your team can maintain.
- Privacy risk assessment
- Privacy risk criteria, an assessment of risks to individuals and agreed treatment.
- Statement of Applicability and controls
- The applicable controls for controllers, processors or both, implemented and evidenced, including data subject rights, transfers, retention and disposal.
- Evidence and handover
- Preparation for management review and an organised handover for the certification audit.
Context
What ISO/IEC 27701 is
ISO/IEC 27701 is the international standard for a privacy information management system. Since its 2025 revision it can be implemented as a stand-alone management system; it can also be integrated with an existing ISO/IEC 27001 ISMS, so that shared management-system processes are reused.
A PIMS gives you a repeatable way to show how personal data is handled: who decides, what is recorded, how risks are treated and how rights requests are answered.
ISO/IEC 27701 and the GDPR
The GDPR (Regulation (EU) 2016/679) makes controllers responsible for, and able to demonstrate, compliance with its principles (Article 5(2), accountability). A PIMS can support that accountability with documented processing records, risk decisions and operating evidence.
ISO/IEC 27701 certification does not prove GDPR compliance and is not a substitute for legal assessment. We do not give legal advice; where you need it, work with your data protection officer or legal counsel.
What this service is not
It is not certification, legal advice or a data protection officer service. The internal audit of a PIMS we implemented is scoped separately and performed by a consultant who had no part in the implementation, or by a separate provider.
How it runs
From processing records to certification audit
Scoping call
We confirm the processing activities, entities and systems involved, whether you already hold ISO/IEC 27001 and your target dates, then quote a fixed fee.
Roles and records
We determine controller and processor roles per activity and build the processing records.
Privacy risk and applicability
We assess privacy risks, agree treatment and record the applicable controls in the Statement of Applicability.
Build
Controls for transparency, rights handling, transfers, retention and suppliers are implemented with your team and evidenced.
Internal audit and management review
An independent, separately scoped internal audit tests the PIMS, then leadership reviews results and actions.
Certification handover
We organise the evidence for the certification body’s audits.
Who it suits
Organisations this suits
- SaaS and service companies that process personal data on behalf of customers.
- Organisations answering privacy questions in procurement and supplier due diligence.
- Organisations certified to ISO/IEC 27001 that are increasingly asked about privacy.
- Controllers that want accountability evidence beyond a set of policies.
Questions
Frequently asked questions
Does ISO/IEC 27701 certification prove GDPR compliance?
No. No ISO certificate proves compliance with a regulation. A PIMS can support GDPR accountability with documented records, risk decisions and operating evidence, but compliance needs its own legal assessment.
Do we need ISO/IEC 27001 first?
Not since the 2025 revision, which allows ISO/IEC 27701 to be implemented on its own. If you already hold ISO/IEC 27001, integrating the two is usually the efficient path.
Are we a controller or a processor?
Often both, decided per processing activity. You are usually a controller for your own staff and marketing data and a processor for data your customers entrust to you. The answer decides which controls apply.
Does Aegentra act as our data protection officer?
No. This service implements a management system. It does not replace a data protection officer or legal advice.
What does it cost?
We do not publish a price. After a scoping call we quote a fixed fee for the agreed scope. Certification-body fees are separate.
Building privacy evidence with ISO/IEC 27701?
Tell us your processing activities, your role and your deadline.