ISO 27701
Who builds an ISO 27701 privacy system, and how does it sit beside ISO 27001 and the GDPR?
Most organizations already handle personal data under rules: a privacy policy, a records register somewhere, a breach procedure written after the last scare. What they often lack is a system that makes those pieces work together and proves it to someone outside. The ISO/IEC 27701 Lead Implementer is the person who builds that system. This guide is about who that person tends to be, what changed when the standard was rewritten in 2025, and how the work sits beside ISO/IEC 27001 and the GDPR.
The facts here come from ISO's pages for ISO/IEC 27701:2025 and the withdrawn 2019 edition, PECB's ISO/IEC 27701 Lead Implementer Candidate Handbook, version 1.5, PECB's course page, and the Official Journal text of the GDPR, all read on 20 October 2026.
What does an ISO 27701 Lead Implementer build?
A privacy information management system, or PIMS. ISO/IEC 27701 sets out the requirements for establishing, implementing, maintaining and continually improving one, with guidance on putting them into practice. It is written for organizations that act as PII controllers, PII processors or both, and ISO says it suits any organization that collects, processes, stores or controls personally identifiable information, public, private or not-for-profit. It comes from the same joint committee as ISO/IEC 27001, ISO/IEC JTC 1/SC 27.
In practice the implementer produces a short list of things that everything else hangs from:
- A scope that names the business units, sites and systems inside the PIMS, and states, for the processing in scope, whether the organization acts as a controller, a processor or both.
- A privacy policy and privacy objectives that top management approves.
- A privacy risk assessment and risk treatment, which looks at risk to the people whose data is processed, not only risk to the organization.
- The privacy controls the risk treatment calls for, with a record of which apply and why.
- The operating records privacy work runs on: what is processed and why, who processes it on the organization's behalf, how requests from individuals are handled, and what happens when something goes wrong.
- Training, awareness and communication, so people outside the privacy team know their part.
Around that core sit the parts every management system shares: documented information, monitoring and measurement, internal audit, management review and corrective action. The structure will look familiar to anyone who has worked on ISO/IEC 27001 or ISO 9001, and that familiarity is a large part of why organizations choose this route for privacy.
PECB weights its seven competency domains the way the job is weighted:
| Domain | Questions | Share |
|---|---|---|
| 1. Fundamental principles and concepts of a privacy information management system | 8 | 10% |
| 2. Initiation of the PIMS implementation | 7 | 8.75% |
| 3. Planning of a PIMS implementation based on ISO/IEC 27701 | 15 | 18.75% |
| 4. Implementation of a PIMS based on ISO/IEC 27701 | 23 | 28.75% |
| 5. Monitoring and measurement of a PIMS based on ISO/IEC 27701 | 12 | 15% |
| 6. Continual improvement of a PIMS based on ISO/IEC 27701 | 8 | 10% |
| 7. Preparation for a PIMS certification audit | 7 | 8.75% |
Implementation alone carries 23 of the 80 questions, more than any domain in PECB's ISO 27001 or ISO 22301 Lead Implementer exams. The handbook also splits the paper by level of understanding: 35 questions test comprehension, application and analysis, and 45 test evaluation. More than half the exam asks you to judge what an implementer should do in a situation, not to recall what the standard says.
What changed in 2025?
This is the first thing to settle, because it changes how the job is framed. The first edition, ISO/IEC 27701:2019, was titled as an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management. Its abstract described the PIMS as being in the form of an extension to those two standards. In practice that meant an organization built an information security management system first and added privacy to it.
The second edition, ISO/IEC 27701:2025, was published in October 2025, and ISO now lists the 2019 edition as withdrawn. Its title is Privacy information management systems, Requirements and guidance, and ISO's own answer to the question of whether it can be used alone is yes, because it is an independent management system standard. An organization can now build a PIMS without first holding, or building, an ISMS.
That does not make ISO/IEC 27001 irrelevant. ISO's page still lists alignment with existing ISO/IEC 27001 systems as a benefit, and in most organizations the security and privacy controls overlap heavily: access control, supplier management, incident handling and secure development appear in both. What changed is the default. Under the 2019 edition, privacy rode on security. Under the 2025 edition, privacy can stand on its own, and organizations that already run an ISMS choose to integrate rather than being required to.
