02 / Compliance and certification
ISO/IEC 27701, privacy with a management system behind it
We help you build a privacy information management system that shows how personal data is handled, by whom and why, in a form a certification body can audit.
Overview
What ISO/IEC 27701 covers
ISO/IEC 27701 sets out requirements and guidance for a privacy information management system (PIMS). It looks at personal data from two sides: as a PII controller, deciding why and how data is processed, and as a PII processor, handling data on someone else's behalf.
The standard was built to work with an ISO/IEC 27001 information security management system, and most organisations still implement it that way. Recent editions have changed how the two standards relate, so we confirm early which edition your certification body audits against and plan around it.
Certification is issued by an accredited certification body. Black Fox prepares you, maps the work to your GDPR obligations where they overlap, coordinates the audit with our long-standing certification partners or a body of your choice, and stays with you through it if you want us there.
Who it is for
Organisations that process personal data for clients and are asked to prove how they protect it, controllers who want their privacy programme audited, and teams that already run an ISO/IEC 27001 ISMS and want privacy inside the same system.
The work, from scoping to evidence.
What we do
Roles and scope
We work out where you act as controller, where as processor, and which processing activities the PIMS covers.
Gap assessment
A review of your current privacy and security practice against the standard, with findings ranked by risk and effort.
Privacy risk and impact
A privacy risk method that sits beside your information security risk assessment, and impact assessments where processing calls for them.
Records and controls
Records of processing, retention, data subject requests, transfers and subprocessor management, each tied to evidence.
Policies and procedures
Privacy documents written for the people who use them, integrated with your existing ISMS instead of stacked next to it.
Internal audit
An internal audit of the PIMS, independent of the people who built it, with findings you can still close before certification.
How the engagement runs
Kickoff
We agree the scope, your roles as controller and processor, the people involved and the deadline. An NDA comes first if you need one.
Gap assessment
Interviews, document review and a look at how personal data actually moves, ending in a prioritised gap report.
Implementation support
We work with your owners on the gaps: records, controls, contracts, procedures and evidence.
Internal audit
A full internal audit against the standard, run like the real one.
Certification audit
We coordinate the audit with one of our long-standing certification partners or the accredited body of your choice, help you prepare and help with any findings that follow.
What you receive
- PIMS scope statement with controller and processor roles
- Gap assessment report with a prioritised action plan
- Privacy risk register and treatment plan
- Records of processing and supporting procedures
- Updated Statement of Applicability or control mapping
- Internal audit report
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Do we need ISO/IEC 27001 first?
It depends on the edition your certification body audits against and how it structures certification. In practice most organisations run ISO/IEC 27701 together with an ISMS, because the security controls carry much of the privacy work. We check this with you at kickoff.
Does ISO/IEC 27701 make us GDPR compliant?
No standard does that on its own. ISO/IEC 27701 overlaps with many GDPR obligations and gives you a structured way to show how you meet them, but the regulation remains the reference. We map one to the other so the gaps are visible.
Do you issue the certificate?
No. Certificates come from accredited certification bodies, independent of whoever helped you implement. We prepare you, coordinate the audit with one of our long-standing certification partners or a body of your choice, and support you through it, so you go from preparation to the certificate in one engagement.
We are a processor. Does that change much?
Yes. The standard has separate guidance for controllers and processors. A processor focuses on following instructions, supporting its customers' obligations and managing its own subprocessors.
Related services
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Compliance and certificationGDPRGDPR support from Black Fox Security: records of processing, DPIAs, security of processing, processor agreements, breach handling and data subject requests.
- Compliance and certificationISO/IEC 27017 and 27018ISO/IEC 27017 and 27018 support from Black Fox Security: cloud control gap assessment, shared responsibility, PII processor controls and audit preparation.
- Governance and riskPolicies and proceduresBlack Fox Security writes and reviews your security policies: acceptable use, access control, incident response, suppliers, backup and more, in plain language.
Find out where your privacy programme stands
Tell us what personal data you handle and for whom. We will show you what the standard expects and what is missing.