> For the complete documentation index, see [llms.txt](https://docs.oxfordinfosec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oxfordinfosec.com/iso27701-privacy-information-management.md). # ISO27701 (Privacy Information Management) ## Introducing the Service If customers are asking how you govern personal data, investors are probing your privacy practices during due diligence, or you already hold ISO 27001 and want to extend it to privacy, this service is for you. ISO 27701 is the international standard for a Privacy Information Management System (PIMS). It takes the privacy obligations you already have under UK and EU data protection law and turns them into a governed, auditable, and certifiable system you can point to, rather than explaining yourself from scratch each time. ISO 27701 extends ISO 27001. It uses the same management system and adds privacy-specific controls for organisations acting as a controller, a processor, or both. You cannot certify to ISO 27701 on its own: it sits on top of an ISO 27001 certificate, either one you already hold or one we implement alongside it. The section below explains how the two fit together. Oxford Infosec takes small, fast-moving companies from initial scoping through to successful certification, then maintains the controls and evidence that keep you certified through surveillance and recertification audits. Our consultants hold internationally recognised qualifications in ISO 27001 implementation and auditing, along with data protection credentials (CIPP/E, CIPM), so the privacy work is grounded in how the law actually applies to you. Our approach is pragmatic and risk-driven, built for small businesses so that every control is proportionate to real-world privacy risk, ISO 27701 requirements, and ICO expectations. We can optionally combine this expertise with a compliance automation platform (explained below), giving you continuous evidence collection, a live view of your privacy controls, and automated reminders for the recurring tasks a PIMS depends on. ## What Problem Does This Solve? Demonstrating that you take privacy seriously increasingly means showing a system, not a statement. Enterprise buyers, investors, and the organisations you process data for want evidence that privacy is governed, reviewed, and improved, not handled case by case when something comes up. Typical challenges for growing organisations: | Challenge | Consequence | | ------------------------------------------------ | ------------------------------------------------------------------------------------------------- | | **No systematic privacy governance** | Privacy is handled ad hoc, and you cannot show an auditor or a customer how it is controlled | | **A privacy policy but little behind it** | What you publish does not match what you do, which is exactly what a regulator or buyer looks for | | **You process personal data for your customers** | Their due diligence stalls because you cannot evidence your privacy controls as a processor | | **ISO 27001 in place, privacy still a gap** | Your security is certified, but privacy questions in questionnaires still slow deals down | | **Privacy work that never stays current** | Records, notices, and assessments drift out of date until the next audit or incident exposes them | Oxford Infosec provides an experienced implementation consultant and ongoing ISO 27701 maintenance, so you achieve certification quickly and keep your privacy management system current year after year. ## How ISO 27701 Relates to ISO 27001 ISO 27701 is an extension of ISO 27001, not a standalone standard. It adds privacy-specific requirements and a set of controls for personal data on top of the information security management system that ISO 27001 defines. Certification bodies assess ISO 27701 as an extension to an ISO 27001 audit, so you need ISO 27001 certification underneath it. That works in one of two ways: * **You already hold ISO 27001.** We add the privacy management system on top, extending your existing scope, risk process, internal audit, and management review to cover personal data. * **You do not have ISO 27001 yet.** We implement both together as a single programme, so the security and privacy management systems share one set of policies, one risk process, and one audit cycle rather than two parallel efforts. Either way, the privacy work reuses the management system rather than duplicating it. If you are already pursuing ISO 27001 with us, adding ISO 27701 is a smaller step than starting from scratch. Our ISO 27001 service description covers the security side in full. ## ISO 27701, GDPR Compliance, and the DPO Service ISO 27701 covers a lot of the same ground as two of our other services, and many organisations use more than one. The simplest way to see the difference is that GDPR Compliance builds your privacy foundations as a project, the DPO service operates privacy for you as an ongoing role, and ISO 27701 turns privacy into a certified management system. The same artifacts (your Record of Processing Activities, your DPIAs, your policies and notices) appear in all three, which is why they fit together rather than compete. | ISO 27701 (this service) | GDPR Compliance | DPO as a Service | | ----------------------------------------------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------ | | A certifiable privacy management system built on ISO 27001 | A fixed-scope project that puts your privacy foundations in place | An ongoing engagement with a named, independent Data Protection Officer | | Goal: achieve and maintain ISO 27701 certification | Goal: get compliant with UK and EU data protection law | Goal: have someone run data protection for you day to day | | Systematises and certifies your Record of Processing, DPIAs, and policies | Builds your Record of Processing, DPIAs, and policies | Maintains and operates them over time | | Adds governance, internal audit, management review, and continual improvement | Hands over a complete set of documentation at the end | Provides continuous advice, monitoring, and training through the year | | Produces an externally audited certificate | Produces documentation, not a certificate | Acts as your formal contact point with the ICO | | Does not provide a named DPO or operate requests day to day | Does not operate requests or act as your