FRAMEWORK · PRIVACY MANAGEMENT
Last reviewed 30 October 2026ISO/IEC 27701:2025 sets out how to run a privacy information management system. Since the 2025 edition it stands on its own, and it is written to align or integrate with an ISO 27001 information security management system. We add it to the ISMS you already run, or build both together.
Up to 50 people in scope. Certification body fees are separate and paid to the certification body.
WHERE THIS FRAMEWORK FITS
ISO 27701 is delivered alongside Goldline's ISO 27001 work. We add it to an ISMS you already run, build the two together in the Integrated Sprint, or move a 2019 certificate to the 2025 edition.
All three are fixed and published, plus VAT, for up to 50 people in scope. The certification body's fees are separate and paid to the certification body.
For active engagement, book a free 45 minute diagnostic and we'll confirm which of the three fits, and which certification route is open to you.
Book the Free DiagnosticWHAT IT IS
ISO/IEC 27701 was first published in 2019 as an extension to ISO 27001. The 2025 edition replaced it and is a management system standard in its own right, with its own requirements in clauses 4 to 10 and normative controls for organisations acting as controllers, processors or both. ISO has withdrawn the 2019 edition.
If you already run an ISO 27001 ISMS, most of the machinery is there: scope, risk method, internal audit and management review. ISO 27701 adds the privacy side, including your role for each processing activity, a personal data inventory, privacy risk, and the controls for individuals' rights, processors and transfers.
Sources: iso.org/standard/27701; UKAS Technical Bulletin, Transition Arrangements for PIMS, Revision 1, 18 August 2026 (replaces the bulletin of 18 March 2026).
WHO IT'S FOR
Not for organisations that need legal advice on lawful basis, notices or international transfers. That is work for your solicitor or DPO, and we'll work alongside them.
WHAT YOU GET
£5,500 + VAT
£12,500 + VAT
from £2,950 + VAT
Excluded from all three: legal advice, privacy notice drafting, transfer risk assessments, remediation of technical findings and certification body fees. Readiness work credits in full against a Sprint started within six months.
HOW WE DELIVER
Phase 1
Processing activities mapped, controller and processor roles set, the ISMS scope extended or confirmed.
Phase 2
Gap assessment against ISO/IEC 27701:2025 and privacy risk assessed with your existing risk method.
Phase 3
Controls put in place, Statement of Applicability written, procedures and records built and evidenced.
Phase 4
Internal audit and management review run on the combined system, and the evidence pack prepared for the certification body.
WHAT IT ISN'T
| ISO 27701:2025 | ISO 27001 | UK GDPR certification (Article 42) | |
|---|---|---|---|
| Type | Privacy management system standard | Information security management system standard | Certification scheme approved under UK GDPR |
| Covers | How privacy is run, for controllers and processors | How information security is run | Whether specific processing complies with data protection law |
| Certified by | A certification body | A certification body | A certification body accredited for an approved scheme on the regulator's register |
ISO 27701 does not make an organisation GDPR compliant and is not on the regulator's register of UK GDPR certification schemes. It shows how privacy is managed, which customers can check.
QUESTIONS
WHAT COMES NEXT
A 45 minute call sets out whether ISO 27701 fits your scope now, which route to certification is open, and what it would take from where your ISMS stands today.
We use cookies to measure the site and improve it.
We use cookies and similar technologies to measure how this site is used and to measure our advertising. Until you choose, Google tags run in a consent-limited mode that sets no cookies. If you accept, we load Google Analytics 4 and Google Ads with cookies, PostHog, Plausible and Microsoft Clarity, which records session replays. Read our Cookies policy.