ISO 27701 internal audit

It is an evidence-based assessment of your privacy information management system against agreed criteria. The engagement defines the standard edition, processing activities, organisational roles and sample before fieldwork. You receive findings and limitations, not an organisational certificate or a blanket opinion that every privacy law has been met.

ISO/IEC 27701:2025 is a standalone management-system standard, so ISO 27001 certification is not a prerequisite for auditing a PIMS against that edition. An integrated audit can examine shared processes where appropriate, but the plan and findings must identify which privacy and information-security criteria were actually evaluated.

We agree the edition explicitly before accepting the engagement. ISO/IEC 27701:2025 is the current edition; the earlier 2019 edition was an extension to information-security standards. If your programme or certificate still references 2019, clarify the relevant certification-body arrangements and any transition scope rather than silently mixing requirements.

The person who designed or implemented the work must not independently audit that same work. Where Aegentra provides both services, we assess prior involvement, conflicts, reporting arrangements and competence, then assign an appropriately impartial auditor. A different name alone is insufficient; if the conflict cannot be managed, use a separate provider.

Start with the PIMS scope, processing activities, controller and processor responsibilities, privacy risks, applicable requirements and control decisions. The agreed sample can then trace notices, requests, retention, supplier instructions and operational records. We agree minimised evidence access first; do not send raw personal records or passwords through the enquiry form.

The schedule and delivery method follow the agreed scope, evidence access and interview availability, not a promised universal number of days. Remote review can use controlled document access or supervised screen-sharing. Any onsite work, sample limitations, reporting deadline and follow-up effort are confirmed in the proposal before fieldwork begins.

Neither. This is an organisational internal-audit service with an agreed scope and report. A certification body separately decides whether to issue an ISO certificate. A PECB Lead Auditor course develops an individual's knowledge and has its own exam and credential conditions. Training, implementation and certification fees are not included automatically.

UK service fees are quoted for the agreed scope. The proposal will define the audit boundary, evidence access, outputs, tax treatment and total payable. Legal advice, implementation, certification-body fees and additional follow-up are not automatically included.

No. A PIMS internal audit evaluates the agreed standard and organisational criteria. Legal compliance requires assessment of the actual processing and obligations. Certification, audit findings and a DPIA are not interchangeable.

Identify the relevant processing activities, organisational roles, suppliers, system boundaries and applicable standard edition. Agree how privacy obligations, records and contractual requirements enter the audit criteria; do not send personal-data exports through the enquiry form.

Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately.