5 Common Problems in ISO/IEC 27701:2025 Certification and Tips to Avoid Them

If your organization is pursuing ISO 27701 certification, you may face unforeseen challenges that can potentially slow down the entire process. Many times, they just crop up suddenly, derailing your hopes of providing privacy assurances to your customers (at least temporarily). 
 
As an ISO Certification Body, Schellman has performed countless 27701 certification assessments over the years, and our clients have encountered some of the same gaps many times over. Now, we want to help you avoid them. 

In this article, we’ll go over 5 common issues that our ISO team frequently identifies during the ISO 27701 certification process. By addressing these challenges ahead of your organization’s initial certification or scope expansion, you can help your process proceed smoothly and more efficiently.  

5 Common Gaps in ISO 27701 Certifications 

1. PIMS Scoping and Documentation Issues

Scoping is so delicate with all compliance initiatives, it’s no wonder that organizations run into problems scoping their ISO 27701 privacy information management system (PIMS) too. 
 
The PIMS is no longer an extension of your ISO 27001 information security management system (ISMS), so when you go about defining its scope/boundaries in the context of the processing of personal data, remember this: 

• The PIMS should be scoped to include the privacy concerns focal to your privacy program. 
• The scope of the PIMS may be narrower than your privacy program as a whole. 
  • The scoping documentation should clearly outline the boundaries of your PIMS – if a process is not intended to be included, it may be worth explicitly noting as such. 

 As you create and define these boundaries, you’ll face a key decision point: Do you fold the PIMS requirements into existing ISMS documentation or create standalone documentation? 

• The case for folding in: 
  • If your ISMS/PIMS is one combined management system, you should be able to easily incorporate the PIMS scope into the ISMS documentation. 
  • You avoid the efforts of duplicative documentation and can also consolidate updating both sets for relevant changes. 

• The case for additional documents: 
  • You’d be less likely to miss/exclude areas regarding PIMS/ISO 27701/privacy references.  
  • Separate departments are responsible for oversight of the management systems, and there is no overlap in activities.  

2. Flaws in the ISO 27701 Risk Assessment

Another key item to get right is your ISO 27701 risk assessment. You’re required to do one, and it can either stand alone or be integrated into your security risk assessment process. The 27701 risk assessment requirements include: 

• Identifying the applicable controls in Annexes A.1, A.2, and A.3 of ISO 27701 that help mitigate personally identifiable information (PII)-related risks; and
• Addressing the impact of the risk not just for your business but also for PII principals and their data. 
  

Your 27701 risk assessment must include the following: 

• Risk Identification: How do you identify risks and potential threats to your processing of PII? 
• Risk Analysis: How do you identify the likelihood and impact of a risk or threat occurring? 
• Risk Documentation: How do you track, record, and assign owners to risks? 
• Risk Treatment: How are risks mitigated? How are controls selected and implemented to lower the risk likelihood or impact? 

3. Incorrectly Documented Statement of Applicability

Once you’ve completed a risk assessment, you’ll move on to the required statement of applicability (SOA). Your SOA should tie back to the risk assessment and document the current control environment, not a future state. It should not capture an anticipated circumstance or state—this is often a big issue in SOAs.  

For example, if you do not currently process data jointly, then the control should be N/A. Even though there could be a situation in the future where that applies, it does not make it applicable now. 

Core components of your SOA—to be documented in a current state—include: 

• Your implemented controls and their justifications 
• The reasoning for all excluded controls 
• The implementation status of controls 

4. Lack of Internal Audit and Management Review

Internal audits are a required component of establishing and maintaining a PIMS, but it’s also a way to double check your team’s work. The internal audit should occur after the risk assessment (mentioned in #2) has been conducted. You should perform this internal audit to verify that: 

• In-scope controls are appropriate and functioning; and 
• ISO 27701 requirements and controls are met.
  

This’ll also help to confirm that no necessary controls have been omitted. As a reminder, once the internal audit has been performed, the PIMS must still go through the established management review process. The management review allows senior leadership to perform an additional appraisal to confirm that the PIMS is reflective of the organization’s current landscape, considering the follow factors:  

• Have any changes occurred internally or externally that impact the PIMS?  
• Are the needs and expectations of internal or external interested parties accurate?  
• Are there trends related to nonconformities, monitoring results, or audits that may reveal pervasive issues?  
• How can the PIMS align more with best practice?  

Tracking the outputs of these questions enables the organization to demonstrate the maintenance and continual improvement of the PIMS.  

5. Commonly Misunderstood Controls in Annexes A.1 and A.2

With ISO standards being as comprehensive as they are, it should be no surprise that some controls are sometimes missed or misunderstood. Let us clear up some common misconceptions so you can avoid issues with these controls: 

Next Steps for Your ISO 27701 Certification 

Aside from these, several other, general issues we find during the certification process include: 

• An overreliance on contractual agreements and the privacy notice
  • While these documents are key to defining privacy obligations and responsibilities, you should record additional policies and procedures to demonstrate how you communicate, support, and implement these privacy obligations requirements.
• Failure to consider or misunderstanding applicable legislation/regulations
  • Organizations sometimes think ISO 27701 equates to compliance with a particular law or privacy regulation. And while the implementation guidance does reference laws/regulations, don’t make the mistake of failing to consider other applicable regulations—you might meet a control without actually meeting a legal requirement.
  • The opposite is also true—you’ve chosen to go through this certification, so you cannot disregard a control requirement just because it’s not a legal requirement from another regulation that you’re subject to. If your risk assessment process has denoted a control requirement as applicable, you will be held accountable for implementation. 

All of these issues can hinder a smooth ISO 27701 process, but now that you have this list of items to avoid, you should be better positioned than most to avoid these possible causes of derailments or delays. 

But this certification—and privacy as a whole—is very complex, so if you find that you still have some questions about how to make this process easier, please feel free to contact our dedicated privacy team, who would be happy to address any concerns you might have. 

In the meantime, discover additional ISO 27701 certification insights in these helpful resources:  

• An Overview of ISO 27701 
• How to Prepare for ISO 27701:2025 
• Get Your Free Guide to ISO 27701