Privacy Certification

ISO 27701 Certification Consulting

Truvo builds the privacy information management system (PIMS) that ISO/IEC 27701:2025 certification requires, as an extension of your ISO 27001 ISMS or as a standalone program. A senior lead guides your team from scoping through the certification body's Stage 2 audit.

  • A PIMS scoped to your role as PII controller, PII processor or both
  • Built on your existing ISO 27001 ISMS, or from zero
  • Led by a senior CISSP in the US or Canada

For most SMBs, ISO 27701 consulting costs USD $2,500 to $5,000 a month to build and operate the PIMS.

Talk to an ISO 27701 consultant

Share your scope and target certification date, and a consultant will follow up to book a call.

What does ISO 27701 certification involve?

Truvo follows the Assess, Build, Operate model, mapped to the clauses of ISO/IEC 27701:2025.

Frame (8)

Assess: Privacy Scope and Gap Assessment

  • What We Do

    We confirm whether you act as a PII controller, a PII processor or both, map the personal data you process, and compare your current practices against ISO/IEC 27701:2025 Clauses 4 to 10 and Annex A.

  • What You Get

  • Scope Statement:
    The PIMS boundary, the processing activities in scope, and your controller and processor roles for each one.

  • Gap Report:
    Each clause and Annex A control rated against your current practice, with the work needed to close each gap.

Frame (9)

Build: PIMS Documentation and Statement of Applicability

  • What We Do

    We write the privacy policy, the privacy risk assessment method and the procedures your team follows. Where you hold ISO 27001, we extend the existing ISMS documents so security and privacy share one management system.

  • What You Get

  • Statement of Applicability:
    Every control in Annex A Tables A.1, A.2 and A.3, marked included or excluded with a justification.

  • Privacy Risk Register:
    Privacy risks to the people whose data you hold, with a treatment plan, owners and target dates.

Frame (10)

Build: Privacy Controls in Operation

  • What We Do

    We put the controls in your Statement of Applicability into daily use with your team: privacy impact assessments, data subject requests, processor and sub-processor agreements, and breach notification.

  • What You Get

  • Records of Processing:
    A record of each processing activity, with purpose, legal basis, retention and the parties involved.

  • Evidence Set:
    The records an auditor asks for, collected while your team operates the controls.

Frame (11)

Operate: Monitoring and Management Review

  • What We Do

    We help your team measure the PIMS under Clause 9.1, track privacy incidents and data subject requests, and prepare the Clause 9.3 management review. The Clause 9.2 internal audit is a separate engagement, done by an auditor who did not build your PIMS.

  • What You Get

  • Monitoring Records:
    Measurements your team tracks, such as data subject request response times, completed privacy impact assessments and privacy incidents.

  • Management Review Input:
    Privacy risk changes, monitoring results and open actions, formatted for leadership sign-off.

Frame (12)

Operate: Stage 1 and Stage 2 Certification Audit

  • What We Do

    We help you select an accredited certification body, prepare your team for interviews, and stay with you through Stage 1 and Stage 2, including responses to any nonconformities the auditor raises.

  • What You Get

  • Audit Readiness Pack:
    Documents, evidence and an interview plan organized the way the certification auditor reviews them.

  • Corrective Action Plan:
    Responses to auditor findings, each with an owner and a target date.

What do you get from an ISO 27701 engagement?

Four things you hold at the end, ready for the certification auditor.

A scoped privacy information management system

A documented PIMS with a scope statement, your controller and processor roles, a privacy policy and named owners for each process.

A Statement of Applicability for Annex A

Each control in Tables A.1, A.2 and A.3 marked included or excluded, with the justification an auditor expects to read.

A privacy risk register and records of processing

Privacy risks with treatment owners and dates, plus a record of each processing activity in scope.

A PIMS in operation, with evidence

Controls your team operates day to day, monitoring records under Clause 9.1 and management review input under Clause 9.3, ready for the internal audit and Stage 1.

When is Truvo the right call?

For many companies, the trigger is a customer contract, RFP or security review that asks for ISO 27701 certification.

Right call when

  • Your team is new to privacy management systems or to ISO certification

  • Your team prefers to focus on other work while a senior lead builds the PIMS

  • You hold ISO 27001 and want to add privacy to the same management system

  • Customers or prospects ask for ISO 27701 in security reviews or RFPs

  • You handle personal data under GDPR, PIPEDA or Quebec Law 25 and want one program to show how you manage it

Wrong call when

  • You need the lowest possible price. Our pricing is competitive, but every audit is run by experienced auditors, goes through several rounds of QA and ends in a detailed report, so we are rarely the cheapest option

What do clients say about Truvo's ISO work?

"Truvo Cyber conducted our ISO 27001 and ISO 27701 internal audit. They were easy to work with, communicated clearly throughout the project, and delivered a thorough, professional report on time. I would recommend them to any organization working through similar compliance requirements."

Ellipse (1) (1)
Aimee Halbert

UserTesting

"Truvo is an instrumental and integrated part of our team...
They don’t just provide recommendations; they ensure we meet our stringent ISO 27001 and SWIFT compliance goals. We trust them with projects of national importance, and they deliver."

