ISO/IEC 27701 certification
Independent certification of how your organization manages personal information and its privacy responsibilities.
Service from . Quotations by email; portal support after the holiday break.
Email for a quotationUnderstanding the standard
ISO/IEC 27701:2025 sets requirements and guidance for a privacy information management system (PIMS). It addresses organizations acting as controllers or processors of personally identifiable information. The 2025 edition is a standalone management system standard; ISO/IEC 27001 certification is not a prerequisite.
Privacy responsibilities in your scope
The audit considers how your organization identifies privacy responsibilities and risks, selects relevant measures and keeps evidence of their operation. The scope needs to reflect the personal information processed, the services involved and the organization’s role.
A PIMS gives you a systematic way to manage privacy obligations and evidence. An ISO/IEC 27701 certificate does not by itself prove compliance with a privacy law or act as a regulator’s approval.
Managing privacy obligations
Your activities, jurisdictions and role determine which privacy duties apply. A PIMS can organize how you identify those duties, assign responsibility, keep evidence and review results. It can support work on the General Data Protection Regulation (GDPR), the US Health Insurance Portability and Accountability Act (HIPAA) or Ontario’s Personal Health Information Protection Act (PHIPA), where those laws apply.
ISO/IEC 27701 certification is not by itself certification under GDPR Article 42, a US government-recognized HIPAA certification or an approval under PHIPA. Your organization remains responsible for evaluating and meeting its legal obligations.
Official GDPR textHHS: private certifications and HIPAAIPC: health privacy in Ontario
One organization, an integrated management system
ISO/IEC 27001 remains our core service. ISO/IEC 42001 and ISO/IEC 27701 also address AI and privacy risks, with requirements of their own. ISO 9001 addresses the quality of products and services. Each standard can be used on its own or integrated with the others.
It is the same organization and its context. Where activities overlap, governance and common information can be shared. One internal audit programme and a joint management review can cover the integrated system, provided the requirements, competence, results and decisions needed for every standard are addressed. The scopes may differ and must remain explicit.
Complade reviews the degree of integration before planning a combined audit. Required audit hours and competence remain specific to each standard. Your organization arranges its internal audits; Complade provides independent certification.
The certification engagement
The process includes application and scope review, Stage 1 and Stage 2 evaluation of the management system, action on nonconformities and a certification decision independent of the audit team. Delivery and scheduling are confirmed from the activities, available evidence and required competence.
Complade provides the independent assessment. Your organization implements the system and arranges its internal audits and management review. Complade does not provide implementation consulting or internal audits for its certification clients.
Read the audit processAudit hours and pricing
Pricing will follow the same method as ISO/IEC 27001 and CyberSecure Canada: the audit hours actually required for the scope, with administrative overhead kept to a minimum through the portal and a streamlined process. The hours depend on the standard’s own rules and the complexity of the activities.
Numeric prices have not yet been published. Email certification.info@complade.com with your scope, people in scope and sites, readiness and target dates.
Complade customers: 30% off each additional standard
Complade customers receive a 30% discount on the certification fees for each additional standard they add. The quotation shows the base fee and the discount. Required audit time is determined from the scope and applicable rules; the discount does not reduce that time. Taxes and travel are stated separately.
Accreditation and engagement terms
Complade’s accreditation for ISO/IEC 27001 and CyberSecure Canada does not automatically cover another standard. Your quotation will state the requested programme’s accreditation status and applicable terms before you commit. Required competence and certification arrangements will be confirmed for your scope.
Check Complade’s official SCC accreditation scopePrivacy management and audit resources
Complade’s detailed resources for this standard are being prepared.
Resources coming soon