Title: ISO 27701 privacy management > ISO 27701 privacy management for UK organisations: organise privacy responsibilities, decisions and evidence around the personal data you handle. Source: https://aegentra.co.uk/services/govern/iso-27701 Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT. Published: 2026-10-21 Updated: 2026-10-21 Licence: public web content; cite the source URL. Govern / United Kingdom # ISO 27701 privacy management Organise privacy responsibilities, decisions and evidence around the personal information your business handles. Last reviewed 21 October 2026. Fees in pounds sterling plus VAT. [Discuss your scope](https://aegentra.co.uk/contact?subject=ISO%2027701%20privacy%20management) [See a working example](https://aegentra.co.uk/services/govern/iso-27701#working-example) Where does responsibility for personal information sit? Scope and fee ## Agree the work. Know the boundary. The written proposal defines the scope, responsibilities, price and delivery timetable. ### What shapes your quote - Scope, complexity and existing evidence - Required specialist work and access arrangements - Depth of reporting and any separately agreed follow-up [Request a scoped proposal](https://aegentra.co.uk/contact?subject=ISO%2027701%20privacy%20management) The requirement in context ## Define the requirement before selecting the work. Begin with the processing activity and the organisation’s role, not a generic privacy-policy template. Agree the applicable ISO 27701 edition and assess legal requirements separately with appropriate advice. Primary references [ISO: privacy information management systems](https://www.iso.org/standard/27701) Inside the work ## Where does responsibility for personal information sit? Original fictional working example. The actual criteria, evidence, scope and delivery arrangements are agreed for your organisation. | Work area | Decision to make | Evidence to retain | | --- | --- | --- | | Processing | Identify the purpose, data categories and responsible organisation. | A maintained processing map and named owner. | | Supplier interface | Clarify instructions, access and responsibilities. | Agreed records, review and escalation route. | | Change | Assess the effect of a new purpose or system. | Decision, approval and revised controls. | Fictional example · Not a client result, legal determination or complete audit checklist. [Download this working example (CSV)](https://aegentra.co.uk/downloads/govern-iso-27701-working-example.csv) What you take away ## Evidence. Ownership. A practical next step. Organise privacy responsibilities, decisions and evidence around the personal information your business handles. - Agreed privacy-management boundary and applicable edition - Roles, information flows and supplier interfaces - Privacy risk and control decisions - Operating records and improvement plan ### Separate responsibilities Privacy-management work is not legal advice or proof of compliance with every data-protection obligation. Certification, legal review and technical remediation are separately scoped. How the work moves forward ## From the requirement to a usable result. Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced. - ### Understand the requirement Define the product, service, process and relevant external requirement. - ### Build the record Assign responsibilities and connect decisions to operating evidence. - ### Review and improve Check what is working, address gaps and agree the next review. Your delivery team ## Team qualifications and credentials. Qualifications, professional credentials and formal training held across Aegentra’s delivery team. Credentials are held across the delivery team and matched to assigned roles. The proposal identifies the consultants, responsibilities and relevant qualification evidence before work begins. ### Management systems and audit - ISO/IEC 27001 Lead Implementer - ISO/IEC 27701 Lead Implementer - PECB ISO/IEC 27001 Lead Auditor - ISO/IEC 42001 Lead Auditor - CISA — Certified Information Systems Auditor - ISM Auditor ### Cybersecurity and cloud - CISSP — Certified Information Systems Security Professional - CISM — Certified Information Security Manager - Certificate of Cloud Security Knowledge (CCSK) - OSCP+ — OffSec Certified Professional Plus ### Service delivery and specialist training - ITIL Expert - PRINCE2 - Mastering Generative AI for Cybersecurity Certificate - Essential Eight Assessment Course certificate — TAFEcyber ### Further training and audit qualifications Further training and audit qualifications across the team include ISO/IEC 42001 Lead Implementer training, ASD ISM General and Technical audit codes, ISO/IEC 27017 and ISO/IEC 27018 audit codes, and ISO 9001 and ISO 19011 audit qualifications. ### Relevant competence. Clear responsibilities. For internal audit, competence, objectivity, impartiality and prior involvement are checked before the work is accepted. Implementation, internal audit and independent certification have separate roles. These are individual qualifications held across the wider team, not a claim that every consultant holds every credential or that Aegentra is an accredited certification body. [Read about our team’s capability](https://aegentra.co.uk/about#team) A practical starting point ## Where does responsibility for personal information sit? Begin with the processing activity and the organisation’s role, not a generic privacy-policy template. Agree the applicable ISO 27701 edition and assess legal requirements separately with appropriate advice. Fictional working exampleProcessing — Identify the purpose, data categories and responsible organisation. — A maintained processing map and named owner. Supplier interface — Clarify instructions, access and responsibilities. — Agreed records, review and escalation route. Change — Assess the effect of a new purpose or system. — Decision, approval and revised controls. Before you commission the work ## Your questions. Clear answers. **Where does responsibility for personal information sit?** Begin with the processing activity and the organisation’s role, not a generic privacy-policy template. Agree the applicable ISO 27701 edition and assess legal requirements separately with appropriate advice. **What is included in the engagement?** Agreed privacy-management boundary and applicable edition; Roles, information flows and supplier interfaces; Privacy risk and control decisions; Operating records and improvement plan. The proposal defines the exact outputs and acceptance criteria. **What is not automatically included?** Privacy-management work is not legal advice or proof of compliance with every data-protection obligation. Certification, legal review and technical remediation are separately scoped. **What does the service cost?** UK service fees are quoted for the agreed scope. We confirm a quote after reviewing the agreed boundary, starting position, dependencies and required deliverables. **How should we share evidence?** Agree secure access, minimisation and retention before work starts. Describe the requirement in the enquiry; do not send passwords or sensitive records through the form. **Can we reuse ISO 27001 evidence for privacy implementation?** Relevant shared management-system evidence may be useful, but privacy roles, processing purposes and obligations need their own assessment. Check the applicable ISO 27701 edition and integration arrangements rather than assuming an older extension model applies to every project. **Is a privacy policy enough for a PIMS?** No. Establish who makes decisions, how processing is understood, how obligations and risks are addressed and which records demonstrate operation. The website privacy notice is only one possible output, not the management system. **What should we prepare for a scoping conversation?** Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately. Choose the right route ## Connected work. Distinct responsibilities. Commission organisational support, build your own knowledge or clarify what a customer has requested. ### Related services [ISO 27001 implementation](https://aegentra.co.uk/services/govern/iso-27001) [Microsoft 365 data protection](https://aegentra.co.uk/services/harden/data-protection) [ISO 27701 internal audit](https://aegentra.co.uk/services/govern/iso-27701-internal-audit) ### Clarify your requirement [Read the decision guide](https://aegentra.co.uk/knowledge/course-or-consultancy) ## Let’s define the work you actually need. Tell us what you need to achieve, what is in scope and where you are starting. [Talk about your project](https://aegentra.co.uk/contact)