ISO/IEC 27701
Set up a privacy information management system that shows how personal data is governed and protected.
ISO/IEC 27701: what it is and why it matters
ISO/IEC 27701 specifies requirements and gives guidance for establishing, implementing, maintaining and continually improving a privacy information management system. It is written for organisations that act as controllers or processors of personal data.
The 2019 edition was an extension to ISO/IEC 27001 and 27002. The 2025 edition is a full standalone standard, so an ISO/IEC 27001 certificate is no longer a prerequisite for certification, although many organisations still run the two together.
Built for the people who carry the work
- Privacy officers, data protection officers and privacy managers
- Information security and compliance managers
- Legal and risk teams who support privacy programmes
- Consultants and auditors who assess privacy controls
What you will be able to do
- Explain what a privacy information management system is and what it covers
- Describe the roles of controller and processor in the standard
- Map personal data processing and the controls that apply to it
- Link privacy risk work to an information security management system
- Prepare for internal audit and review by a certification body
Subject outline
- 01
Context, scope and leadership
- 02
Privacy policy, roles and accountability
- 03
Processing records and personal data inventories
- 04
Privacy risk and impact assessment
- 05
Controls for controllers and for processors
- 06
Monitoring, internal audit and improvement
How it supports real work
Keeping records of processing that match what systems actually do
Building a repeatable way to assess privacy impact for new projects
Showing evidence of privacy controls to customers and auditors
Training, examination and certification are different steps
ISO/IEC 27701 is certifiable at organisation level. A certificate shows that a management system was audited against the standard. It is not a finding that your organisation complies with any specific law.
- Training builds knowledge. It does not certify your organisation.
- Organisational certification comes from a certification body audit.
- Meeting the standard does not by itself make an organisation compliant with a privacy law such as GDPR or PDPL.
What is confirmed, and what people ask
Delivery information
Delivery details for this course have not been confirmed for publication, so none are listed here. Course length, schedule, language, delivery format and fees are confirmed per enquiry. Certification bodies set their own exam and eligibility rules, and we confirm the route to any certificate before you enrol.
Enquire About This CourseFrequently asked questions
Is ISO/IEC 27701 the same as complying with GDPR or PDPL?
No. It is a voluntary management system standard. Legal compliance depends on the law that applies and how you meet it.
Do I need ISO/IEC 27001 first?
Under the 2025 edition, no. The standard can be certified on its own, although it works well alongside ISO/IEC 27001.
What changed from the 2019 edition?
It became a standalone standard with a new title, aligned with the wider ISO/IEC 27000 family and with greater emphasis on governance, accountability and transparency.
Does the course certify me personally?
Not automatically. Personal credentials depend on the issuing body. Ask us which route applies before you enrol.
Related courses
Related Valtrenix services
Request course information
Tell us who the training is for and what you want to achieve. We reply with confirmed details only, including what is currently available for ISO/IEC 27701.
- Individual and team training enquiries welcome
- No fees, dates or formats are published until confirmed
- We confirm the certification route before you enrol