ISO 27701 PIMS Certification

What is ISO/IEC 27701?

ISO 27701 of ISO/IEC 27701 is a Privacy Information Management System (PIMS) standard that is designed to help organisations comply with privacy laws around the world. In recent years, new data protection laws have been introduced in multiple countries that establish requirements for securing and processing Personally Identifiable Information (PII). However, it is not always clear how organisations should comply with these laws. ISO 27701 was introduced in 2019 and provides actionable guidance to help organisations conform to these varied regulations.

ISO/IEC 27701:2019 is an extension of ISO/IEC 27001, the information security management system (ISMS) standard. Where ISO/IEC 27001 sets a standard for secure IT governance in the broadest sense, ISO/IEC 27701 focuses specifically on protecting personal data.

ISO/IEC 27701 is the first standard of its type in the world and is applicable to public and private companies, government entities and not-for-profit organisations. It supports compliance with the EU’s GDPR, but is also applicable to personal data governance laws in all other geographies.

Why is ISO 27701 certification important?

Following several high-profile data breaches, national governments and organisations like the EU have introduced strict new laws around private data protection. These data protection laws aim to protect the PII of citizens, such as their names, addresses, age, bank account details and more.

However, understanding how to apply these regulations to your organisation’s ISMS can be very challenging. Furthermore, for organisations that process customer and employee data in multiple jurisdictions, ensuring compliance with several countries’ data governance laws is complex and time-consuming. ISO/IEC 27701 supports you by providing a standardised way of complying with all these laws.

Benefits of ISO 27701 certification include:

Compliance with all relevant data protection laws and clarification of the roles and responsibilities of PII controllers and processors.
Gain a competitive edge – ISO/IEC 27701 certification demonstrates strong IT governance and increases stakeholder trust in your privacy and data protection practices.
Achieve world-class standards – a rigorous risk and compliance driven approach meets the requirements of global data governance laws.
Improve transparency – measure and report data privacy improvements using detailed security and privacy controls.
Minimise PII related risk by keeping track of evolving privacy threats and the regulatory landscape.
Supports business relationships with your customers and suppliers by demonstrating you meet PII protection standards worldwide.

TÜV SÜD supports businesses through the ISO/IEC 27701 certification process

TÜV SÜD’s experienced ISMS teams possess the accreditation and expertise to conduct ISO/IEC 27001 and ISO/IEC 27701 audits across industries. Through our worldwide network of IT governance professionals, we can provide information security certification services no matter where you are. We have an in-depth understanding of the standard and have extensive experience helping organisations implement this kind of IT governance regulation.

Furthermore, TÜV SÜD’s experts actively participate in international standardisation committees and we have a complete understanding of the latest PII regulatory developments around the world. And because we are vendor agnostic, our third-party audits are both impartial and independent, meaning your organisation gains valuable insights from an unbiased expert.

TÜV SÜD’s ISO/IEC 27701 certification process

TÜV SÜD has developed an efficient five-step process to support your ISO/IEC 27701 certification:

Readiness Review
We help you understand the standard’s objectives and informational requirements for the audit.
Audit on-site
Our experts conduct audits of your PII protection activities, assessing how you store and process customer information.
Non-conformance resolution
After the audit, your organisation implements measures to correct any non-conformances that the audit identified.
Issuance of audit report and certificate
TÜV SÜD issues you with your ISO 27701 certificate, which you can use to demonstrate your compliance.
Annual surveillance
To maintain the certificate, we conduct annual surveillance to ensure ISO data management standards continue to be met.

Complying with new privacy regulations such as the EU’s GDPR, California’s Consumer Privacy Act, India’s Personal Data Protection Bill or Brazil’s General Data Protection Law can be very challenging. However, by becoming ISO/IEC 27701 certified, your organisation can indicate compliance with all these (and similar) requirements.
To find out more about the standard or to begin the ISO/IEC 27701 certification process, contact us today.

Does ISO 27701 cover GDPR?

No, ISO 27701 does not address GDPR, but it can help any organisation prepare for future GDPR compliance. Together, ISO 27001 and ISO 27701 provide organisations with a way to strengthen their information security management systems and achieve privacy standard certification. While ISO 27001 and ISO 27701 provide a strong foundation for organisations attempting to comply with GDPR requirements, they do not address every aspect of the regulation.
How do I get ISO 27701 certified?

There are three steps to obtaining ISO 27701 certification:

1. You must first hire a qualified certification body to conduct an audit of your company.
2. An assessor will thoroughly audit your organisation once you've accepted athe proposal. During the initial certification audit, the assessor is required to make a mandatory visit. They'll check to see if a fully operational personal information management system has been implemented.
3. The certification body will determine whether your organisation has fulfilled the requirements after the assessor has finished the audit. If the result is favourable, they will issue you a certificate certifying that your business complies with the requirements of the ISO 27701 standard. The certification is valid for the following three years or up until your ISO 27001 certificate expires, whichever occurs first.

If your company does not yet have ISO 27001 certification, you must obtain it first or simultaneously pursue ISO 27001 and ISO 27701 certifications.
Why is ISO 27701 important?

ISO 27701 PIMS of ISO/IEC 27701 is a Privacy Information Management System (PIMS certification) standard designed to help organisations comply with privacy laws around the world.
How long does it take to implement ISO 27701 PIMS?

Most small to mid-sized companies can implement ISO 27701 PIMS within 6-12 months based on the size and difficulty of the management system. The process is much less tedious when you approach an ISO 27701 expert. ISO 27701 certification in India can be easily achieved through TÜV SÜD.
What is the difference between ISO 27001 and 27701?

ISO/IEC 27701:2019 is an extension of ISO/IEC 27001, the information security management system (ISMS) standard. Where ISO/IEC 27001 sets a standard for secure IT governance in the broadest sense, ISO/IEC 27701 Certification focuses specifically on protecting personal data.
How many controls are there in ISO 27701?

The ISO 27701 standard includes the 114 security controls from Annex A of ISO/IEC 27001 as well as the ISO/IEC 27002 implementation guide. However, ISO/IEC 27701 also contains particular security measures that are specifically related to personally identifiable data and are divided into two categories based on whether the business is acting as a controller or a processor.