ISO/IEC 27701:2025 is the international standard for Privacy Information Management Systems — and the recognised framework for demonstrating GDPR accountability. Now fully standalone, you no longer need ISO 27001 first. Build your PIMS directly to satisfy data protection regulators, contractual due diligence requirements, and the expectations of the people whose data you process.
One standard, three distinct needs. Whether you’re starting from scratch, preparing for an audit or managing an existing certification, choose the support that fits where you are today, with a clear scope and tangible outputs, shaped around your business, risks and deadline.
Build a PIMS your team can run and an auditor can test, delivered by senior practitioners.
Know where you stand before the auditor does, with an independent, evidence-based view of your PIMS against ISO/IEC 27701:2025.
Keep your certification valid and your PIMS audit-ready as processing activities, suppliers and regulations change, without the scramble before each audit.
Exact deliverables are confirmed in your proposal after scoping.
Your budget should account for three elements: consultancy support, the certification body’s fees and your organisation’s own implementation effort.
Bitsecura provides a tailored quote after scoping your requirements. The fee depends on the services you need, the complexity of your organisation and how much work your team has already completed.
| What affects the fee | Why it matters |
|---|---|
| Scope and complexity | Multiple locations, systems and processing activities require more assessment and coordination. |
| Existing privacy practices | Established processing records, notices, procedures and usable evidence can reduce the work required. |
| Internal capacity | Some teams need targeted advice; others need more implementation support. |
| Engagement type | A standalone internal audit has a different scope from implementation or ongoing maintenance. |
| Delivery requirements | Delivery is remote by default. Any on-site activity identified during planning, and additional audit support, affect the fee. |
Your proposal should make clear the deliverables, responsibilities, delivery arrangements, fees and any separately priced activities.
Your Bitsecura fee covers the work listed in your proposal. Three other costs sit outside it, and the first is the one clients most often confuse with consultancy fees.
Workshops, document reviews, evidence assessment and many audit interviews can be delivered remotely. We agree meeting times, evidence-sharing arrangements and milestones with your team.
Where physical controls or operational activities need on-site assessment, we identify that requirement during planning. Your certification body determines the arrangements for its own assessment.
Every engagement is led by Arian Sheremeti, Bitsecura’s Principal GRC Consultant and Auditor, with more than 20 years of experience and a background at PwC and Deloitte.
You get a senior ISO 27001 Lead Auditor and Lead Implementer from the first scoping conversation, not a hand-off to a junior team. We work in a documented, repeatable way, and your policies, risk register and evidence stay in your own systems, so the PIMS belongs to your organisation.
There is no single answer. Your timeline depends on the agreed scope, existing controls, internal availability and the certification body’s schedule. We agree a realistic plan with you during scoping.
A credible plan allows time to implement controls, collect operating evidence, complete the internal audit and management review, and address findings.
Yes. ISO/IEC 27701:2025 is a standalone standard, so you no longer need ISO 27001 first.
If you already run an ISMS, much of the management system (risk, internal audit, management review and improvement) can be reused, and the two can share an audit cycle.
No certificate makes you GDPR compliant, only your actual processing does. ISO 27701 gives you a managed, auditable structure that maps well onto GDPR obligations (records of processing, roles as controller and processor, data subject rights handling), which makes demonstrating accountability far easier.
An external certification body conducts the certification assessment and decides whether to issue the certificate. Bitsecura provides implementation, internal audit and readiness support.
You can read more about the distinction in ISO’s guidance on certification.
No. Your organisation can maintain its own PIMS if it has the capacity and competence. Ongoing support is useful when you need additional expertise, independent internal audits or help coordinating maintenance activities.
Tell us whether you need implementation, an internal audit or ongoing PIMS support. We will discuss your existing arrangements and the outcome you need.
Book a free discovery call