Frameworks · Global standards
ISO 27701 compliance, run as a living system
ISO/IEC 27701 extends ISO 27001 and ISO 27002 into a privacy information management system, defining requirements for controllers and processors of personally identifiable information.
Who it applies to
Organisations already certified or working toward ISO 27001 that need to demonstrate privacy governance to customers or regulators.
What it demands
PIMS requirements
Extension of the ISMS scope, roles and documentation to privacy processing.
Controller obligations
Lawful basis, notices, data subject rights, and records of processing.
Processor obligations
Instructions, subprocessor governance and assistance duties.
How Compli-Once runs it
- 1
The extension is computed from your ISO 27001 state, so only the privacy delta becomes new work.
- 2
Records of processing and data subject request handling live as evidence with owners and expiry.
- 3
Crosswalked to the DPDP Act, UK GDPR and UAE PDPL so one privacy programme serves several regimes.
What you already satisfy
ISO 27701 overlaps with frameworks you may already run. The crosswalk quantifies existing coverage on day one, before you plan a single task.
Implement once, satisfy many
In a representative demonstration environment, 61% of a newly adopted regulatory framework was already satisfied by the existing ISO 27001 programme.
Illustrative, computed live per tenant in the platform.
Frequently asked questions
Do we need ISO 27001 first?
In practice yes. ISO 27701 is an extension, and Compli-Once computes the additional privacy requirements against your existing ISMS.
Does it satisfy privacy law?
It evidences good practice and maps closely to statutory duties, but the statutory frameworks are modelled separately so obligations stay explicit.