For a candidate, the practical point is simple. PECB's Candidate Handbook, version 1.5, which was still the current version when we checked it on 20 October 2026, does not name an edition, and its first domain still asks you to explain the relationship between a PIMS and an ISMS. Ask your training partner which edition your course follows before you buy the standard, and make sure the copy you bring into the open-book exam is the one your course used.
Who gets sent on the course?
PECB's audience list for the five-day course names managers and consultants involved in privacy and data management, expert advisers who want to master the implementation of a PIMS, people responsible for keeping an organization conformant with data privacy requirements, and members of the PIMS implementation team. Its stated prerequisite is a fundamental understanding of information privacy. Put job titles on those descriptions and the cast is easy to recognize.
| Role | Why the work lands on them | What they need from the credential |
|---|---|---|
| Privacy program manager | They already run privacy, and the organization now wants it certified | The management system structure an auditor expects |
| Data protection officer | The GDPR puts them at the center of privacy compliance | A way to turn legal duties into an operating rhythm with records |
| Information security manager or CISO | They run the ISMS, and privacy is the natural next system | How privacy risk differs from security risk, and which controls are new |
| Compliance or GRC manager | They already handle policies, audits and regulators | The privacy-specific requirements and how to evidence them |
| Consultant | Clients want someone who has built one before | A recognized credential and a method they can repeat |
| Cloud or SaaS product lead | Customers ask how their data is handled as a processor | A certificate that answers the question once, for every customer |
The last row is where much of the demand comes from. A processor that handles personal data for hundreds of customers can answer the same privacy questionnaire hundreds of times, or point to one audited system. ISO has also published ISO/IEC 27018:2025, guidelines for protecting PII in public clouds acting as PII processors, and cloud providers often hold both.
When does the work land on your desk?
A customer or partner asks for proof
Picture a software company selling to hospitals and banks. Each customer's procurement team sends a privacy questionnaire, a data processing agreement and a list of follow-up questions about sub-processors, transfers and breach handling. The same answers are written and rewritten by whoever is free. Eventually someone proposes a certificate that answers most of it once, and the work lands on the person who already owns privacy or security.
The GDPR is the daily rulebook
For any organization processing personal data under the GDPR, Article 5(2) makes the controller responsible for, and able to demonstrate, compliance with the principles in Article 5(1): the accountability principle. Article 24 asks for appropriate technical and organizational measures, reviewed and updated where necessary. A management system is a natural way to meet that "able to demonstrate" duty, because demonstrating is what management systems are built to do. The implementer's job is to make the records exist and stay current.
Security is certified, and privacy is next
Organizations that already hold ISO/IEC 27001 often treat ISO/IEC 27701 as the next step. The scope, the risk method, the internal audit cycle and management review already exist, and the privacy work can reuse them. Under the 2025 edition that is a choice rather than a requirement, but for an organization with a working ISMS it is usually the quickest route.
A breach or a regulator's question
The least comfortable trigger is a personal data breach. Article 33 of the GDPR requires the controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, and Article 34 adds a duty to tell the people affected when the risk to them is high. Organizations that miss those steps the first time tend to want a system that makes sure they will not miss them again.
How a PIMS sits beside ISO 27001 and the GDPR
This is the table that saves the most time on a first PIMS project in an organization that already has an ISMS. It takes the GDPR duties a privacy system is most often asked to evidence, says how far an ISO/IEC 27001 ISMS usually covers each one, names the PIMS record that answers it, and shows where that work sits in the PECB exam. The ISMS column is our reading of how the two systems overlap, not a ruling, so check it with your data protection officer.
