ISO 27701

Overview

ISO/IEC 27701 extends ISO 27001 and ISO 27002 with additional requirements and guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS). It maps directly to GDPR, CCPA, LGPD, and other privacy regulations, providing a certifiable framework for privacy compliance. CodeMiners' ISO 27701 certification demonstrates that personal data processing activities are governed by a formal management system.

Governing Body

International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC)

Scope of Certification

Extends the ISMS to include privacy-specific controls for organizations acting as PII controllers and/or PII processors. Covers consent management, data subject rights, lawful basis for processing, cross-border data transfers, and sub-processor management.

Audit and Assessment Process

Audited as an extension to the ISO 27001 certification. The certification body evaluates additional PIMS-specific controls during the ISO 27001 audit cycle. Requires demonstration of privacy impact assessments, data processing records, and data subject request handling procedures.

Key Requirements

1. Privacy impact assessments for all processing activities
2. Records of processing activities (ROPA)
3. Data subject rights fulfillment procedures
4. Consent management and lawful basis documentation
5. Cross-border data transfer safeguards
6. Sub-processor due diligence and contractual controls
7. Privacy breach notification procedures

Compliance Entitlements

• Certified extension of ISO 27001 for privacy management
• Direct mapping to GDPR, CCPA, and global privacy regulations
• Coverage of both PII controller and PII processor responsibilities
• Systematic privacy risk identification and treatment

Client Benefits

• Provides certified evidence of GDPR and CCPA compliance alignment
• Simplifies privacy due diligence for clients operating in regulated markets
• Demonstrates that personal data is managed under a formal, auditable system
• Reduces client liability exposure when engaging CodeMiners as a data processor

Related Certifications