ISO/IEC 27001 · Information security
It requires assessing and treating information security risks and declaring the applicability of the Annex A controls.
- Sectors
- Technology · Financial services · Telecommunications
- Edition
- ISO/IEC 27001:2022
ISO/IEC 27701Privacy information management
It requires a privacy information management system, with controls for controllers and processors of personal data.
What it demonstrates
- It requires a privacy information management system, with controls for controllers and processors of personal data.
- The audit checks those controls.
- Sectors
- Technology
- Healthcare
- Finance
- BPO
- Edition
- ISO/IEC 27701:2025
- Discipline
- Information security
- Topic
- Technology and information
- Public status
- Third-party certification
G-CERTI register of certification routes · 02-09-2026
ISO/IEC 27701, step by step
Initial certification follows these steps.
- Enquiry and scope
What you are asked for, what activities you carry out, and at which sites and in which country you operate.
- Proposal
In writing, sized to the standard, the activities, the sites and the country.
- Audit
The assigned team assesses the documentation and the operation with evidence.
- Verifiable certificate
A function separate from the audit team decides. The certificate can be checked by its code.
- Continuity
Continuity of the cycle is agreed for your case.
- Who audits
- The audit team assigned to the case, with declared competence for the standard.
- Who decides
- A function separate from the audit, in accordance with ISO/IEC 17021-1.
- Who issues
- G-CERTI Co., Ltd.
- Where it is checked
- The public certificate register, by code. Verify
Issuance depends on the audit and an independent decision.
FAQ
What exactly is the reference?
ISO/IEC 27701:2025 — Privacy information management systems — Requirements and guidance. Edition 2, 2025; a standalone management system standard.
How much does certification cost?
There is no list price: the proposal is sized on standard, scope, sites, headcount, activities, system complexity and delivery mode. The request is reviewed first and the proposal is then issued.
What happens if the audit raises findings?
Findings are documented and classified. The organization submits correction, root cause and corrective action with evidence; the audit team evaluates it and only then does the file go to decision.
Who decides on certification?
A competent function separate from the audit team. Those who audit do not decide, and no outcome is anticipated before that review.
Where can an issued certificate be checked?
In the public certificate register, by code.
Other standards on the same topic
ISO/IEC 20000-1 · IT service management
It requires a service management system that plans, delivers and improves the IT services agreed with the customer.
- Sectors
- IT service providers · Data centres · Digital government
- Edition
- ISO/IEC 20000-1:2018
ISO/IEC 42001 · Artificial intelligence management
It requires governing how the organization develops, provides or uses artificial intelligence, with assessed risks, Annex A controls and human oversight.
- Sectors
- Banking · Healthcare · Telecommunications
- Edition
- ISO/IEC 42001:2023
ISO/IEC 27017:2015 · Security controls for cloud services
- Discipline
- Information security
- Edition
- ISO/IEC 27017:2015
Request your ISO/IEC 27701 proposal
The proposal arrives in writing, with the standard, the scope and the timeline.