| GDPR duty | Does an ISO/IEC 27001 ISMS cover it? | PIMS record that closes the gap | PECB domain |
|---|---|---|---|
| Art. 5(1) principles: lawful, fair, transparent, purpose-limited, minimized, accurate, time-limited | Only the security principle | Privacy policy, purpose and retention register | 3. Planning |
| Art. 5(2) and 24: accountability, able to demonstrate compliance | The system structure, not the privacy content | PIMS documented information, management review | 3. Planning and 5. Monitoring and measurement |
| Art. 25: data protection by design and by default | Partly, through secure development | Privacy design review records | 4. Implementation |
| Art. 28: processors give sufficient guarantees, under contract | Partly, through supplier security | Processor and sub-processor register, contract checks | 4. Implementation |
| Art. 30: records of processing activities | No | Record of processing activities | 4. Implementation |
| Art. 32: security of processing | Largely | The ISMS controls, referenced from the PIMS | 4. Implementation |
| Art. 33 and 34: breach notice to the authority, within 72 hours where feasible, and to individuals when risk is high | Partly, through incident management | Breach procedure with the clock, decision log, communication template | 4. Implementation |
| Art. 35: impact assessment for likely high-risk processing | No: its risk method looks at risk to the organization | Impact assessment screening and assessments | 3. Planning |
| Arts. 12 to 22: rights of individuals | No | Rights request procedure and log | 4. Implementation |
| Art. 37: data protection officer, where required | No | Designation decision and role description | 3. Planning |
Two things stand out. First, the ISMS does real work: security of processing and much of breach handling are already there, which is why building on an ISMS is the quickest route. Second, the rows marked "no" are the heart of privacy: records of processing, impact assessments, rights requests and the principles themselves. That is the work a PIMS adds, and it is why implementation carries 23 of the 80 exam questions. We have turned the table into a checklist you can copy below.
GDPR duties to PIMS evidence checklist
GDPR duties to PIMS evidence checklist
Use this when you build a privacy information management system (PIMS) to ISO/IEC 27701 in an organization that processes personal data under the GDPR. It lists the GDPR duties a PIMS is most often asked to evidence, says whether an existing ISO/IEC 27001 ISMS usually covers each one, and leaves a box for the record and the owner. It is a working aid, not legal advice, and the ISMS column is our reading, not a ruling: check it with your data protection officer or legal team. ISO/IEC 27701 is sold rather than published, so check requirement wording against your own copy of ISO/IEC 27701:2025.
First, settle the role
- For each processing activity, are we a PII controller, a PII processor, or both? Record: ________
- Which business units, sites and systems are inside the PIMS scope? Record: ________
- Do we already run an ISO/IEC 27001 ISMS, and does its scope cover the same ground? yes / no
GDPR duties and the record that answers them
- Art. 5(1) principles: lawful, fair, transparent, purpose-limited, minimized, accurate, time-limited, secure. ISMS covers it: security only. Record: privacy policy, purpose and retention register. Owner: ________
- Art. 5(2) accountability: able to demonstrate compliance. ISMS covers it: the management system structure, not the privacy content. Record: PIMS documented information. Owner: ________
- Art. 24 controller responsibility: appropriate measures, reviewed and updated. ISMS covers it: partly. Record: privacy risk treatment plan, management review minutes. Owner: ________
- Art. 25 data protection by design and by default. ISMS covers it: partly, through secure development. Record: privacy design review records. Owner: ________
- Art. 28 processors: sufficient guarantees and a contract. ISMS covers it: partly, through supplier security. Record: processor register and contract checks. Owner: ________
- Art. 30 records of processing activities. ISMS covers it: no. Record: record of processing activities. Owner: ________
- Art. 32 security of processing. ISMS covers it: largely. Record: Statement of Applicability, control evidence. Owner: ________
- Art. 33 breach notification to the supervisory authority, where feasible within 72 hours. ISMS covers it: partly, through incident management. Record: breach procedure with the 72-hour clock and the decision log. Owner: ________
- Art. 34 communication of a high-risk breach to the people affected. ISMS covers it: no. Record: data subject communication template. Owner: ________
- Art. 35 data protection impact assessment for likely high-risk processing. ISMS covers it: no, its risk method looks at risk to the organization. Record: DPIA screening and assessments. Owner: ________
- Art. 37 data protection officer, where required. ISMS covers it: no. Record: DPO designation decision. Owner: ________
- Arts. 12 to 22 data subject rights: access, rectification, erasure, restriction, portability, objection. ISMS covers it: no. Record: rights request procedure and log. Owner: ________
The PIMS records that answer most of these
- PIMS scope, with the controller and processor roles stated
- Privacy policy and privacy objectives, approved by top management
- Privacy risk assessment and risk treatment, with the method written down
- Record of processing activities, with purposes, categories and retention
- Processor and sub-processor register
- Privacy notices, consent records where consent is the lawful basis, rights request log
- Breach procedure and breach log
- Training and awareness records
- Internal audit reports, management review minutes, corrective action log
A note on certificates: a certificate to ISO/IEC 27701 is not the same as a GDPR certification under Article 42, which is issued on criteria approved by a supervisory authority or the European Data Protection Board (Article 42(5)).
