Privacy information management
ISO/IEC 27701: privacy information management
Protect personal data. Prove it.
ISO/IEC 27701 is the privacy information management standard. It builds on information security management to cover personal data: why it is processed, who can reach it, how long you keep it, and how you respond when people exercise their rights. It gives you structured evidence of how you handle customer and employee data.
What the standard asks for
- Records of how personal data is processed, and why
- Clear controller and processor responsibilities, including in contracts
- A process for data subject requests and for privacy risk
- Retention, sharing and disposal rules for personal data
- Internal audit, management review and continual improvement
When it usually comes up
Processing personal data at scale, processor contracts that ask for evidence, or preparing for stricter privacy law.
Good to know
- It supports your work under Malaysia's Personal Data Protection Act 2010 (as amended in 2024) by building the records and processes those duties depend on. Certification does not by itself make an organisation compliant with the law.
- It applies whether you decide why personal data is processed (controller) or process it for someone else (processor).
How we help with ISO/IEC 27701
- Gap analysis
- Know exactly where you stand before you commit.
- Documentation
- Policies and procedures built around how you actually work.
- Implementation support
- Hands-on guidance from roadmap to rollout.
- Risk assessment
- Identify and treat risks before they become findings.
- Internal audit
- Find the gaps before the external auditor does.
- Training
- Your team understands the system and keeps it alive.
- Certification support
- Preparation for the Stage 1 and Stage 2 audits run by your chosen certification body.
- Maintenance
- Support through surveillance audits and continual improvement.
We advise and prepare. Certification is issued by an accredited certification body that is independent of us.
Often built together with
The ISO management system standards share one structure, so what you build for ISO/IEC 27701 is reused when you add another.
Working towards ISO/IEC 27701?
A scoping call is a conversation about your organisation, the standards in play, and what a sensible first step looks like.