ISO 27701
ISO/IEC 27701 — Privacy Information Management System
The privacy extension to ISO 27001 — mapping to PIPEDA and GDPR
ISO 27701 extends ISO 27001 with privacy-specific controls to create a Privacy Information Management System (PIMS). It maps directly to GDPR, PIPEDA, and other privacy frameworks — providing a single certification that satisfies multiple regulatory requirements. For Canadian businesses with European customers, ISO 27701 is increasingly expected.
Who must comply with ISO 27701?
Any organization that has already implemented ISO 27001 and processes significant volumes of personal information. It's particularly relevant for SaaS companies, healthcare technology providers, HR platforms, and financial services handling EU or Canadian personal data.
Not sure if ISO 27701 applies? Run a free assessment →
Key obligations under ISO 27701
PII Processor Obligations
Document your role as a PII processor vs. controller for every data flow. Map processor-controller relationships contractually.
Privacy Risk Assessment
Conduct privacy impact assessments for high-risk processing activities using the ISO 27701 PIMS risk framework.
Consent Records Management
Maintain structured records of all PII subject consents including purpose, date, method, and withdrawal status.
PII Transfer Controls
Implement controls for cross-border PII transfers including contractual safeguards and impact assessments.
Individual Rights Response
Define and operationalize processes for access, correction, portability, erasure, and objection requests.
Privacy by Design
Embed privacy considerations into system design, procurement, and product development from the outset.
Penalties & enforcement
Run a free ISO 27701 gap assessment
Answer 47 questions, get a scored gap report, and see exactly what you need to do to comply with ISO 27701 — in under 3 hours. Free forever.
Start free assessment