Sources: Regulation (EU) 2016/679 (GDPR), Articles 5, 12 to 22, 24, 25, 28, 30, 32 to 35, 37 and 42 (http://data.europa.eu/eli/reg/2016/679/oj); ISO/IEC 27701:2025 (https://www.iso.org/standard/27701). Read 20 October 2026. From Credential Press, credentialpress.com.
Where does the credential apply?
ISO/IEC 27701 is an international standard, and certification to it is offered by certification bodies in many countries, working to ISO/IEC 17021-1 for management system certification. PECB runs the exam worldwide, online through the PECB Exams application with a remote invigilator, or on paper through the partner that ran your course. For online multiple-choice exams, PECB says candidates receive their results instantly, and candidates sitting a Lead exam in a language that is not their own can ask, on the day, for 30 extra minutes.
The law around the standard varies. In the EU, the GDPR frames most privacy work, and a PIMS maps closely onto its accountability duty. In the United States, privacy law is a mix of federal sector rules and state laws, and a management system gives one structure that can carry several of them. The standard is deliberately law-neutral: it tells you how to manage privacy, and your applicable laws tell you what the privacy rules are.
What the credential is not
It is not your organization's certificate. The Lead Implementer is a personal credential. The certificate an organization holds comes from a certification body after an audit.
It is not a GDPR certification. Article 42 of the GDPR encourages data protection certification mechanisms, and Article 42(5) says those certifications are issued on criteria approved by a supervisory authority or by the European Data Protection Board. A certificate to ISO/IEC 27701 is strong evidence of accountability, but it is not one of those mechanisms, and it does not discharge the legal duties.
It is not a law course. The exam tests whether you can build and run a privacy management system, not whether you can advise on the meaning of a legal provision. If you need the law in depth, the IAPP's CIPP/E is the established route, and our CIPP/E exam guide explains it.
And it is not a substitute for the standard. ISO/IEC 27701 is sold rather than published free, and the exam is open book: PECB allows a hard copy of ISO/IEC 27701, the training course materials and your own course notes. Our guide to PECB's open-book rules explains what that does and does not let you do.
Which credential level can you claim?
PECB awards four levels on the same exam. You sit one paper; the title you hold depends on the experience and PIMS project hours you can show.
| Credential | Work experience | Privacy information management experience | PIMS project activities |
|---|---|---|---|
| Provisional Implementer | None | None | None |
| Implementer | Two years | One year | 200 hours |
| Lead Implementer | Five years | Two years | 300 hours |
| Senior Lead Implementer | Ten years | Seven years | 1,000 hours |
Each level also needs the exam and a signed PECB Code of Ethics. The handbook lists the project work that counts: drafting a PIMS plan, initiating a PIMS implementation, implementing it, monitoring and managing the implementation, and performing continual improvement. PECB certifications are valid for three years. If you are early in your career, the Provisional Implementer shows you passed the same exam, and the hours from your first PIMS project move you up.
How does it compare with the credentials around it?
| PECB ISO/IEC 27701 Lead Implementer | PECB ISO/IEC 27001 Lead Implementer | IAPP CIPP/E | |
|---|---|---|---|
| The question it answers | Can you build and run a privacy management system? | Can you build and run an information security management system? | Do you know European data protection law? |
| Anchored in | ISO/IEC 27701 | ISO/IEC 27001:2022 | The GDPR and related European law |
| Best fit | Privacy program managers, DPOs, consultants | Security managers, ISMS owners, consultants | Privacy lawyers, DPOs, privacy analysts |
| Natural pairing | ISO/IEC 27001, or CIPP/E for the law | ISO/IEC 27701 for privacy | ISO/IEC 27701 for the operating system |
The pairing with ISO/IEC 27001 is the classic one, and the ISO 27001 Lead Implementer Exam Guide covers that side. The pairing with CIPP/E is the one that makes a privacy professional hard to replace: one says you know the rules, the other says you can make an organization follow them, with records. Our guide to the GDPR data protection officer role covers where the DPO fits.
