They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
6STEPS TO CERTIFICATION
ISO 27701 is certified as an extension of ISO 27001. Here is the path from gap analysis to the Stage 1 and Stage 2 audits — and what it takes to keep the certificate live afterwards.
Built on an ISO 27001 ISMS — existing or certified at the same time.
6Steps to certification
Stage 1+2Audit structure
3-yearCertificate cycle
ISO/IEC 27701:2019 · Accredited certification body audit · Last reviewed June 2026
Direct Answer
How do you get ISO 27701 certified?
ISO 27701 cannot be certified on its own — it is an extension of ISO 27001, so an ISMS must be in scope first. From there the path is the familiar management-system one: gap analysis, documentation, control implementation, internal audit, and then a two-stage audit by an accredited certification body. The certificate runs on a three-year cycle with annual surveillance.
Key Takeaways
- ISO 27701 cannot be certified on its own — an ISO 27001 ISMS is the prerequisite.
- The audit has two stages: a documentation review (Stage 1) and an evidence-based audit of the operating PIMS (Stage 2).
- Certificates run a three-year cycle with annual surveillance and a recertification audit.
- Realistic timelines depend on scope, the volume of PII, and starting maturity — not a fixed number of weeks.
The path
Six steps to certification
Step 1
ISO 27001 in place
Because ISO 27701 extends ISO 27001, you need a certified ISMS first — or you run both programmes together. This is the foundation the PIMS builds on.
Step 2
Privacy gap analysis & scoping
Map where PII is collected and processed, fix your role as controller or processor (or both), and assess current practice against the Annex A and B controls.
Step 3
PIMS documentation
Extend the ISMS with a privacy policy, records of processing, a privacy impact-assessment process, and the Statement of Applicability covering the PIMS controls.
Step 4
Implement privacy controls
Operationalise consent, PII principal rights, retention and disposal, and transfer controls — then generate the evidence that they are working.
Step 5
Training & internal audit
Train staff on the privacy controls, run an internal PIMS audit, hold a management review, and close any findings with corrective action.
Step 6
Certification audit
An accredited certification body runs the Stage 1 documentation review and Stage 2 audit of the PIMS. Once non-conformities are closed, it issues the ISO 27701 certificate.
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Frequently Asked Questions
Common questions about ISO 27701 certification.
Do I need ISO 27001 before ISO 27701?
Yes. ISO 27701 is an extension to ISO 27001, so the ISMS must be in scope — either already certified or audited at the same time. Many organisations run the two programmes together to save effort.
What is the difference between the Stage 1 and Stage 2 audits?
Stage 1 is a documentation review where the certification body checks that your PIMS is designed correctly and ready. Stage 2 is the deeper, evidence-based audit confirming the privacy controls operate in practice. The certificate follows once any non-conformities are closed.
How long is an ISO 27701 certificate valid?
Like ISO 27001, the certificate runs on a three-year cycle with annual surveillance audits, then a recertification audit at the end. The PIMS has to keep operating between audits — it is an ongoing system, not a one-time project.
How long does it take to get certified?
Added to an existing ISO 27001 ISMS, a PIMS programme often reaches the certification audit in a few months. Building ISO 27001 and ISO 27701 together takes longer. The timeline depends on scope, the volume of PII, and your starting maturity rather than a fixed number.
Continue your ISO 27701 research
- ISO 27001 certification process — the prerequisite ISMS certification, step by step.
- ISO 27701 templates & downloads — the PIMS toolkit to accelerate documentation.
- ISO 27701 hub — PIMS overview, controls, and certification in one place.
Keep Exploring
Related Reading
Privacy
ISO 27701 (PIMS)
The privacy extension to ISO 27001 — one audit, two certificates.
Read morePrivacy
PIMS Framework Explained
How the Privacy Information Management System extends an ISMS.
Read morePrivacy
Controller Controls (Annex A)
PII controller-specific controls mapped to GDPR obligations.
Read morePrivacy
Processor Controls (Annex B)
PII processor-specific controls for data processing agreements.
Read moreISO 27001
ISO 27001 Certification Guide
The step-by-step path from gap assessment to certificate.
Read moreTrust
Proof & Track Record
Every number we publish — explained, sourced and verifiable.
Read more