ISO 27701 Documentation: What You Actually Need

Because ISO 27701 builds on an ISO 27001-based Information Security Management System (ISMS), many existing security documents can be extended to cover privacy requirements.

1. Documents You Need to Maintain

Your Privacy Information Management System (PIMS) should include:

• PIMS scope – Define what the privacy system covers, including the roles and responsibilities involved.

• Privacy policy – A dedicated privacy policy or an existing information security policy expanded to include privacy.

• Record of Processing Activities (ROPA) – Document what personal data you process, why you process it, and how it is managed.

• Privacy risk assessment methodology – Define how privacy risks are identified, assessed, and measured.

• Risk treatment process – Explain how identified privacy risks will be addressed and controlled.

• Statement of Applicability (SoA) – Identify which privacy controls apply to your organisation and explain any exclusions.

• Privacy objectives – Define measurable goals for improving privacy management.

• Retention schedule – Specify how long different types of personal data should be retained and when they should be deleted.

• Privacy notices – Provide appropriate notices for each relevant data processing activity.

2. Records You Need to Keep

In addition to the documents above, you should retain evidence showing that your privacy processes are actually working.

These records may include:

• Privacy risk assessment and risk treatment results

• Employee or relevant personnel competence records

• Data subject rights requests and how they were handled

• Consent records, where consent is the legal basis for processing

• Processor and sub-processor registers and related contracts

• Records of international data transfers and their legal basis

• Privacy Impact Assessments (PIAs), where applicable

• Privacy incidents and data breach notification records

• Monitoring and measurement results

• Internal audit plans and audit results

• Management review records

• Nonconformities and corrective action records

3. Record of Processing Activities (ROPA)

The Record of Processing Activities is one of the most important privacy documents.

For every processing activity, you should record:

• What the activity is and why the data is being processed

• Whether you are acting as a controller, processor, or joint controller

• Categories of data subjects involved

• Categories of personal data being processed, including any sensitive/special-category data where relevant

• The lawful basis for processing, where you are acting as a controller

• Where the personal data was obtained from

• Who receives the data, including processors and sub-processors

• Whether data is transferred across borders and the basis for the transfer

• How long the data will be retained

• Which systems or applications store or process the data

• Who is responsible for the processing activity

Your other privacy controls depend heavily on having an accurate ROPA.

Auditors are likely to examine the ROPA early in an audit and use it to identify which processes, systems, and controls they need to review.

4. Statement of Applicability (SoA)

If your organisation is extending an ISO 27001 system to ISO 27701, your Statement of Applicability should also be extended to include the relevant privacy controls.

The applicable controls will depend on your role:

• Controls applicable to controllers

• Controls applicable to processors

• Controls applicable to both

If a control does not apply, explain why.

For example:

"Not applicable because the organisation does not act as a controller for this processing activity."

Simply writing "Not Applicable" without an explanation is generally not sufficient.

5. Practical Tips

Make your role clear

For every processing activity, clearly identify whether you are a controller, processor, or joint controller. Add a short explanation supporting the decision.

Make retention rules work in practice

Having a documented retention schedule is not enough.

Your systems should actually support data deletion when the retention period ends, and you should maintain evidence that the deletion process works.

A retention policy without an actual deletion mechanism is difficult to demonstrate during an audit.

Keep records of rights requests

Maintain records of requests made by data subjects, including requests that were refused.

If a request is refused, document the reason and the applicable basis for the refusal.

Keep processor information updated

Maintain an up-to-date list of processors and sub-processors.

Whenever a new vendor or service provider is introduced, review whether it processes personal data and update the register and contracts accordingly.

Test your privacy processes

Do not simply document your data subject rights process.

Test it periodically and keep evidence of the test to demonstrate that the process actually works.

6. Common ISO 27701 Findings

Auditors commonly identify issues such as:

1. Incomplete ROPA – Some processing activities or systems used by individual departments are missing.

2. Role not clearly defined – The organisation has not determined whether it is a controller or processor for each activity.

3. Missing lawful basis – The lawful basis is not documented, or consent is recorded even though valid consent was not obtained.

4. Retention not implemented – A retention schedule exists on paper, but systems do not actually delete data as required.

5. Unapproved sub-processors – Sub-processors are being used without the required authorisation or contractual arrangements.

6. Rights process not tested – The organisation has never actually exercised or tested its data subject rights process.

7. Incomplete privacy risk assessment – Risks are assessed only from the organisation's viewpoint and not from the perspective of the individuals whose data is being processed.

8. Privacy notice mismatch – The privacy notice describes processing activities that are not accurately reflected in the ROPA.

Key Takeaway

ISO 27701 is not just about having privacy policies and documents. It is about being able to demonstrate that privacy processes are actually implemented and working.

Your documentation should answer three basic questions:

What personal data do we process? → Why and how do we process it? → Can we prove that we manage it properly?

An accurate ROPA, clear roles, effective retention and deletion, documented rights handling, controlled processors, and evidence of testing and monitoring form an important part of demonstrating an effective Privacy Information Management System.