ISO 27701 - Privacy ManagementIs our privacy certified?
When customers probe how you govern personal data, investors scrutinise your privacy practices, or you already hold ISO 27001 and want to extend it to privacy, a published policy is no longer enough. Increasingly, taking privacy seriously means showing a system, not a statement.
ISO 27701 is the international standard for a Privacy Information Management System. We take small, fast-moving companies from initial scoping through to certification, then maintain the controls and evidence that keep you certified year after year.
In short
- 01A certifiable privacy management system, built proportionately on ISO 27001 and aligned to how you actually handle data.
- 02Evidence ready for questionnaires and due diligence, so privacy stops slowing your deals down.
- 03A privacy programme that stays current through surveillance and recertification audits, not just the first one.
What problems we solve
Proving you take privacy seriously increasingly means showing how it's governed, with records and evidence behind it. You're in the right place if any of these sound familiar:
“We've no systematic privacy governance”
Privacy is handled ad hoc, and you can't show an auditor or customer how it's controlled.
“We've a policy, but little behind it”
What you publish doesn't match what you do, which is exactly what a regulator or buyer looks for.
“We process personal data for customers”
Their due diligence stalls because you can't evidence your privacy controls as a processor.
“We've ISO 27001, but privacy's a gap”
Your security is certified, but privacy questions in questionnaires still slow deals down.
“Our privacy work never stays current”
Records, notices, and assessments drift out of date until the next audit or incident exposes them.
“We start from scratch every time”
Each questionnaire and audit begins again, because nothing is captured as a reusable system.
How ISO 27701 certification works
3 to 6 months
Implementation
We agree scope, confirm whether you act as a controller or processor, map the gap against ISO 27701 and your ISO 27001, then put the privacy controls, records, and documentation in place.
External audit
Certification
We run the internal audit and management review, clear the readiness findings, and take you through the combined ISO 27001 and ISO 27701 assessment.
12-month minimum
Maintenance
We keep the controls and evidence current and coordinate surveillance and recertification audits, so certification doesn't lapse.
These are the headlines. The full service description sets out every activity, assumption, and exclusion.
Read the full service descriptionCompanies we've worked with.
What we put in place
Each item is scoped to the personal data you actually process. If a control genuinely doesn't apply, we mark it out of scope rather than inventing work.
Who it's for
20 to 200 employees: facing privacy scrutiny, but without an enterprise privacy function
Controller, processor, or both: customer records, employee data, or data you handle for others
UK or Europe: subject to UK GDPR, EU GDPR, or both
Under external pressure: privacy due diligence, processor assurance, or buyers wanting certified privacy
Already pursuing ISO 27001: or ready to implement both together as one programme
What's not included
- Acting as your Data Protection Officer
- Running data subject requests and breaches day to day
- Implementing technical controls (your IT team)
- Legal and contract drafting
- Penetration testing
- Certification body and platform fees
You work with a named Lead Consultant who holds recognised ISO 27001 implementation and audit qualifications, along with data protection credentials (CIPP/E, CIPM). They're your single point of contact and accountable for delivery. If you later add the DPO service, the same person can continue, so the context carries across both.
Term and pricing
Phase 1: Implementation
3–6 monthsFixed fee
Phase 2: Maintenance
12-month minimumRecurring fee, renewable annually
With ISO 27001
Combined programmeScoped and priced together
Exact figures depend on your size, your starting point, and whether ISO 27001 is already in place. Use the calculator for an indicative estimate.
Estimate the costCommon questions
ISO 27701 FAQs
See whether ISO 27701 is the right step.
A short conversation is usually enough to tell whether certification is the right move, and whether ISO 27001 needs to go in alongside it. If something else suits you better, we'll say so.