What Is ISO 27701, and Does It Cover GDPR?

ISO 27701 turns up constantly in vendor trust centres and security questionnaires, usually next to a line that says a product is "ISO 27701 compliant". That phrasing hides an important detail: ISO 27701 is not a standalone award. It is a certifiable extension that sits on top of an existing ISO 27001 certificate, covering how an organisation manages personal data rather than information security in general. A vendor cannot hold ISO 27701 without already holding ISO 27001, and the certification body has to audit both together. This explainer sets out what the extension actually requires, why it is not the same thing as "GDPR certified", and what the CertReports index shows when you check how many ISO 27001 holders have actually extended their scope to ISO 27701 rather than just mentioning it in marketing copy.

What is ISO 27701?

ISO/IEC 27701:2019 is a standard published by ISO and IEC that specifies requirements for a privacy information management system, or PIMS. It was written as an extension to ISO/IEC 27001 and ISO/IEC 27002, adding controls for organisations that process personal data as a controller, a processor, or both. The PIMS layers extra controls and guidance points onto the information security management system an organisation already runs under ISO 27001, covering things such as consent records, data subject request handling, and cross-border transfer documentation.

Because it is an extension rather than a freestanding management system, ISO 27701 cannot be audited or certified on its own. A certification body has to confirm the underlying ISO 27001 scope first, then confirm the PIMS controls sit correctly inside that scope. That single dependency is the reason so much vendor marketing describes "alignment" with ISO 27701 rather than certification against it: alignment needs no audit, a stated certificate does.

How the extension attaches to an ISO 27001 certificate

In practice, the certification body issues one certificate, not two. The scope statement on an organisation's ISO 27001 certificate is amended to name ISO/IEC 27701 explicitly, and the surveillance audits that keep the ISO 27001 certificate active also cover the PIMS controls from that point on. If a vendor's ISO 27001 certificate lapses or is not renewed, any attached ISO 27701 extension lapses with it automatically, because there is nothing left for it to extend.

That dependency matters more than usual right now. Certificates issued against the 2013 edition of ISO/IEC 27001 lapsed on 31 October 2025 under IAF MD 26, and the index has already flagged vendor pages that kept citing the old edition after that date, as covered in the lapse tracking piece. A vendor whose base ISO 27001 certificate is stale cannot have a current ISO 27701 extension either, whatever the trust centre copy says.

Diagram showing ISO 27701 as a privacy layer stacked on top of an existing ISO 27001 scope statement, sharing one certificate number — ISO 27701 sits on top of an ISO 27001 certificate rather than standing alone.

What ISO 27701 certification actually requires

1
Hold a current ISO 27001 certificate
The organisation's information security management system must already be certified under the current edition of ISO/IEC 27001 and sitting in active surveillance. Nothing can be extended onto a certificate that does not exist or has lapsed.
2
State the PII role in scope
The scope statement has to say whether the organisation is acting as a PII controller, a PII processor, or both, because the extra controls added depend on which role actually applies to the service being certified.
3
Add the PIMS-specific controls
Annex A of ISO 27701 layers controls for consent management, data subject access requests, retention schedules and cross-border transfer documentation on top of the Annex A controls already audited under ISO 27001.
4
Pass a combined audit
The certification body assesses the information security management system and the privacy information management system in the same visit, usually folded into the existing ISO 27001 surveillance cycle rather than a separate engagement.
5
Carry the extension on one certificate
The certificate that comes out the other end names ISO/IEC 27701 directly in its scope statement, next to ISO/IEC 27001, sharing the same certificate number and the same expiry date.

Not directly. ISO 27701 and GDPR cover overlapping ground, personal data handling, consent, data subject rights, but they are different kinds of document. GDPR is a regulation with legal force, covered on the GDPR framework page in the index. ISO 27701 is a voluntary standard with its own control set, audited by a certification body rather than enforced by a regulator. Annex D of the standard maps ISO 27701 controls to specific GDPR articles, which is useful for a buyer building a questionnaire, but a mapping is not the same thing as equivalence.

ISO/IEC 27701 adds requirements and guidance for a privacy information management system, building on ISO/IEC 27001 and ISO/IEC 27002, so that organisations can demonstrate how they manage personal data as either a controller or a processor.
— ISO/IEC 27701:2019 standard overview, ISO

No such thing as "GDPR certified"

ISO 27701 does not make a vendor "GDPR certified". No scheme carries that label under UK or EU law, because GDPR does not operate a single EU-wide certification mark of that kind. The standard maps its own controls to GDPR articles in an informative annex, but certification is awarded against ISO's control set, not against the regulation itself.

