Govern / United Kingdom
ISO 27701 privacy management
Organise privacy responsibilities, decisions and evidence around the personal information your business handles.
Last reviewed . Fees in pounds sterling plus VAT.
Where does responsibility for personal information sit?
Scope and fee
Agree the work.
Know the boundary.
The written proposal defines the scope, responsibilities, price and delivery timetable.
What shapes your quote
- Scope, complexity and existing evidence
- Required specialist work and access arrangements
- Depth of reporting and any separately agreed follow-up
The requirement in context
Define the requirement before selecting the work.
Begin with the processing activity and the organisation’s role, not a generic privacy-policy template. Agree the applicable ISO 27701 edition and assess legal requirements separately with appropriate advice.
Primary references
ISO: privacy information management systemsInside the work
Where does responsibility for personal information sit?
Original fictional working example. The actual criteria, evidence, scope and delivery arrangements are agreed for your organisation.
| Work area | Decision to make | Evidence to retain |
|---|---|---|
| Processing | Identify the purpose, data categories and responsible organisation. | A maintained processing map and named owner. |
| Supplier interface | Clarify instructions, access and responsibilities. | Agreed records, review and escalation route. |
| Change | Assess the effect of a new purpose or system. | Decision, approval and revised controls. |
Fictional example · Not a client result, legal determination or complete audit checklist.
Download this working example (CSV)What you take away
Evidence.
Ownership.
A practical next step.
Organise privacy responsibilities, decisions and evidence around the personal information your business handles.
- Agreed privacy-management boundary and applicable edition
- Roles, information flows and supplier interfaces
- Privacy risk and control decisions
- Operating records and improvement plan
How the work moves forward
From the requirement to a usable result.
Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced.
Understand the requirement
Define the product, service, process and relevant external requirement.
Build the record
Assign responsibilities and connect decisions to operating evidence.
Review and improve
Check what is working, address gaps and agree the next review.
Your delivery team
Team qualifications
and credentials.
Qualifications, professional credentials and formal training held across Aegentra’s delivery team.
Credentials are held across the delivery team and matched to assigned roles. The proposal identifies the consultants, responsibilities and relevant qualification evidence before work begins.
Management systems and audit
- ISO/IEC 27001 Lead Implementer
- ISO/IEC 27701 Lead Implementer
- PECB ISO/IEC 27001 Lead Auditor
- ISO/IEC 42001 Lead Auditor
- CISA — Certified Information Systems Auditor
- ISM Auditor
Cybersecurity and cloud
- CISSP — Certified Information Systems Security Professional
- CISM — Certified Information Security Manager
- Certificate of Cloud Security Knowledge (CCSK)
- OSCP+ — OffSec Certified Professional Plus
Service delivery and specialist training
- ITIL Expert
- PRINCE2
- Mastering Generative AI for Cybersecurity Certificate
- Essential Eight Assessment Course certificate — TAFEcyber
Further training and audit qualifications
Further training and audit qualifications across the team include ISO/IEC 42001 Lead Implementer training, ASD ISM General and Technical audit codes, ISO/IEC 27017 and ISO/IEC 27018 audit codes, and ISO 9001 and ISO 19011 audit qualifications.
Relevant competence. Clear responsibilities.
For internal audit, competence, objectivity, impartiality and prior involvement are checked before the work is accepted. Implementation, internal audit and independent certification have separate roles.
These are individual qualifications held across the wider team, not a claim that every consultant holds every credential or that Aegentra is an accredited certification body.
Read about our team’s capabilityA practical starting point
Where does responsibility for personal information sit?
Begin with the processing activity and the organisation’s role, not a generic privacy-policy template. Agree the applicable ISO 27701 edition and assess legal requirements separately with appropriate advice.
Processing — Identify the purpose, data categories and responsible organisation. — A maintained processing map and named owner. Supplier interface — Clarify instructions, access and responsibilities. — Agreed records, review and escalation route. Change — Assess the effect of a new purpose or system. — Decision, approval and revised controls.
Before you commission the work
Your questions.
Clear answers.
Where does responsibility for personal information sit?
Begin with the processing activity and the organisation’s role, not a generic privacy-policy template. Agree the applicable ISO 27701 edition and assess legal requirements separately with appropriate advice.
What is included in the engagement?
Agreed privacy-management boundary and applicable edition; Roles, information flows and supplier interfaces; Privacy risk and control decisions; Operating records and improvement plan. The proposal defines the exact outputs and acceptance criteria.
What is not automatically included?
Privacy-management work is not legal advice or proof of compliance with every data-protection obligation. Certification, legal review and technical remediation are separately scoped.
What does the service cost?
UK service fees are quoted for the agreed scope. We confirm a quote after reviewing the agreed boundary, starting position, dependencies and required deliverables.
How should we share evidence?
Agree secure access, minimisation and retention before work starts. Describe the requirement in the enquiry; do not send passwords or sensitive records through the form.
Can we reuse ISO 27001 evidence for privacy implementation?
Relevant shared management-system evidence may be useful, but privacy roles, processing purposes and obligations need their own assessment. Check the applicable ISO 27701 edition and integration arrangements rather than assuming an older extension model applies to every project.
Is a privacy policy enough for a PIMS?
No. Establish who makes decisions, how processing is understood, how obligations and risks are addressed and which records demonstrate operation. The website privacy notice is only one possible output, not the management system.
What should we prepare for a scoping conversation?
Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately.
Let’s define the work you actually need.
Tell us what you need to achieve, what is in scope and where you are starting.
Talk about your project