What will the exam expect of you?
Eighty multiple-choice questions, three options each, 70% to pass, which is 56 correct answers and no more than 24 wrong. The handbook says the paper mixes stand-alone questions with scenario-based ones, where you read one scenario and answer five questions about it. Each scenario describes an organization part way through its PIMS project, and every question turns on what the implementer should do next.
The wrong options are the instructive part. They describe sensible things done in the wrong order or from the wrong angle: treating a privacy risk assessment as if it were a security risk assessment, applying controller requirements to an organization acting only as a processor, writing the privacy policy before the scope settles which processing is in, or closing a nonconformity without recording the corrective action. Our guide to PECB scenario-based questions shows the pattern. If you want a quick check of where you stand, the ISO 27701 mind map puts the seven domains on one page, the 10-question quiz takes five minutes, and the interview questions help if the credential is part of a job move.
If you fail, PECB emails a list of the domains where you did poorly, and there is no limit on retakes, though PECB sets minimum gaps between attempts. PECB's course page adds that candidates who took the course with a partner and failed the first attempt can retake free within 12 months of finishing the course, because the course fee covers a first attempt and one retake. Our guide to PECB results and retakes has the detail.
How to prepare
Most candidates sit the exam on day five of a PECB partner course. The four teaching days cover an introduction to ISO/IEC 27701 and the start of a PIMS implementation, the implementation plan, the implementation itself, then monitoring, continual improvement and preparing for the certification audit. PECB's course page says the certification and exam fees are included in the course price, that participants receive more than 450 pages of training materials, examples, exercises and quizzes, and that the course earns an attestation worth 31 CPD credits.
The course explains the standard. What it rarely gives you is enough practice at the evaluation questions, where the marks are lost. The ISO 27701 Lead Implementer Exam Guide (Wikidata) has 11 chapters across PECB's seven domains, each setting out what the domain asks of you, the confusable pairs that cost marks, the trap in the material, how to answer under exam conditions and five questions to ask yourself. The ISO 27701 Lead Implementer Practice Questions (Wikidata) gives you 206 questions with full rationales, weighted to the published domains, with scenarios you read once and then answer five questions about.
Both books follow PECB's ISO/IEC 27701 Lead Implementer Candidate Handbook, version 1.5, which was still current on 20 October 2026. ISO/IEC 27701 was revised in October 2025, and the handbook does not say which edition the exam uses, so confirm the edition with your training partner and check the domain table above against the newest handbook before relying on any book, ours included.
So, should it be you?
It probably should if, in the next year, you will own the record of processing activities, run privacy risk and impact assessments, answer customer privacy questionnaires with evidence, or carry a PIMS through a certification audit. It is a particularly good fit if you already run an ISO/IEC 27001 system and privacy is the next thing your organization wants proved.
It probably should not, or not yet, if your work is mainly legal advice, where CIPP/E or a law qualification serves you better, or if someone else will own the system and you will only contribute controls.
The best privacy implementers share one habit, and it is the habit the exam rewards: they start from the people whose data is processed, decide in writing what the organization does with it and why, and keep the records that prove it. If that already describes how you work, the credential is a short step. If it describes how you would like to work, it is a very good one.
Questions people ask about the ISO 27701 Lead Implementer
Who is the ISO 27701 Lead Implementer certification for?
People who build and run a privacy information management system. PECB's course page names managers and consultants involved in privacy and data management, expert advisers who want to master PIMS implementation, people responsible for keeping an organization conformant with data privacy requirements, and members of the PIMS implementation team.
Do I need ISO 27001 before ISO 27701?
