Privacy Is Not Security: What ISO 27701 Certification Consultants Want Teams to Know

ISO 27701 certification consultants explain why privacy needs its own owner. Learn what the 2025 edition changed and where PIMS consultancy services fit.

Should the security team own privacy?

Not on its own. Security protects personal data from unauthorised access, alteration, and loss. Privacy asks whether the organisation should hold the data at all, on what basis, for how long, and what the person it belongs to can do with it. A dataset can pass every security check and still fail privacy.

Most organisations give privacy to security because personal data is data. That arrangement gets a lot right and misses one category of risk, and the miss is systematic, not accidental. Picture a dataset that is encrypted, access controlled, monitored and backed up. It was collected without a lawful basis, kept nine years past its purpose, and used for something the notice never mentioned. Security controls would call it healthy. Reviews by ISO 27701 consultants often begin with exactly this kind of database.

Where does the gap between privacy and security show?

It shows in four places: collection, purpose, retention and individual rights. Security can’t tell whether a field should have been collected or data reused for a new aim. It also can’t judge how long data is kept, or whether one person’s records can be found and removed.

Minimisation is a legal obligation, not good practice. GDPR Article 5 limits data to what is necessary, and India’s data protection framework lists data minimisation among its core principles.

Using data for something it was not gathered for is a privacy failure with no security dimension. The data never left. Singapore’s PDPA covers this through its purpose limitation obligation, and the Philippines’ Data Privacy Act rests on a legitimate purpose principle. Security monitoring almost never detects this breach, yet it is one of the most common.

Retention is where the two functions part ways. Security instinctively prefers keeping data. Privacy requires deletion, the control security teams are least comfortable with. New Zealand’s Privacy Act 2020 limits how long personal information may be held.

Rights need design. Nothing in a security programme creates the ability to find one person’s data across systems and remove it. Kenya’s Data Protection Act 2019 sets out data subject rights in Part IV, and Nigeria’s Data Protection Act 2023 created a commission to oversee compliance.

How does privacy risk differ from security risk?

Security risk assessment asks what could harm the organisation. Privacy risk assessment asks what could harm the individual. The two often point the same way and sometimes in opposite directions, and the second question is the one that gets skipped when privacy reports into security.

The fix is small. If security runs the privacy programme, add one question to the risk process: what is the risk to the individual whose data this is? Ask it separately from the organisational question. The answers differ more often than people expect, and the difference is the privacy risk the security programme was never designed to see.

What does ISO 27701 add, and what changed in 2025?

ISO/IEC 27701 sets requirements for a privacy information management system (PIMS) for organisations that control or process personal data. The 2019 edition extended ISO 27001. The October 2025 edition is an independent standard, so privacy can be implemented without a separate security certificate.

ISO’s own page says the 2025 edition suits organisations of any size and still aligns with ISO 27001 systems. The ISO 27701 certification requirements cover ground security frameworks leave out: controller and processor roles, lawful basis, records of processing, individual rights and risk to the people concerned.

The earlier extension model was deliberate, and its logic holds. Privacy depends on security. It just isn’t contained by it. Certification also supports legal compliance rather than proving it, so it doesn’t replace legal advice.

How do ISO 27701 certification consultants play a main role?

They turn the standard into controls that fit how a business really handles data. A consultant maps data flows, tests the privacy risk assessment, builds the records an auditor will ask for and prepares the team. An accredited certification body, not the consultant, issues any certificate.

PIMS consultancy services usually start with a data inventory, because nobody can limit collection or retention they haven’t mapped. Good ISO 27701 consultant services shorten preparation and find gaps before the auditor does. They also give privacy and security teams one shared language. Experienced PIMS consultants push for privacy to carry its own risk question, since that’s where the miss happens.

Which industries and countries gain most from a PIMS?

Any organisation that handles personal data can use ISO 27701, whatever its size. The gain is largest where data is sensitive or plentiful. Examples are IT and cloud services, medical device and healthcare firms, banks and fintech, manufacturers holding customer or employee data, and occupational health providers.

In India, ISO 27701 certification consultancy services help companies line up PIMS controls with the DPDP Act and its 2025 Rules. In Singapore, an ISO 27701 consultant Singapore organisations hire should map controls to the PDPA’s purpose and retention obligations. A Kenyan or Nigerian exporter gains one body of evidence instead of answering every buyer’s privacy questionnaire afresh, and ISO certification consultancy services in Kenya can build it. Philippine and New Zealand organisations face different laws but ask the same internal questions. Because ISO 27701 isn’t tied to one national law, it also helps exporters selling into Oman or the USA.

How can MSCi help with ISO 27701?

MSCi prepares organisations for conformity assessment and audits. We review how personal data moves through the business, test the privacy risk assessment and build the evidence an auditor expects. We don’t issue the ISO certificate or any notified body certificate.

As ISO certification consultants with 40+ years of experience in ISO consultation, we know how auditors read records. We start with a gap review of collection, purpose, retention and rights, then agree a plan with your security and privacy owners.

5. FAQ

1.What do ISO 27701 consultants actually do?

They map where personal data enters and moves, test the privacy risk assessment and build the records an auditor expects. They then prepare staff for the audit. The accredited certification body makes the decision.

2.Why use PIMS consultants if a security team already exists?

Security teams are trained to ask what could harm the organisation. PIMS consultants add the second question: what could harm the individual, and cover collection, purpose, retention, and rights, which security controls rarely test.

3.Can a company certify to ISO 27701 without ISO 27001?

Yes. The 2025 edition is an independent management system standard, so ISO 27001 is no longer a prerequisite. Firms that already hold it often integrate the two systems.

4.Does ISO 27701 certification mean a company complies with privacy law?

It supports compliance but doesn’t prove it. Laws such as India’s DPDP Act, Kenya’s Data Protection Act, and New Zealand’s Privacy Act 2020 each set their own duties. ISO 27701 certification consultancy services in India or elsewhere can show where the standard and the law overlap.

5.Do ISO certification consultants write the policies too?

They usually draft or review the policies and records, but the organisation must own and run them. An auditor will ask staff how the process works, so ownership can’t be outsourced.

6. Can MSCi issue the ISO 27701 certificate?

No. MSCi is a consultancy that prepares companies for conformity assessment and audits. Certificates come only from an accredited certification body after a successful audit.