ISO/IEC 27701 privacy information management consulting

For Your Business

Who this service is for and when to start

Organizations that collect, use, or process personal data on behalf of clients can evaluate implementation when services go live, data flow changes, or customers request privacy management proof. Companies that adopted the 2019 version should review gaps according to the new 2025 structure.

First, confirm the organization’s role in different data processing activities. The same company may have different responsibilities across services and cannot be summarized with a single name.

The Challenge

Common challenges faced by businesses

A privacy policy that differs from actual data flows, or unclear retention and deletion after transfer to suppliers, makes accountability difficult. Without identity checks and internal procedures, requests to exercise data subject rights may be delayed or lead to excessive disclosure.

Information security controls alone are insufficient for personal data. Also examine why data is processed, who decides, and the rights of and impacts on the people concerned.

Our Approach

Methods and applicable requirements

ISO/IEC 27701:2025 is the second edition of the privacy information management system requirements and guidance, replacing the 2019 edition. It is a standalone management system standard for personally identifiable information controllers and processors. It can integrate with ISO/IEC 27001, but prior adoption of 27001 is not required to implement it.

Roles, purposes, and data flows

Consulting reviews processing purposes, data sources, flows and roles to clarify the responsibilities of the organisation and outsourced services. Define the scope around actual activities so the policy covers how data is really processed.

Rights requests and data handling

Organize processes for request acceptance, identity verification, internal search, access, and retention/deletion. Confirm specific legal requirements based on applicable regions; the system ensures consistent execution and evidence maintenance.

Impact and external interfaces

Review processing changes, risks, and privacy impacts, and organize supplier and cross-border data interfaces. Management measures need to be linked to actual scenarios; certificates cannot be used as a guarantee of global privacy law compliance.

Preparation

What documents do companies need to prepare?

• Activities and roles: Processing purposes, types of personal data, and roles of controllers and processors.
• Data and flows: Data sources, systems, suppliers, and cross-border interfaces.
• Policies and handling: Privacy policies, rights requests, and retention/deletion rules.
• Evaluation and implementation: Risk or impact assessment, case summaries, and evidence of improvements.

For an initial discussion, provide a summary or de-identified sample. Share full records under the agreed scope, access permissions and confidentiality arrangements. Check whether existing records are still valid before filling gaps; there is no assumption that every document must be rewritten.

Project Planning

Estimating time and cost

Evaluate based on data activities, involved regions, number of suppliers, and system foundations. Jurisdictional legal judgments and system functionality modifications should be separately confirmed; initially prioritize using summaries and de-identified data.

Each project specifies the number of on-site interviews, document revisions, training sessions, internal-audit support activities and improvement reviews, together with responsibilities. Third-party certification, specialist testing, engineering and legal services are not included in consulting fees by default. Confirm transition schedules for existing certificates with the certification body.