Unified privacy certification built on your security foundation
ISO/IEC 27701 specifies requirements and provides guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS). Because it is structured as an extension to ISO 27001, organizations with an established ISMS can achieve accredited international privacy certification with minimal duplicate effort.
The standard establishes specific control suites depending on whether your organization operates as a PII Controller (Data Fiduciary) or a PII Processor (Data Processor), providing verifiable third-party assurance for international clients.
Key PIMS control areas
- Conditions for Collection & Processing: Documenting lawful bases, clear notice mechanisms, and consent records.
- Obligations to PII Principals: Establishing formal processes for access, correction, erasure, and objection handling.
- Privacy by Design & Default: Integrating data minimization, pseudonymisation, and retention limits into engineering pipelines.
- Sub-processing & Cross-Border Transfers: Verifying contractual safeguards, transfer impact assessments, and processor oversight.