In This Article
Overview
Based on hundreds of ISO 27701 audits, certain challenges and findings appear repeatedly. Understanding these common issues helps organizations avoid them and achieve smoother certification.
ISO 27701 audit findings typically fall into: (1) Foundation issues with ISO 27001 prerequisites, (2) Scope and role determination problems, (3) Documentation gaps, (4) Control implementation failures, and (5) Operational evidence deficiencies.
Foundation Issues
Since ISO 27701 extends ISO 27001, foundation problems cascade into privacy certification:
Challenge: Weak ISO 27001 Foundation
What auditors find: ISMS that barely meets ISO 27001 requirements struggles to support ISO 27701 extension.
Why it happens: Organizations rush to add privacy certification without solidifying their security foundation.
How to avoid: Ensure your ISMS is mature and operating effectively before adding ISO 27701. Address any ISO 27001 nonconformities first.
Challenge: Risk Assessment Disconnect
What auditors find: Privacy risks not integrated with information security risk assessment.
Why it happens: Privacy and security teams work in silos; risk methodologies differ.
How to avoid: Integrate privacy risk assessment into your existing risk management process. Same methodology, expanded criteria to include privacy impacts.
Challenge: Separate Management Systems
What auditors find: PIMS treated as separate from ISMS instead of an extension.
Why it happens: Different teams implement each standard independently.
How to avoid: Design PIMS as an integrated extension from the start. Same policy framework, same audit program, same management review.
Scope and Role Problems
Challenge: Unclear Role Determination
What auditors find: Organization hasn't clearly analyzed whether they're controller, processor, or both for each processing activity.
Why it happens: Controller/processor distinction can be complex; organizations default to assumptions.
How to avoid: Document formal analysis for each processing activity. Consider: Who determines purposes? Who determines means? Document your reasoning.
Challenge: Scope Misalignment
What auditors find: PIMS scope doesn't align logically with ISMS scope.
Why it happens: ISMS scope defined without considering privacy; PIMS added later without adjustment.
How to avoid: PIMS scope should be a subset of or equal to ISMS scope. If PII processing occurs outside ISMS scope, either expand ISMS or justify the gap.
Challenge: Incomplete Processing Inventory
What auditors find: PII inventory misses processing activities, data types, or recipients.
Why it happens: Data mapping done once and not maintained; shadow IT creates unknown processing.
How to avoid: Implement ongoing data discovery and mapping. Include processing inventory in change management process.
Documentation Gaps
Challenge: Missing Statement of Applicability
What auditors find: SoA doesn't include Annex A (controller) or Annex B (processor) controls.
Why it happens: Organizations extend ISO 27001 SoA without adding ISO 27701 controls.
How to avoid: Expand your SoA to include all applicable Annex A and/or Annex B controls with implementation status and justifications for any exclusions.
Challenge: Inadequate Privacy Policy
What auditors find: Privacy policy is generic marketing content, not operational policy.
Why it happens: Confusion between external privacy notice and internal privacy policy.
How to avoid: Create an internal privacy policy that establishes management commitment, privacy principles, and organizational approach to privacy—extending your information security policy.
Challenge: Missing Lawful Basis Documentation
What auditors find: No documented analysis of legal basis for processing activities (controllers).
Why it happens: Legal basis assumed rather than formally determined and documented.
How to avoid: For each processing activity, document the legal basis and rationale. Include legitimate interest assessments where that basis is used.
Control Implementation Failures
Challenge: Data Subject Rights Not Operationalized
What auditors find: Procedures exist but no evidence of actual rights handling.
Why it happens: Organizations focus on documented procedures but don't track actual requests.
How to avoid: Implement a request tracking system. Even if you receive few requests, have evidence of the process working (test requests, logs, response templates).
Challenge: Privacy by Design Theater
What auditors find: Privacy by design policy exists but no evidence of application in projects.
Why it happens: Policy created but not integrated into development/change processes.
How to avoid: Embed privacy checkpoints in project methodologies. Document privacy considerations in change records. Conduct DPIAs for significant changes.
Challenge: Subprocessor Management Gaps (Processors)
What auditors find: No formal subprocessor list, missing authorizations, inadequate agreements.
Why it happens: Subprocessors engaged informally without proper privacy due diligence.
How to avoid: Maintain a formal subprocessor register. Obtain controller authorization. Ensure flow-down of privacy obligations in contracts.
Challenge: Third-Party Agreement Deficiencies (Controllers)
What auditors find: DPAs missing required clauses, not signed, or not covering all processors.
Why it happens: Procurement doesn't involve privacy team; legacy contracts not updated.
How to avoid: Review all processor relationships. Ensure compliant DPAs are in place. Include privacy in procurement process.
Operational Failures
Challenge: No Privacy Incidents Recorded
What auditors find: Zero privacy incidents in a year of operation.
Why it happens: Privacy incidents not recognized or not reported through incident process.
How to avoid: Train staff to recognize privacy incidents. Integrate privacy incident classification into existing incident management. It's more credible to show incidents handled well than to claim none occurred.
Challenge: Internal Audit Didn't Cover Privacy
What auditors find: Internal audit program covers ISO 27001 but not ISO 27701-specific requirements.
Why it happens: Audit program not updated when PIMS was implemented.
How to avoid: Extend internal audit program to cover all ISO 27701 clauses and applicable Annex controls. Train internal auditors on privacy requirements.
Challenge: Management Review Ignores Privacy
What auditors find: Management review inputs and outputs don't address privacy performance.
Why it happens: Management review agenda not updated for PIMS.
How to avoid: Add privacy-specific inputs to management review: privacy incidents, data subject requests, privacy risk status, regulatory changes, privacy audit findings.
Prevention Strategies
Pre-Audit Readiness Review
- Conduct a gap assessment against ISO 27701 before audit
- Use an experienced assessor familiar with common findings
- Allow time to remediate gaps before certification audit
Integration from the Start
- Design PIMS as ISMS extension, not separate system
- Engage both security and privacy stakeholders
- Use common documentation, processes, and governance
Focus on Evidence
- For every control, ask "what evidence would prove this works?"
- Implement logging and record-keeping from day one
- Test processes with realistic scenarios
Learn from Others
- Engage consultants with ISO 27701 audit experience
- Review published guidance from certification bodies
- Participate in privacy professional networks
The most successful ISO 27701 implementations treat privacy as an integral part of information management, not a compliance checkbox. Organizations that embed privacy into their culture, not just their documentation, consistently achieve smoother certifications.