Compliance tools · Cybersecurity and data protection

Toolkit for ISO 27701

ISO/IEC 27701:2025 · European Union and United Kingdom · Voluntary standard

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your Toolkit for ISO 27701 documentation cited clause by clause. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

Toolkit for ISO 27701 is ISO/IEC 27701:2025, a voluntary standard in the European Union and United Kingdom. Privacy information management system standard, certifiable on its own or alongside ISO 27001. The toolkit runs alongside your own licensed copy of the ISO standard.

The free assessment screens for Toolkit for ISO 27701 when a business handles personal data.

Sectors this instrument reaches: IT and technology; SaaS; health services; marketing and analytics; HR and recruitment services; financial services.

This is a voluntary standard rather than binding law. Businesses adopt it because customers, insurers or public buyers ask for it.

Screen your business against all 116 agent toolkits, free →

• Your exact position under Toolkit for ISO 27701: what is in place, what is missing, and what to do about each gap.
• Documentation with clause citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the standard requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that Toolkit for ISO 27701 applies to your business, free →

Does Toolkit for ISO 27701 apply to my business?

ISO/IEC 27701 applies to you if your organisation processes personally identifiable information as a PII controller, a PII processor, or both, and you wish to establish, maintain and continually improve a Privacy Information Management System. It is voluntary and carries no territorial restriction.

Who does ISO 27701 apply to?

It applies to any organisation that processes personally identifiable information as a PII controller, a PII processor, or both, and that wishes to establish, maintain and continually improve a PIMS. All 46 obligations fall on the organisation seeking certification.

Does Toolkit for ISO 27701 apply to a small business?

The standard has no size threshold. It applies to organisations of all sizes, from sole traders to multinational corporations, and scales to organisational size without prescribing fixed resource levels or fixed organisational structures.

When does ISO 27701 apply from, and what are the deadlines?

There is no legal commencement date because the standard is voluntary. The certification cycle runs a Stage 1 documentation review, a Stage 2 operational audit, annual surveillance audits, and full recertification every three years.

What does ISO 27701 require me to do?

You must operate an ISO/IEC 27001 ISMS and build a PIMS on top of it, covering context and scope (Clause 4), leadership and policy (Clause 5), risk assessment and the Statement of Applicability (Clause 6), resources and documented information (Clause 7), operations (Clause 8), performance evaluation (Clause 9) and improvement (Clause 10).

What records or documents does ISO 27701 require me to keep or produce?

You must keep a documented privacy policy (Clause 5.2), a Statement of Applicability (Clause 6.1), the risk assessment methodology (Clause 6.1), records of processing activities, privacy impact assessment procedures, and all documented information required by Clause 7.5.

What happens if I do not comply with ISO 27701?

No statutory authority imposes fines for non-conformity with the standard itself. An accredited certification body may suspend or withdraw your certificate, you may lose contracts, and data protection authorities may scrutinise you, with GDPR fines reaching up to EUR 20 million or 4 per cent of annual worldwide turnover.

Does Toolkit for ISO 27701 apply to a UK business selling into the EU?

The standard is globally applicable and carries no territorial restriction, so it applies to a UK business selling into the EU in the same way as anywhere else. It does not replace any legal or regulatory privacy obligation, and you must still comply with the data protection laws of every jurisdiction in which you operate.

Does Toolkit for ISO 27701 apply to an EU business selling into the UK?

The standard is globally applicable and carries no territorial restriction, so it applies to an EU business selling into the UK in the same way as anywhere else. It does not replace any legal or regulatory privacy obligation, and you must still comply with the data protection laws of every jurisdiction in which you operate.

How do I start complying with ISO 27701?

The first practical step is to hold or concurrently achieve ISO/IEC 27001 certification, because an organisation cannot certify to ISO/IEC 27701 without an operational ISMS conforming to ISO/IEC 27001. The Stage 1 audit then reviews your documented PIMS.

Which ComplianceSME account includes the Toolkit for ISO 27701 toolkit?

The Toolkit for ISO 27701 agent toolkit is included from the Medium level.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive