Toolkit
ISO/IEC 27701 readiness cheat sheet
A one-page summary to work from, not a substitute for the full guide or the official text.
Saves a one-page PDF straight to your device. It is put together by your browser, on this page — nothing is uploaded.
Who it's for. Any organisation that processes personally identifiable information as a controller, a processor, or both, and wants a structured, auditable privacy programme.
Scope
- Covers PII controllers (who decide the purpose and means of processing) and PII processors (who process on their behalf)
- Since the 2025 edition, can be implemented and certified standalone — no longer requires ISO/IEC 27001 first
- Scope should state which processing activities, systems, sites and roles are covered
Key requirements
- Define roles and scope for each processing activity
- Map PII and processing: records of processing, data flows, systems and third parties
- Run a privacy risk assessment that considers risk to individuals, not just the organisation
- Identify legal and contractual requirements in every jurisdiction you operate in
- Give notices, manage consent where relevant, and handle data subject or data principal rights requests
- Put processor obligations in contracts: process only on instructions, support breach and rights handling, control sub-processors
- Produce a Statement of Applicability against the Annex A controls
Evidence to gather
- PIMS scope and policy
- Records of processing and data-flow maps
- Privacy risk and impact assessments
- Notices, consent records and rights-request logs
- Processor and sub-processor agreements
- Cross-border transfer assessments
- Breach register
Common gaps
- Assuming certification proves legal compliance with GDPR, DPDP or another privacy law — it doesn't
- Ignoring the processor role: many SaaS providers are both controller for their own account data and processor for customer content
- Still working from the 2019 clause structure instead of the 2025 standalone one
- No re-mapping plan for organisations transitioning from a 2019 certificate
This is general educational information, condensed by MajorCyber™ in its own words, not legal, audit or certification advice, and not a compliance assessment, certification or attestation of any kind. It is a starting checklist, not a complete statement of the framework's requirements — confirm anything material against the full ISO/IEC 27701 guide, the official text, or a qualified adviser.