FRAMEWORKS / READINESS / Privacy
ISO/IEC 27701
Privacy information management across roles, processing, controls, and personal data evidence.
SCOPE & APPLICABILITY
What the framework actually requires
Privacy information management standard; confirm the applicable edition and requirements before assessment.
What matters in practice
Requirements depend on scope. These are the areas to evaluate, not a guarantee of certification or regulatory compliance.
Controller/processor roles
Map activities and responsibilities.
Privacy risks and records
Identify relevant privacy controls.
Policies, owners, and evidence
Manage ongoing reviews and evidence.
An operational path, not a checkbox exercise
Translate requirements into accountable activities, evidence and reviewed controls.
Map activities and responsibilities.
Identify relevant privacy controls.
Manage ongoing reviews and evidence.
APPLICABILITY
Who should assess this framework?
For organisations processing personal data that want a structured privacy information management system. Controller/processor roles and the standard edition matter.
BEYOND CHECKLISTS
Why this matters
A data inventory quickly becomes stale without ownership. Privacy governance should connect processes, suppliers, accountable people and system changes.
EVIDENCE & OPERATIONS
What your organisation should be able to evidence
This is a practical starting point, not an exhaustive set of regulatory obligations or a substitute for an independent audit.
- 01 Processing activities and personal data inventory
- 02 Controller, processor and subprocessor responsibilities
- 03 Privacy and retention policies
- 04 Risk assessments and DPIAs where required
- 05 Data subject rights request procedure
- 06 Review, training and provider oversight records
FAQ
Frequently asked questions
Practical distinctions worth understanding before starting your programme.
Does ISO 27701 replace GDPR?
No. It is a privacy information management standard. GDPR remains applicable law where its scope conditions are met.
Do we need ISO 27001 first?
Check the applicable edition and certification body's requirements. The relationship with an ISMS and certification criteria can differ by edition.
Is a complete RoPA enough?
No. A good record helps, but accountability, operational safeguards, periodic review and evidence also matter.
FURTHER READING
Explore related resources
Use original ZebraByte articles and guides to explore security programmes, privacy governance and readiness.
Framework descriptions are educational. Applicability, service availability and any independent assessment require confirmation for your organisation.
Important scope boundary
ZebraByte can discuss readiness, technical controls and programme management. A regulator, qualified auditor or certification body makes the applicable independent determination. Support for a particular framework is subject to the agreed service scope.
Related frameworks and programmes
Need a scope assessment for your organisation?
Share your sector, systems and contractual requirements. We can outline the next practical steps and clarify whether this framework is relevant.