ISO 27701 Implementation

From data inventory to a working PIMS. We build the privacy management system around how your organisation actually processes personal data, then help your people run it, so certification is the result of good privacy practice, not a paperwork exercise.

1. 01

   Set scope and ownership

   Define the PIMS boundary, your role as PII controller or processor, governance and certification objectives.

2. 02

   Map processing and gaps

   Inventory PII processing, data flows and third parties, and assess practices against ISO/IEC 27701:2025.

3. 03

   Build the privacy risk process

   Establish the method, risk register, treatment plan and accountable risk owners for privacy risk.

4. 04

   Shape policies and controls

   Adapt privacy policies, notices and data subject rights procedures to your real environment and obligations.

5. 05

   Create the Statement of Applicability

   Record control decisions, justifications, implementation status and links to evidence.

6. 06

   Make it audit-ready

   Coach control owners, build the evidence trail and prepare management for certification.