ISO 27701 Privacy Information Management System Certification

ISO 27701 is an international standard that adds a privacy information management system (PIMS) to ISO 27001, specifying requirements that help organizations manage and protect personal information securely.

It aims to manage an organization's entire personal data processing systematically, reducing the risk of leaks and raising trust.

Background

As companies collect more personal information, data breaches are also increasing — and so is the need for a systematic framework for processing personally identifiable information.

• Building and operating a PIMS
• Privacy impact assessment (PIA)
• Managing collection, use, provision, storage and disposal
• Compliance with legal and regulatory requirements
• Responding to privacy breaches and continual improvement

This scheme extension is planned for January 2027. See our History for the schedule.

• ManufacturingManufacturers collecting and processing personal data
• ServicesCompanies processing customer and member data
• Public sectorAdministrative services and public data operators
• HealthcareOrganizations processing patient and medical records
• IT & tech companiesWeb and app services, cloud platforms
• Consulting and other industriesAny organization collecting and processing personal data

With privacy regulation tightening and stakeholder trust becoming critical, ISO 27701 is an effective way to formally demonstrate your privacy capability, reduce risk and compete in global markets.

• Regulatory complianceMeeting privacy laws and regulations
• Greater customer trustStronger trust in how personal data is protected
• Operational efficiencyImproved and standardized privacy processes
• Global competitivenessMeeting international standards eases market entry
• Better corporate imageTrust through responsible data management

• A management framework for handling personal information
• Systematic procedures for managing personally identifiable information

1. ApplicationConfirm standard and scope, submit the form
2. Review & contractScope review, schedule and requirements
3. Audit planningAudit plan prepared and shared
4. Certification auditEvidence from documents, site and interviews
5. Review of resultsConformity and corrective actions reviewed
6. Certificate issuedCertificate stating scope and standard

• Application form (company details, scope, sites, number of employees)
• Copy of business registration certificate
• Management system documents (manual, procedures, etc.) — reviewed during the audit

Coming soon — the list of documents to submit will be published after confirmation by KOCI. Meanwhile, please ask us via Inquiry or by phone.

After reviewing your application, our staff will explain the scope, process and schedule individually.