ICO contact | Handles data subject requests, breaches, and the regulator as they arise | In practice the three reinforce each other: * If you have already done the GDPR Compliance project, much of that documentation (your Record of Processing Activities, lawful basis register, privacy notices, and procedures) is reusable as evidence for the ISO 27701 management system, so you are not starting again. * ISO 27701 defines and certifies the privacy management system, and a DPO can then operate it day to day. If you take both, the same named consultant can deliver the implementation and act as your DPO, so you do not have to explain your business twice. * ISO 27701 gives you the auditable, certifiable wrapper around the privacy work that GDPR Compliance builds and the DPO service runs. It is the right choice when a certificate, not just compliance, is what your customers or investors are asking for. ## Compliance Automation Platform Before diving into the detail, it's worth explaining the compliance automation platform we recommend, since it underpins much of how we work. A cloud-based compliance automation platform serves as the "engine room" for day-to-day privacy and security housekeeping. Once connected to your existing tools (for example AWS, Google Workspace, GitHub, your MDM), it continuously collects evidence that key controls are operating, maintains your policy documents, and displays progress on a live readiness dashboard. Its privacy module keeps your Record of Processing Activities, data subject request workflow, and assessments in one place. The platform automatically raises tasks (like policy reviews, vendor re-assessments, or staff-training refreshers), assigns them to the right people with due dates, and preserves an auditable trail. We can work with whichever compliance automation platform you already have in place (such as Vanta or Secureframe). ## Fit for Small Businesses This service is designed for organisations that need a credible ISO 27701 certificate without the overhead of an enterprise-scale privacy function. Typically that means: * **20 to 200 employees**: large enough to face privacy scrutiny, small enough that an enterprise privacy programme would swamp the business * **Processing personal data as a controller, a processor, or both**: customer records, employee data, user accounts, or personal data you handle on behalf of your own customers * **Operating in the UK or Europe**: subject to UK GDPR, EU GDPR, or both, and to the privacy expectations of enterprise buyers and investors * **Facing external pressure**: privacy due diligence, processor assurance requests, or customers who want certified privacy rather than a self-asserted policy Our approach recognises the reality of small, fast-moving teams: limited headcount, shifting priorities, and the need to keep shipping product while holding a credible certificate. The ICO is clear that smaller organisations need a "smaller-scale approach to accountability", so we focus on what is genuinely required and proportionate, not on generating paperwork for its own sake. * **Practical controls**: we focus on the personal data you actually process and the risks that matter. If a control genuinely doesn't apply, we mark it out of scope rather than inventing work. * **Light-touch scheduling**: assessments, workshops, and evidence collection are conducted with the minimum possible impact on the rest of the business. * **Automated evidence wherever possible**: The platform's integrations pull access logs, configuration states, and test results from your existing systems, cutting down on manual screenshots and spreadsheets. * **Risk-led priorities**: we order actions by privacy risk and the effort to deliver them, so you can stage improvements alongside normal delivery. * **Straightforward guidance**: we avoid standards-speak and explain what's required in plain English. Policies come as editable templates, with notes that make clear what's mandatory versus optional. If you only need to be compliant with data protection law and do not need a certificate, our GDPR Compliance project is usually the better starting point. And if you have no appetite for ISO 27001, ISO 27701 certification is not yet available to you, because it sits on top of an ISO 27001 certificate. ## Outcomes: What You Get ### Certified privacy you can rely on
OutcomeWhat this means
You achieve certification on your target timelineScoping, implementation, and audit prep aligned to your deal, investor, or contractual deadline
The certificate reflects how you handle dataControls match how you actually process personal data, not a generic template auditors see through
You stay certified year after yearSurveillance and recertification audits pass without last-minute firefighting
### Credibility with customers, partners, and regulators | Outcome | What this means | | ------------------------------------------------- | ---------------------------------------------------------------------------------------- | | **You can answer privacy questionnaires quickly** | Evidence is documented and ready, mapped to what buyers and processors typically ask | | **Due diligence goes smoothly** | Customers and investors can see privacy is governed, not improvised | | **You can evidence accountability** | If the ICO ever asks, you can show a managed system rather than scrambling for documents | ### A privacy programme that runs itself | Outcome | What this means | | ----------------------------------------- | ------------------------------------------------------------------------ | | **You know where you stand** | Live view of control status, evidence coverage, and open privacy actions | | **Issues surface early** | Gaps are caught before the external audit, not during it | | **The standard fits around the business** | Controls and cadence calibrated to small teams, not enterprise templates | ## Scope of Activities This service is split into the initial implementation, which takes you all the way to certification, and the subsequent maintenance of the controls and evidence that keep you certified through surveillance and recertification audits. ### Phase 1: Implementation Phase 1 typically takes three to six months, depending on your starting point, whether ISO 27001 is already in place, and how quickly you can action remediation items.
