Get a Quote

ISO 27701:2019

ISO 27701 Privacy Information Management

Extend your information security management with a Privacy Information Management System that demonstrates real accountability for personal data.

Book an ISO 27701 Consultation Ask on WhatsApp

ISO 27701 extends ISO 27001/27002 (information security management) with specific requirements and guidance for managing personal information, effectively turning an Information Security Management System into a Privacy Information Management System (PIMS). It sets out controls for organisations acting as either data controllers or data processors.

For South African businesses, ISO 27701 maps closely to the accountability requirements of POPIA (the Protection of Personal Information Act), while POPIA compliance is a legal obligation regardless of certification, an ISO 27701-aligned PIMS gives you a structured, auditable way to demonstrate that accountability to regulators, customers and business partners.

Andreas Burger Consulting implements ISO 27701 as an extension to a new or existing ISO 27001 system, mapped explicitly against your POPIA obligations so the two reinforce each other rather than running as separate compliance exercises.

After certification: a PIMS depends on document control and CAPA for breaches and data subject requests. DynamicERMS, built by our technology partner Dynatek, provides document management and CAPA tracking built around ISO standards.

Why it matters

Key benefits

Provides a structured, auditable framework for POPIA accountability

Builds customer and partner trust in how you handle personal information

Extends naturally from an existing ISO 27001 information security system

Meets data-protection requirements increasingly written into B2B and government contracts

Clarifies data controller vs. data processor obligations across your operations

Reduces the risk and cost of data breaches and regulatory action

How we work

Our implementation process

Privacy Gap Assessment

We assess your current data-handling practices against ISO 27701 and POPIA's accountability requirements.

Processing Activity Mapping

We map what personal information you hold, where it lives, who accesses it, and why. This is the foundation of a PIMS.

PIMS Documentation

We build the privacy policy, controls and procedures required, layered onto your ISO 27001 ISMS (or built alongside a new one).

Implementation & Training

We train your team on data-handling procedures, breach response, and their role in maintaining the PIMS.

Internal Audit & Certification Support

We run your internal audit and support you through certification body audits for ISO 27001/27701.

FAQ

Common questions about ISO 27701 Privacy Information Management

ISO 27701 is designed as an extension to ISO 27001 (or ISO 27002), so in practice it's implemented alongside or on top of an existing ISMS. If you don't yet have ISO 27001, we can scope both together as a single combined implementation.

Certification isn't a legal substitute for POPIA compliance, which is a standalone legal obligation. But an ISO 27701-aligned PIMS gives you a structured, evidence-based way to demonstrate the accountability POPIA requires, which is exactly what regulators and auditors look for.

Any business that processes meaningful volumes of personal information, particularly those handling customer data at scale, operating as a data processor for other companies, or working in regulated sectors like finance, healthcare, or HR/recruitment.

No. ABC is not a Certification Body and does not issue certificates. We implement and prepare you for audit; independent accredited bodies certify. That separation, required under ISO/IEC 17021-1, protects the integrity of your certificate.

Ready to get started with ISO 27701 Privacy Information Management?

Book a consultation and we'll scope exactly what your business needs.

Book an ISO 27701 Consultation
Scroll to Top