What ISO 27701 is
ISO/IEC 27701 sets requirements for a privacy information management system: how an organisation manages personal data as a controller, as a processor or as both. The first edition, from 2019, was an extension to ISO 27001. The 2025 edition stands on its own and can be certified without ISO 27001, with its own set of security controls. It has separate controls for controllers and processors, and maps them to the GDPR and other privacy laws.
What customers ask
The questions overlap with a GDPR vendor assessment, organised by the standard's control sets:
- Whether you are certified, to which edition, and what the scope covers.
- Your role for the customer's data, which for a SaaS vendor is usually processor.
- How you handle the customer's instructions, help with data subject requests, and keep records of processing.
- Sub-processors: who they are, how they are bound, and how the customer is told about changes.
- Transfers outside the EU, and the safeguards that apply.
- Retention, return and deletion at the end of the contract.
- How a personal data breach is detected and reported to the customer.
Answering with a certificate
Attach the certificate and quote its scope and its edition. Reviewers who know the standard will ask for the processor controls you have chosen and how they are implemented, much as an ISO 27001 reviewer asks for the statement of applicability.
Answering without one
Answer each row as you would in a GDPR assessment: the fact, the owner, the evidence. Your data processing agreement, sub-processor list and breach procedure answer most of the rows. If you hold ISO 27001 and plan to add 27701, say so with a date.
In Responsemate
The DPA, the sub-processor list and any certificate sit in the knowledge base as evidence with review dates, and the privacy rows of every questionnaire are drafted from the same approved answers, so they do not drift between customers. GDPR vendor assessment questionnaires.
Questions people ask
Do we need ISO 27001 before ISO 27701?
Not any more. Under the 2019 edition, ISO 27701 was an extension of ISO 27001 and could only be certified on top of it. The 2025 edition is a standalone management system standard, although most organisations still run the two together.
Does ISO 27701 certification prove GDPR compliance?
No, and a reviewer will not read it that way. It shows that privacy is managed in a structured way, with controls that map to the GDPR, which makes the privacy section of a questionnaire easier to answer and to trust.