ISO 27701 Implementation Checklist

Implementation Checklist

• □ PIMS scope statement (org units, systems, PII categories, roles)
• □ Privacy policy + leadership assignment of roles
• □ Processing inventory / records with owners
• □ Risk assessment & treatment for privacy risks
• □ Notices / transparency artefacts current
• □ Lawful basis / consent records where required by applicable law
• □ Rights / DSAR intake, verification, clocks, fulfilment logs
• □ DPIA/PIA procedure and completed assessments for high-risk processing
• □ Processor / vendor register, contracts, sub-processor flow-down
• □ Retention & deletion schedule with technical enforcement evidence
• □ Security measures + monitoring (access, logging, encryption as applicable)
• □ Breach assessment & notification playbooks mapped to applicable laws
• □ Competence / awareness records
• □ Internal audit programme + management review minutes
• □ Statement of Applicability aligned to the edition under audit

Automation Tip

CSA holds owners, URLs, and status so the checklist becomes a living control register rather than a one-off spreadsheet.

Frequently Asked Questions

Is this checklist a substitute for the standard?

No. Buy the official ISO text and your CB’s SoA template. This is an operational readiness aid.

2019 or 2025 checklist?

Core programme items overlap. Remap annex/SoA rows to the edition your CB will audit.

How often should we re-run it?

Before each internal audit and after material processing changes.

Related Privacy Resources

Privacy program · Certification · CSA