Privacy Information Management Systems
ISO/IEC 27701 extends ISO/IEC 27001 and ISO/IEC 27002 into privacy information management, splitting requirements between PII controllers and PII processors. It is the most direct route from a security certification you already hold to demonstrable, audited GDPR accountability.
Why ISO/IEC 27701 is worth holding
- Turns GDPR accountability obligations into auditable, evidenced controls
- Builds on an existing ISO 27001 certification rather than replacing it
- Expected of processors handling personal data at enterprise scale
- Certification paths
- 3
- From
- $795
Certification path
You do not need all of these. Most people take one — the level that matches what they are actually being asked to do.
Foundation
A two-day grounding in ISO/IEC 27701 — the vocabulary, the structure of the standard and how privacy information management systems actually work in practice.
Lead Implementer
Five days on leading an ISO/IEC 27701 implementation end to end — from gap assessment and scope through DPIA, records of processing and privacy control selection, to the certification audit itself.
Lead Auditor
Five days on auditing privacy information management systems against ISO/IEC 27701, using the ISO 19011 and ISO/IEC 17021-1 principles that certification bodies audit by.
Compare the levels
| Level | Length | CPD | Exam | Best for | From |
|---|---|---|---|---|---|
| Foundation | 2 days | 14 | 1h · Multiple choice | Professionals joining the PIMS implementation or audit team | $795 |
| Lead Implementer | 5 days | 31 | 3h · Essay-type | Project managers and consultants leading the PIMS implementation | $1,495 |
| Lead Auditor | 5 days | 31 | 3h · Essay-type | Auditors seeking to lead certification audits of a management system | $1,495 |
PECB is a global certification body that provides training and certification against ISO standards. Its personnel certification schemes are accredited to ISO/IEC 17024, the international standard for bodies certifying people — which is what makes a PECB credential recognised by employers, auditors and certification bodies worldwide rather than being a private certificate of attendance.
No. Foundation is not a formal prerequisite for Lead Implementer or Lead Auditor. It exists for people who are new to the standard and want the vocabulary and clause structure before the deeper course. If you already work with the standard day to day, go straight to the Lead course — we will tell you plainly on the pre-enrolment call which is right for you.
The official PECB participant materials and case studies, the certification exam voucher, one free retake if you do not pass first time, your first-year certification application fee, the CPD credits, twelve months of KATE app access, and a 1:1 call before you enrol. There are no separate exam fees added later.
Lead Implementer is for building the management system: scope, risk assessment, control selection, documentation and getting the organisation ready for its certification audit. Lead Auditor is for assessing one: audit planning, evidence gathering, findings, nonconformity reports and audit programme management. Implementers build, auditors verify. Consultants often hold both.
Foundation exams are one hour and multiple choice. Lead-level exams are three hours, essay-type and open book — you may bring the standard and your own notes. Exams can be sat online with remote proctoring or on paper at the end of a classroom session. Results are typically issued within four to six weeks, and your certification is then issued once your application is approved.
One retake is included in every price on this site, at no additional cost. PECB allows retakes without repeating the training, and we will run a focused review session with you first to work out what went wrong.