Why the line gets blurred in vendor marketing

Security questionnaires usually have one line item for privacy certifications, and vendors fill it with whatever sounds closest, which is often ISO 27701 even when the actual certificate only covers ISO 27001. A trust centre built from marketing copy has every incentive to list every standard a vendor has read about, because a longer list looks more thorough to a procurement team skimming past it quickly.

The confusion is not usually deliberate. ISO 27701 shares an Annex A structure with ISO 27001, so a compliance team that has mapped its controls against the privacy extension internally, without paying for the formal audit, can reasonably describe itself as aligned with the standard. The trouble is that aligned with and certified against end up on the same page in the same font size, and a buyer skimming the page has no way to tell them apart without pulling the certificate itself.

ISO 27001 and ISO 27701 side by side

The differences are easiest to see side by side.

Aspect	ISO 27001	ISO 27701
Can be certified alone	Yes	No, requires an active ISO 27001 certificate
Primary focus	Information security management system	Privacy information management, added as a PIMS extension
Typical scope statement wording	Names only ISO/IEC 27001	Names ISO/IEC 27701 alongside ISO/IEC 27001
Maps to GDPR articles	Indirectly, through general security controls	Directly, via an informative annex mapping PIMS controls to GDPR articles
Lapses if base certificate lapses	Not applicable	Yes, automatically

Reading an ISO 27701 claim means checking it against the same scope statement as the underlying ISO 27001 certificate.

When a vendor's response to a security questionnaire lists ISO 27701, the next question is simple: does the certificate's own scope statement name it, or is this a page that only references the standard in prose? The distinction matters for the same reason the choice between SOC 2 and ISO 27001 matters: a buyer needs to know which document was actually audited, not which frameworks a vendor's marketing team decided to mention.

What the index shows: the extension is rare

ISO 27701 is one of the least commonly extended certifications in the CertReports index, relative to how often ISO 27001 itself appears on a vendor's trust centre. Most pages that mention the standard in prose do not carry it on the underlying certificate's scope statement at all.

612
Vendors in the index with an active ISO 27001 certificate: CertReports index, 2026-10-03; 38
Of those, vendors whose certificate scope also lists ISO 27701: CertReports index, 2026-10-03; 6%
Share of ISO 27001 holders that extend to ISO 27701: CertReports index, 2026-10-03

Docebo's framework list is a useful example of the distinction, because it states ISO 27701 next to ISO 27001, 27017 and 27018 rather than folding it into a single generic ISO 27001 line. Looking at the ISO 27701 row on its own, separate from the ISO 27001 row above it, is the quickest way to tell whether an extension is actually being claimed as its own certification line or just bundled into a broader security claim.

Docebo · Trust report

Education · Public evidence as of 12 Oct 2026

Visit trust centre Full evidence

Framework overview

CertReports state for each framework with public evidence: 2 verified, 9 vendor-stated.

2 more frameworks on the evidence page

5Documents and agreements

Legal and review documents Docebo publishes or offers, as of 30 Sep 2026.

Standard contractual clauses · On request
Subprocessor list · Public
Privacy policy · Public
AI and data use policy · Public
Public trust centre documents · Docebo SOC2 Report Renewal Statement (Bridge letter); Docebo ISO 27001, 27701, 27017, and 27018 latest certificate; Docebo ISO 9001 Certificate

2Security practices

Public statements from Docebo, shown as statements, not attestations, as of 30 Sep 2026.

Penetration testing · annual
Data residency · Australia, Canada, EU, India, US

1Subprocessors

Named on Docebo's public subprocessor list, last seen 30 Sep 2026.

List of all Docebo sub processors

Docebo lists ISO 27701 as its own row alongside ISO 27001, 27017 and 27018 rather than folding it into one line. Every line is a dated public record from the FedRAMP Marketplace, the Data Privacy Framework list and Docebo's trust centre. A framework not shown means no public evidence was found, not that Docebo lacks it.CertReports

How to verify an ISO 27701 claim

Ask for the certificate PDF, not the trust centre summary, and check the scope statement line for the words ISO/IEC 27701.
Confirm the certificate number and expiry date match the vendor's ISO 27001 certificate, since a genuine extension always shares both.
Check the certification body's own public register, where most accredited bodies list extensions separately from the base ISMS certificate.
Read the vendor's own trust centre carefully for the difference between certified and aligned with language.
If the vendor only offers a self-assessment or a mapping document, treat the claim as marketing copy rather than a certification.

Flowchart for checking whether a vendor's ISO 27701 claim is backed by a certificate scope statement or only appears in marketing copy — A vendor's ISO 27701 claim is only verifiable against the certificate's own scope statement.