What is ISO/IEC 27701 and does it certify GDPR compliance?

ISO/IEC 27701 is the international standard setting out the requirements for a privacy information management system, the PIMS: policies, roles, impact assessments and controls through which an organization manages the personal data it processes as a controller or as a processor. The 2019 edition defined it as an extension of ISO/IEC 27001 and ISO/IEC 27002, certifiable only by organizations that already ran an active information security management system (ISMS). The current edition, ISO/IEC 27701:2025, published in October 2025 as its second edition, changes that: it adopts the harmonized structure of management system standards and becomes certifiable on its own, with no ISMS as a prerequisite, while still designed to integrate with 27001 where one already exists. The certificate comes from a third-party certification body, which in Italy is accredited by Accredia, after an initial audit and then annual surveillance audits for the whole life of the certificate.

See also: ISO/IEC 27001 · The international standard for an information security management system, certifiable by third-party bodies.

What the certificate shows, and what it does not

An ISO/IEC 27701 audit checks that a system exists: an inventory of processing activities, assigned roles, a procedure for answering people who ask about their own data, an impact assessment where one is needed. It does not check that every processing activity is lawful under the GDPR, nor that the legal bases chosen are the correct ones: that judgment requires a case-by-case legal analysis that no certification body performs. The standard's structure explicitly separates requirements for whoever decides how personal data is processed (PII controller) and whoever processes it on someone else's behalf (PII processor), the same line that European law draws between controller and processor: anyone who wants that distinction explained in full finds it in the entry on data controller vs. processor. The certificate attests that the organization applies those roles consistently, not that it chose them correctly for every single processing activity.

An enterprise example

An HR software vendor processes employee data on behalf of dozens of corporate clients, so it acts as a processor. A banking client's tender asks for verifiable proof that data is managed with a method, not just a compliance statement signed by the vendor. The vendor obtains ISO/IEC 27701 certification on top of an existing 27001 ISMS: the auditor checks the register of processing carried out for third parties, the contracts carrying the clauses Article 28 of the GDPR requires, and the breach notification procedure. The certificate does not replace the data processing agreement the client signs anyway, but it cuts down the questions the vendor has to answer one by one in every due diligence, because the structure is already documented and verified by a third party.

Why it matters for decision makers

The commercial risk is selling or buying ISO/IEC 27701 as though it were a certification of GDPR compliance. It is not: the GDPR has its own certification mechanisms, set out in Article 42, and 27701 is not one of them. More to the point, Article 42(4) states that not even a certification issued under the GDPR reduces the controller's or the processor's responsibility. Anyone presenting the certificate as "we are GDPR compliant" is conflating two different things. What the certificate actually demonstrates to a customer or an authority is more modest and more solid at once: a method exists, it is documented, and an independent third party has verified it. For a company processing personal data at scale, or on behalf of regulated clients, that proof shortens due diligence and tenders; substantive compliance with the GDPR and AI still requires its own legal assessment, which the certificate does not replace.

This entry is informational and does not constitute legal advice: for decisions on GDPR compliance, involve a DPO or legal counsel.