Mask Group-1
Matt Charette

CISO, Payments Canada

Ready to plan your ISO 27701 certification?

Book a strategy call. We review your scope and your role as controller or processor, and give you a clear picture of the timeline and investment.

Book Your Free ISO Strategy Session

What do companies ask about ISO 27701 certification?

For most SMBs, ISO 27701 consulting costs USD $2,500 to $5,000 a month to build and operate the PIMS. The monthly fee depends on the PIMS scope, whether you act as a PII controller, a PII processor or both, and whether an ISO 27001 ISMS is already in place. The certification body bills the audit fee separately.

The timeline depends on scope. Adding ISO 27701 to an operating ISO 27001 ISMS is typically faster than building both from zero, because the two standards share the same Clause 4 to 10 structure and much of the evidence. We give you a dated plan after the scoping call.

ISO 27701 is a management system standard. GDPR, PIPEDA and Law 25 are laws. Certification shows an independent auditor checked how you manage personal data, and the same PIMS records support your obligations under each law. A certificate shows conformity with ISO 27701, and compliance with each law remains a separate legal question. For a program built around specific privacy laws, see our privacy program consulting page.

ISO/IEC 27701:2025, published in October 2025, is a standalone management system standard, so an organization can certify a PIMS without holding ISO 27001. The 2019 edition was an extension of ISO 27001 and required an ISMS. Companies that hold ISO 27001 can add ISO 27701 to the same management system and reuse the risk assessment, internal audit and management review.

A PII controller decides why and how personal data is processed. A PII processor handles personal data on behalf of a controller and follows the controller's instructions. ISO/IEC 27701:2025 Annex A lists controls for controllers in Table A.1, controls for processors in Table A.2, and security controls for both in Table A.3. A SaaS company is often a controller for employee data and a processor for the data customers upload.

Yes. Many certification bodies offer a combined audit when both standards share one management system. Truvo can build both standards into one management system, with one evidence set.

Clause 9.2 of ISO/IEC 27701:2025 requires internal audits, with auditors selected so the audit stays objective and impartial. Certification bodies typically expect a completed internal audit and management review before the Stage 2 audit. Truvo offers the ISO 27701 internal audit as a separate service, delivered by an auditor who did not build your PIMS.

An accredited certification body issues the certificate after the Stage 1 and Stage 2 audits. ISO/IEC 27706:2025 sets the requirements for bodies that audit and certify a PIMS, and replaced ISO/IEC TS 27006-2:2021. Truvo prepares you for the audit and supports you through both stages. The certification body is independent of Truvo.

Client data, documentation and sensitive materials are stored in secure North American cloud environments. Every engagement is led by a senior CISSP in the US or Canada with 10+ years in security, and every consultant on the engagement is an experienced, vetted professional.

How is Truvo different?

Our consultants build and operate management systems, so the PIMS fits how your team handles personal data day to day.

The Template Approach

  • Generic Documents:
    Policy templates are written for a generic company. Certification auditors test whether the documents match how your team handles personal data.

  • Two Separate Programs:
    A privacy program built apart from the ISMS means two risk registers, two internal audits and duplicate evidence.

  • Roles Left Open:
    Without defined controller and processor roles, Annex A exclusions are hard to justify at Stage 1.

The Truvo Approach

  • One Management System:
    Where you hold ISO 27001, your team reuses the ISMS risk assessment, internal audit and management review for the PIMS.

  • Controls Tied to Real Data Flows:
    Each Annex A control in your Statement of Applicability maps to a processing activity your team carries out.

  • Senior, Practitioner-Led:
    Every engagement is led by a senior CISSP in the US or Canada who builds and operates management systems.

Ready to certify your privacy program?

ISO 27701 consulting led by practitioners who build and operate management systems.

Book a Strategy Call

From the blog: privacy and data protection

Laptop showing a padlock and world map, for PIPEDA privacy compliance

PIPEDA Compliance for SaaS: 10 Principles as Controls

PIPEDA (the Personal Information Protection and Electronic Documents Act) is Canada's federal privacy law for private-sector organizations that ...

Learn More
Vector infographic: A man with glasses points to Quebec on a globe, where a teal radius connects to global servers. Side panels read "No Revenue Threshold" and "Partial Overlap." A bottom banner titled "Where the Privacy Gap Sits" displays five privacy compliance icons.

Quebec Law 25 Compliance: The Privacy Law Every SaaS Company Should Know About (But Probably Doesn't)

Quebec Law 25 is the province's modernized private-sector privacy law: a set of amendments (adopted in 2021 as Bill 64) to the Act respecting the ...

Learn More
An infographic titled 'LAW 25 COMPLIANCE CHECKLIST' for Quebec security teams. It links 'LEGAL REQUIREMENT' and 'SECURITY OVERLAP' (SOC 2, ISO 27001) as a man checks a large clipboard list. The bottom outlines 'THE 8-POINT CHECKLIST' with 8 key icons, such as privacy officer, PIA, and safeguards.

Law 25 Compliance Checklist: What Security Teams Actually Need to Do

Quebec's Law 25 has been fully in force since September 2024, and the penalties are no longer theoretical. Under the Act respecting the protection of ...

Learn More