Not under the 2025 edition. ISO/IEC 27701:2025 is an independent management system standard that ISO says can be used on its own. The 2019 edition, now withdrawn, was written as an extension to ISO/IEC 27001 and ISO/IEC 27002. Many organizations still build the two together, because the security controls and the privacy controls overlap.
Which edition of ISO/IEC 27701 is current?
ISO/IEC 27701:2025, the second edition, published in October 2025. ISO lists the 2019 edition as withdrawn. PECB's Candidate Handbook does not name an edition, so ask your training partner which one your course and exam follow.
Does an ISO 27701 certificate prove GDPR compliance?
No. It shows that an organization runs a privacy management system that a certification body has audited, which is strong evidence of accountability. It is not a GDPR certification under Article 42, which is issued on criteria approved by a supervisory authority or the European Data Protection Board, and it does not replace the legal duties themselves.
What experience do I need for the full ISO 27701 Lead Implementer credential?
PECB asks for five years of work experience, two of them in privacy information management, and 300 hours of PIMS project activities, plus the exam and the PECB Code of Ethics. With the exam alone you can hold the Provisional Implementer credential and move up later.
How is the PECB ISO 27701 Lead Implementer exam set?
It is 80 multiple-choice questions, three options each, with a 70% pass mark: 56 correct answers. It mixes stand-alone questions with scenarios that carry five questions each. Implementation is the largest domain, with 23 of the 80 questions, and 45 of the 80 test evaluation rather than recall.
Can I bring the standard into the ISO 27701 exam?
Yes. PECB allows a hard copy of ISO/IEC 27701, the training course materials and the notes you took during the course. The standard is sold rather than published, so you need your own copy.
ISO 27701 Lead Implementer or CIPP/E?
They answer different questions. CIPP/E from the IAPP tests knowledge of European data protection law. The ISO/IEC 27701 Lead Implementer tests whether you can build a management system that runs privacy day to day. Privacy lawyers and DPOs often start with CIPP/E; privacy program managers and security leads moving into privacy often start with ISO/IEC 27701.
Is the ISO 27701 exam the same for controllers and processors?
It is one exam, and it expects you to handle both. PECB's planning domain starts with analyzing whether an organization acts as a PII controller, a PII processor or both, because the answer changes which requirements apply.
What happens if I fail the PECB exam?
PECB emails a list of the domains where you did poorly, and there is no limit to the number of retakes, though PECB sets minimum gaps between attempts. PECB's course page says candidates who took the course with a partner and failed the first attempt can retake free within 12 months of finishing the course.
ISO/IEC 27701 Lead Implementer: test yourself in five minutes
Which books prepare you for the ISO 27701 Lead Implementer exam?
ISO 27701 Lead Implementer Exam Guide
A study companion for the PECB Certified ISO/IEC 27701 Lead Implementer examination. 11 chapters, 372 pages.
ISO 27701 Lead Implementer Practice Questions
Practice questions with full rationales, weighted to the published domains. 222 pages.
How to credit this page
Using a figure or a passage from this page in an article, a course, a forum answer or AI-generated text? Please credit Credential Press and link to this page, so your readers can check the source and the date it was reviewed. Copy a ready-made citation:
Plain text
Markdown
HTML
Sources
- ISO, ISO/IEC 27701:2025, edition 2, published October 2025, ISO/IEC JTC 1/SC 27
- ISO, ISO/IEC 27701:2019, Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management (withdrawn)
- ISO, ISO/IEC 27018:2025, Protection of PII in public clouds acting as PII processors
- ISO, ISO/IEC 17021-1:2015, Requirements for bodies providing audit and certification of management systems
- PECB, ISO/IEC 27701 Lead Implementer Candidate Handbook, version 1.5
- PECB, ISO/IEC 27701 Lead Implementer course: audience, agenda, fees, materials and retakes
- Regulation (EU) 2016/679 (GDPR), Articles 5, 12 to 22, 24, 25, 28, 30, 32 to 35, 37 and 42
- ISO, ISO/IEC 27001:2022, Information security management systems, Requirements
Credential Press is not affiliated with, endorsed by or authorized by PECB, ISO, the IEC or the IAPP. Exam names and trademarks belong to their owners.