ISO/IEC 27701:2019
ISO 27701 Standard Implementation
ISO/IEC 27701 extends ISO 27001 into privacy information management (PIMS). It defines how an organisation — as a controller or processor of personal data — protects privacy and demonstrates accountability to clients and regulators.
What is ISO/IEC 27701?
ISO 27701 was created in response to the GDPR: organisations needed a certifiable way to demonstrate accountability in personal-data processing. The standard extends the ISMS with specific privacy requirements and dedicated annexes for controllers (Annex A) and processors (Annex B), while Annex D directly maps the requirements onto GDPR articles.
For IT companies, agencies, call centres, and healthcare and financial organisations that process large volumes of personal data, a PIMS certificate becomes a strong competitive advantage — controllers increasingly choose only certified processors.
Implementation phases
The real phases we guide every project through — from preparation to the certificate, which comes only at the end:
Training and PIMS Internal Audit
The standard is implemented as an extension of an existing ISMS. Not sure whether you already meet these requirements? Check with the short self-assessment at the bottom of this page.
Checking the foundation: ISO 27001
ISO 27701 is not certified on its own. We check the maturity of an existing ISMS or plan simultaneous implementation of both standards.
Role: controller or processor
We map personal-data flows and determine the role for each process — this determines which annex of the standard applies.
Extending risk assessment to privacy
The risk methodology is supplemented with risks to data subjects, including impact assessments (DPIAs) for high-risk processing.
Records of processing and legal bases
A register of processing activities, legal bases, retention periods and procedures for data-subject rights (access, erasure, objection).
Extending controls and documentation
Privacy by design, processor agreements, international data transfers and breach notification.
Training and PIMS internal audit
Targeted training for employees who work with personal data, and extending the internal audit to privacy requirements.
The path to certification
Certification is carried out together with the ISO 27001 audit, or as an extension of an existing certificate.
The prerequisite for everything: the system is implemented and applied in practice — every requirement of the standard met, the internal audit carried out and the management review completed.
An existing ISO 27001 certificate, or simultaneous certification of both standards.
Review of the processing register, data-subject-rights procedures, contracts and role mapping.
How privacy is applied in practice — from data-subject requests to responding to a data breach.
Valid for 3 years, maintained through annual audits together with ISO 27001.
Benefits of Adopting the Standard
An independently confirmed privacy system — a strong argument with regulators and in due-diligence processes.
Controllers increasingly require certified processors; the certificate shortens supplier checks.
Security and privacy are managed together — without duplicating documentation and audits.
Systematic privacy management reduces the likelihood of data breaches and sanctions.
An illustrative, typical scenario we often hear from clients — it does not represent a specific, named client.
“We had ISO/IEC 27001, but when asked ‘where is our clients’ personal data and who has access to it’, nobody could give a precise answer. ISO/IEC 27701 forced us to map our processing of personal data (PII), separate the controller and processor roles and link controls directly to GDPR requirements through Annex D.”
— a common scenario among our clients
Related standards
ISO 27001 is the mandatory foundation — 27701 shares its risk assessment and certification cycle. Annex D maps requirements onto GDPR, and the NIST Privacy Framework is the American counterpart, useful when working with US partners.
ISO/IEC 27701 training — from a basic understanding of the standard to internal auditor training. Delivered at your premises, online or as a combination of both.
FAQ about ISO/IEC 27701
Can I implement ISO 27701 without ISO 27001?
No — 27701 is an extension and is only certified alongside an existing or simultaneously implemented ISMS. Both standards can be introduced in a single project.
Does ISO 27701 mean automatic GDPR compliance?
Not automatically, but it covers the large majority of GDPR requirements, and Annex D directly maps the requirements onto the regulation's articles.
What is a PIMS?
A Privacy Information Management System — an ISMS extended with requirements for protecting personal data in the roles of controller and processor.
How long does implementation take?
With an existing ISO 27001, usually 2 to 4 months; if the standards are introduced together, 6 to 10 months. For large systems — over 500 employees, multiple locations or an integrated system of several standards — a project realistically runs beyond a year; we handle those clients too.
How much does ISO 27701 implementation cost?
