✦
Demonstrate privacy accountability
Show customers and partners that privacy risks and responsibilities are managed systematically.
ISO/IEC 27701:2025 • Privacy Information Management Systems
Protect Personal Information. Build Trust in Privacy.
Demonstrate responsible handling of personal data with independent ISO/IEC 27701 certification audits for your privacy information management system.
PRIVACY ACCOUNTABILITY
INDEPENDENT AUDITS
USA & AUSTRALIA
2025 EDITION
Why certification matters
Why choose ISO 27701 certification?
Independent assessment of a structured approach to managing personal information and privacy risk.
✦
Build confidence with customers
Provide independent assurance of the privacy information management system.
✦
Address controller and processor duties
Establish controls appropriate to your role in handling personally identifiable information (PII).
✦
Improve privacy risk oversight
Assess privacy risks, monitor controls and act on identified weaknesses.
✦
Support regulatory obligations
Organise evidence and governance relevant to applicable privacy laws without claiming automatic legal compliance.
✦
Integrate with ISO/IEC 27001
Coordinate privacy and information security systems where it benefits your organisation.
The standard
Discuss certification →
What is ISO/IEC 27701:2025?
ISO/IEC 27701:2025 specifies requirements and provides guidance for a privacy information management system (PIMS). It is intended for organisations responsible for processing personally identifiable information (PII), including PII controllers and processors.
Important change: The 2025 edition is a standalone management system standard. Unlike the withdrawn 2019 edition, it does not require ISO/IEC 27001 certification as a prerequisite under the standard itself. It can still be integrated with an information security management system.
Certification is not a guarantee against breaches and does not replace privacy-law compliance obligations.
Key PIMS focus areas
- Privacy context, scope, governance and accountability
- PII controller and processor responsibilities
- Privacy risk assessment and treatment
- PII lifecycle, transparency and appropriate controls
- Competence, awareness and documented information
- Monitoring, internal audit, management review and improvement
A clear pathway
Our ISO 27701 certification process
A structured audit pathway with a clear separation between coordination and independent certification decisions.
01
Define your PIMS scope
Tell us about the personal data you handle, your controller/processor roles, services and locations.
02
Confirm certification arrangements
The certification body reviews the scope, applicable edition, accreditation status and audit programme.
03
Stage 1 audit
Assess documented arrangements, scope, system readiness and preparation for the next audit.
04
Stage 2 audit
Evaluate implemented privacy controls and management-system effectiveness through evidence and interviews.
05
Independent certification decision
The certification body reviews the audit results and makes the certification decision.
06
Surveillance and renewal
Scheduled surveillance and recertification audits help maintain confidence over the certification cycle.
Already certified?
Ask about a transfer →
Transfer your ISO 27701 certification
Already certified under ISO/IEC 27701? Ask about transfer and transition arrangements. Eligibility depends on the certificate, existing accreditation, audit history, scope and the receiving certification body’s rules.
For certificates referencing the withdrawn 2019 edition, the applicable transition requirements should be confirmed before committing to a transfer date.
Helpful information
- Current certificate and applicable edition
- Scope, PII roles and locations
- Recent audit reports and nonconformities
- Surveillance dates and certificate expiry
Our relationships
Blue Wolf, ARS, SCK and accreditation
Blue Wolf coordinates independent certification services through certification-body relationships. The relevant certification body—not Blue Wolf—makes the certification decision and issues the certificate. Verify each body’s current ISO/IEC 27701:2025 accredited scope and standalone-certification availability before publication.
Blue Wolf Certifications
Certification enquiries, coordination and customer support.
ARS
Certification-body relationship; confirm ISO/IEC 27701:2025 scope.
SCK
Certification-body relationship; confirm ISO/IEC 27701:2025 scope.
Common questions
ISO 27701 certification FAQs
What is ISO/IEC 27701 certification?
Independent assessment of a privacy information management system (PIMS) against ISO/IEC 27701 requirements.
What is the current edition?
ISO/IEC 27701:2025 is the current edition, replacing ISO/IEC 27701:2019.
Is ISO/IEC 27001 certification required first?
Not by the 2025 standard itself. ISO/IEC 27701:2025 is a standalone management system standard, although it can integrate with ISO/IEC 27001. Availability of standalone accredited certification depends on the certification body’s approved scope.
Does certification prove GDPR or other legal compliance?
No. Certification supports systematic privacy management and can provide evidence relevant to obligations, but does not guarantee compliance wit
Who is ISO/IEC 27701 for?
Organisations acting as PII controllers or processors, including technology, healthcare, finance, professional services and public-sector organisations.
How long does certification take?
Timing varies by scope, complexity, sites, system maturity and audit scheduling.
Can an existing 2019-edition certificate transfer?
Potentially, subject to transition arrangements, accreditation, certificate validity, audit history and the receiving certification body’s review.
Who issues the certificate?
The relevant certification body makes the independent decision and issues the certificate; Blue Wolf coordinates certification services.
Take the next step
Request Your ISO 27701 Quote →
Ready to demonstrate confidence in your privacy management system?
Tell us about your organisation, privacy scope and locations. We’ll help you understand the available certification pathway.