CategoryActivity
Kick-off and ContextA lightweight alignment call with founders or leadership to agree scope (which processing activities are in), whether you act as a controller, a processor, or both, your objective (certification with the least overhead), accountability (a named senior contact), and interested parties (customers, data subjects, regulators, investors, staff).
Compliance Platform Implementation (optional)Connect the platform to your existing systems so it can automatically collect evidence. We configure integrations, set owners and review cycles, and set up the privacy module so the dashboard reflects how your business actually runs.
Personal Data Inventory and Records of ProcessingMap the personal data you hold, where it comes from, why you process it, who you share it with, and how long you keep it, captured in a Record of Processing Activities that doubles as evidence for the PIMS.
Privacy Risk Assessment and DPIAsAssess privacy risk to individuals alongside your information security risk, and set up a data protection impact assessment process and template for anything new that uses personal data.
Statement of ApplicabilityExtend your Statement of Applicability to the ISO 27701 controls that apply to you as a controller (Annex A), a processor (Annex B), or both, with a documented justification for what is in and out.
DocumentationCreate or refine the privacy policies and procedures you will actually use: a data protection policy, lawful basis register, consent records, privacy notices, a retention schedule, a data subject request procedure, a breach response procedure, privacy by design, international transfer controls, and processor and sub-processor agreements.
Control Implementation SupportGuide the technical and organisational privacy controls (for example consent capture, data subject request fulfilment, retention and erasure, and transfer mechanisms) and validate they work.
Competence and TrainingSet up privacy awareness training for all staff, with records to demonstrate competence, and make sure people in privacy-relevant roles have the right knowledge.
Internal Audit and Management ReviewConduct the first-cycle internal audit across the combined security and privacy management system, and facilitate the inaugural management review with leadership.
Certification PreparationRun a readiness check, coordinate corrective actions, and rehearse the auditor Q&A and logistics for the combined ISO 27001 and ISO 27701 assessment.
### Phase 2: Maintenance
CategoryActivity
Continuous MonitoringOperate compliance automation integrations to harvest evidence, track control performance, and surface alerts for privacy or security controls that aren't working as expected
Records and Privacy Risk ManagementKeep the Record of Processing Activities current, refresh DPIAs as processing changes, and update privacy risk treatment on a quarterly cadence
Internal Audit ProgrammePlan and execute thematic spot checks and full-scope audits across the privacy and security controls, logging findings and corrective actions
Policy and Procedure MaintenanceSchedule reviews, keep privacy notices accurate as the business changes, update documents for changes to standards or operations, and manage version control
Management ReviewPrepare a summary of key metrics and run semi-annual management review sessions, capturing decisions and action items
Audit LiaisonCoordinate with the Certification Body for surveillance and recertification audits; track evidence requests and responses
Privacy Awareness and TrainingDeliver onboarding modules, annual refresher, and targeted campaigns; monitor completion metrics and maintain competence records
Processor and Supplier OversightAssess processors and suppliers who handle personal data, keep data processing and sub-processor agreements current, and monitor third-party assurance reports
Data Subject Rights and Breach ReadinessKeep the data subject request and breach procedures current and tested so they work when needed. Operating them in real time is the DPO service or your own team
International Transfer WatchTrack adequacy decisions and transfer mechanisms (for example SCCs and the UK IDTA), and update controls when they change
Standards and Regulatory WatchMonitor ISO, ICO, EDPB, and sector-specific updates; advise on required control adjustments
## Service Governance Cadence Maintaining ISO 27701 isn't a one-off effort. The standard requires regular reviews, audits, and updates. The table below shows a typical rhythm of activities. For smaller organisations, several of these can be combined into single sessions, and the monthly review is often just a 30-minute call rather than a formal meeting.
CategoryActivityFrequency
Monthly Check-inTrack open actions, new privacy risks, control performance issues, and alerts.Monthly
Privacy Risk and Records ReviewRefresh the Record of Processing Activities, re-score top privacy risks, verify treatment progress, and review any new processing.Quarterly
Management ReviewPresent a summary of objectives, incidents, audit results, and corrective actions. Record decisions and assignments for continual improvement.Semi-annual (minimum)
Internal Audit GovernanceApprove the annual internal audit plan; track execution and close-out of findings; adjust scope based on risk review outcomes.Annual plan; progress check at each leadership meeting
Policy and Procedure GovernanceSystematic review of the privacy and security policy suite; confirm privacy notices remain accurate; publish updated versions.Quarterly
Processor and Supplier OversightReassess processors and suppliers handling personal data; review their assurance reports and agreements; update the supplier risk register.Quarterly
External Audit LiaisonPrepare auditor access, evidence sampling, and logistics for surveillance or recertification audits; debrief outcomes and action plans.Annually (surveillance) / every 3 years (recertification)
Training and Awareness GovernanceTrack privacy and security awareness completion, role-based training needs, and plan the next campaign.Quarterly
## Who Delivers the Service You'll work with a named Lead Consultant who holds recognised ISO 27001 implementation and audit qualifications, along with data protection credentials (CIPP/E, CIPM). They act as your single point of contact and are accountable for delivery, reporting to whoever you nominate as executive sponsor (often the founder, CTO, or COO). If you later add the DPO service, the same person can continue, so you do not have to explain your business twice. ## What's Not Included The following items are not included in this service. Where relevant, we can recommend specialists or help you procure these services separately.