There is no fixed price that applies to everyone — the cost depends on the organisation's field of activity, its size and number of employees, the chosen standard and the current state of the system. Send us a short description of your organisation and we will prepare a free, tailored estimate.
Standards that fit together like a honeycomb
Each standard keeps its own shape, but together they form a single solid, integrated management system (IMS) — with no gaps or overlaps. Click a hexagon to open that standard.
More about the integrated management system
An integrated management system (IMS) combines two or more ISO standards — for example ISO/IEC 27701 with ISO 9001 or ISO 14001 — into one shared framework of documentation, objectives and internal reviews, instead of each standard living in its own parallel procedure.
A single structure (the High-Level Structure — HLS) shared by every modern ISO standard. Thanks to it, the quality policy, risk management, internal audits and management review can be common to several standards at once.
Each standard on its own addresses one part of the business — quality, environment, safety, information. When an organisation introduces several of them, separate systems quickly duplicate the same documentation and the same auditors.
Less duplicated procedure work, simpler management, stronger process oversight, more efficient use of resources and easier preparation for a combined certification audit.
ISO/IEC 27701 can be implemented on its own or as part of an integrated system — the decision depends on how many standards you're targeting and whether you're introducing them at once or gradually.
Check your organization's readiness
Answer a few questions and receive an indicative assessment of your organization's current level of readiness for ISO/IEC 27701.
This self-assessment provides an indicative readiness result only. It does not constitute certification, an official audit, or formal confirmation of compliance.
The EU, the US and other markets
ISO/IEC 27701 is the same standard wherever you certify it — what differs is the designation, the accreditation behind the certificate and what your customers ask for.
In the European Union the standard is adopted with an EN prefix, and what your buyer in the Netherlands, Germany or France looks at is not the prefix but the accreditation behind the certificate: a body accredited by a signatory of the international recognition arrangement (Global Accreditation Cooperation, formerly IAF) is recognised in other markets too. What EU partners and EU regulation expect is on the page about the EU market.
For companies with customers in the United States — supplier audits, security questionnaires and how ISO sits alongside SOC 2 — see the page about the US market.
Wherever your customer is, we run the project remotely in English — over Teams, WhatsApp or Viber, with documentation and records in English — and on site when that is easier.
Montenegro and the region: MEST ISO/IEC 27701:2019
When people ask about a MEST ISO/IEC 27701:2019 certificate (or a ISO/IEC 27701:2019 certificate), they mean the confirmation issued by an independent accredited certification body to an organisation whose system complies with every requirement of this standard. Montenegro's national edition of the standard carries identical content to the international edition — the same requirements, the same clauses, just under a national designation — which is why both designations turn up in tenders for the same standard.
Why do the designations differ if it's the same standard?
Every member country of the European and international standardisation system adopts the same standard into its own national catalogue and adds a national prefix — in Montenegro, that's MEST. The content, structure, clauses and every requirement an auditor checks during certification remain completely identical regardless of which designation appears on the document. That's why a certificate issued under one designation fully covers the other — it isn't two standards, but one and the same, simply under two names.
Our core activity is standards implementation and rollout: we prepare your organisation so the certification audit goes without surprises, and we explain terms like "ISO/IEC 27701 certification" and "MEST ISO/IEC 27701 certificate" because that's exactly how clients search for them. What certification, accreditation, IAF and surveillance audits involve — read the Certification / ISO Certificate page, and about tender designations on the ISO Standards in Tenders page.
Montenegro is where we work from: our consultants are based in Podgorica, Budva and Bijelo Polje, documentation and training come in Montenegrin or in English, and the certificate itself is issued by an independent accredited certification body — not by us. We work on site in Serbia, Bosnia and Herzegovina, Croatia, North Macedonia, Albania and Kosovo as well — more about what we do in Montenegro.
Some of our references
More than 400 organisations in Montenegro and the region have gone through implementation with us — from banks and public bodies to manufacturing, IT, laboratories and hospitality.
These are only some of our clients. More about us →
Request a free consultation
We will assess the scope of work and propose a realistic plan and budget for your organisation. Call us or send an inquiry — we reply within 24 hours.