A privacy information management system in its own right. We audit your PIMS against ISO/IEC 27701 and, on the evidence, issue certification — independently of the audit team.
Accredited certification available within the authorised scope — subject to scheme-specific scope and competence requirements. See the full Accreditation & Scope matrix.
ISO/IEC 27701 sets out a privacy information management system (PIMS): the controls and responsibilities needed to manage personal data as a controller or processor, supporting obligations under privacy law.
The 2025 edition carries its own management system requirements in clauses 4 to 10. Where the 2019 edition was an extension that could only be certified alongside ISO/IEC 27001, the current edition can be certified on its own — privacy no longer waits on an information security certificate.
As an independent certification body, Skyeblanc Certification audits your privacy information management system against ISO 27701 and, where the evidence supports conformity, issues certification. We do not design, document or improve your system — that separation is a requirement of ISO/IEC 17021-1 and is exactly what gives an ISO 27701 certificate its meaning.
The certification decision is made by an independent decision-maker who did not conduct your audit.
The same defined path for every applicant — the certification decision held independent of the audit team.
A readiness review of your documented PIMS — your PII controller and processor roles, the privacy risk assessment, the PIMS scope, and the applicability of each control. Where an information security management system is also in place, how the two relate.
Assessment of the PIMS in operation: the privacy-specific controls, records of processing activities, and the handling of PII principal rights — together with the interface to your information security management system where one exists.
An independent decision-maker reviews the evidence and grants — or declines — certification.
Annual surveillance audits, then a full recertification at year three renews the cycle.
Audit duration for ISO 27701 is determined by the applicable scheme requirements — never a flat rate. The main factors:
The number of people — including shifts and part-time — is the primary driver of audit duration.
How many sites and where. Multi-site sampling follows IAF MD1.
The range of activities and processes within your certified scope.
Operations across multiple shifts can extend on-site audit time.
Transfers from another accredited body are reviewed under IAF MD2.
On-site or ICT-assisted remote auditing per IAF MD4, matched to risk.
Fees are fixed for the defined audit programme. A fixed fee covers the audit; it never buys an outcome — certification is granted only on the evidence, by an independent decision-maker.
ISO/IEC 27701 suits any organisation that processes personal data and wants to demonstrate privacy governance. We routinely audit across:
Tell us your scope, sites and employee numbers, and we'll return a fixed-fee audit quotation with the programme and timeline.
Prefer pricing first? Request an audit quotation →