CategoryWhat's not included
Acting as your Data Protection OfficerOperating as your named, independent DPO and formal ICO contact point. That is our DPO as a Service
Operating data subject requests and breachesWe build, maintain, and test the procedures and keep the PIMS current. Running requests and breaches in real time, within the legal deadline, is the DPO service or your own team
ISO 27001 certification (where not held)The security management system underneath ISO 27701. We can implement it alongside as a combined programme. See our ISO 27001 service description
Other compliance frameworksSOC 2, PCI-DSS, NIST CSF, and similar. See our separate service descriptions
Legal and contract draftingNegotiating or red-lining DPAs, MSAs, or supplier clauses. We supply privacy language; final legal vetting sits with your counsel
EU RepresentativeIf you are UK-based but processing EU residents' data and need an EU Representative, that is a separate appointment. We can advise on whether you need one
Implementing technical controlsIf the project finds you need better encryption, access controls, or tooling, we tell you what is needed. Your IT team implements it
Penetration testingExternal or internal penetration tests and social-engineering simulations
Procurement and licensingCompliance platform subscriptions and certification body fees
Travel and on-site expensesConsultant travel, accommodation, per diem
Audit costsThe certification audit itself is procured directly from the auditing company. We can advise on selecting and procuring an auditor
## Assumptions
AssumptionWhy this matters
ISO 27001 is in place or implemented in parallelISO 27701 is certified as an extension to ISO 27001. Without the security management system underneath, the privacy certificate cannot be issued.
Executive sponsorship is active and visibleA named senior leader approves scope, risk appetite, and resource allocation; without this, key decisions stall.
You provide timely access to people, systems, and recordsInterviews, evidence collection, and control validation depend on access to the right people, systems, and documentation.
You implement remediation actions you own by agreed due datesOxford Infosec guides and validates; hands-on changes (for example configuring retention or consent capture) remain your responsibility.
Processors and suppliers cooperate with assurance requestsISO 27701 requires oversight of those who process personal data on your behalf; delays caused by non-responsive vendors are outside our control.
Legal review of policies and contracts is provided by your own counselOxford Infosec supplies privacy language, but final legal vetting sits with you.
Engagement is delivered remotely unless on-site days are mutually scheduled and pre-approvedTravel costs are excluded unless explicitly agreed.
All communications are in English and within your standard working hours (UK/Europe time zone)Ensures availability for workshops, meetings, and advisory calls.
Privacy incidents and breaches are disclosed promptlyTimely awareness is required to keep the risk register, improvement log, and evidence current.
Certification body fees and scheduling are your responsibilityOxford Infosec assists with liaison and readiness but does not contract directly with the auditor.
## Term and Review Phase 1 (implementation) is a fixed fee. Where ISO 27701 is implemented alongside ISO 27001 as a combined programme, the two are scoped and priced together. Phase 2 (maintenance) has a minimum engagement term of twelve months, renewable annually, which begins after the first audit is completed. Scope and fees are reviewed at each renewal to ensure the service continues to meet your needs. ## Combining with Other Services The ISO 27701 service works well alongside Oxford Infosec's other services: * **ISO 27001**: the foundation ISO 27701 is built on. If you do not already hold it, we implement the two together so security and privacy share one management system. If you do, we extend it to privacy. * **GDPR Compliance**: a good precursor where you need to get the privacy foundations right first. The Record of Processing Activities, policies, and procedures it produces are reusable as evidence for the ISO 27701 management system. * **DPO as a Service**: where you want someone to operate the privacy management system day to day, handling data subject requests, breaches, and the regulator. ISO 27701 defines and certifies the system; the DPO runs it. * **vCISO**: your vCISO provides ongoing strategic oversight across security and privacy while this service handles implementation and maintenance. * **SOC 2**: if you're selling into both UK and US markets, you may need recognised assurance on both sides of the Atlantic. We can help you decide how the frameworks fit together. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.oxfordinfosec.com/iso27701-privacy-information-management.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.