Get audit-ready for ISO 27701
ISO/IEC 27701:2019 · Privacy Information Management System
Extension to ISO 27001 and ISO 27002 for privacy information management, providing guidance for PII controllers and processors to manage privacy risks.
ISO 27701What is ISO 27701?
Extension to ISO 27001 and ISO 27002 for privacy information management, providing guidance for PII controllers and processors to manage privacy risks.
Who it applies to
Organisations already running an ISO 27001 management system that need to evidence privacy management to customers or regulators. Often the practical answer when a customer asks for "GDPR certification", which does not exist.
How the standard is organised
An extension to ISO 27001 and 27002 that adds privacy-specific requirements and separates duties by role — PII controller and PII processor — rather than standing alone.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
ISO 27701 on the Bitkosh platform
The 26 ISO 27701 controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- A.7.2.3Determine when and how consent is obtained
Set a clear, repeatable process for how consent gets asked for and captured, so it isn't ad hoc from one form to the next.
Consent Management - A.7.3.4Modify or withdraw consent
Make it genuinely possible for someone to change their mind and pull consent, not just a dead-end contact form.
Consent Management - A.7.5.1Basis for PII transfer between jurisdictions
Confirm and record the legal mechanism that actually permits moving personal data across a border.
Cross-Border Transfer - A.7.3.1Obligations to PII principals
Work out what you actually owe the people whose data you hold, and write down how you're delivering on it.
Data Subject Rights - B.8.2.1Customer agreement
As a processor, stick strictly to what your customer has actually instructed -- don't process data beyond that scope on your own initiative.
PII Processor - A.7.3.10Automated decision making
Flag where a decision about someone is made automatically, and handle the extra obligations that come with that.
Data Subject Rights
More privacy & data protection frameworks
Frequently Asked Questions
Who publishes ISO 27701, and who does it apply to?
How is ISO 27701 conformance demonstrated?
How is ISO 27701 structured?
Ready to get audit-ready for ISO 27701?
See how the Bitkosh Readiness Platform gets you audit-ready for ISO 27701 — and the other 47 ready frameworks — from a single control library.