ISO 27701 Checklist — Free Privacy Readiness Assessment (2026)

Tell us about your environment

A few details to tailor your roadmap. Required fields are marked *.

Organisation name *

Your name *

Email (where to send your PDF copy) *

Primary sector *

Organisation size (FTE) *

Microsoft licensing tier

What is prompting you to look at ISO 27701 now? *

When do you need to be audit-ready?

1.Leadership & Governance0/4 2.Data Mapping & Risk Assessment0/3 3.Everyday Privacy Controls0/4 4.Vendors & Overseas Data0/2 5.Evidence & Monitoring0/4

👤

Leadership & Governance

Scope, ownership, policies and measurable targets.

Progress

0/4

PIMS scope is defined — covering systems, products, regions and teams that handle personal information, with clear in/out boundaries

A clear scope statement is the first thing an auditor checks. Vague or missing scope is the most common Stage 1 finding.

View evidence examples ->

A short scope statement listing systems, products, regions and teams handling personal data
A clear list of in-scope tools (e.g. CRM, support platform) and out-of-scope items (e.g. retired systems)
Identification of key PII types such as customer, employee or patient data

Privacy ownership is assigned — a named privacy lead or DPO with documented responsibilities, escalation paths and decision authority

Auditors want evidence that privacy is owned at a named level — not just delegated generically to IT or legal.

View evidence examples ->

A named privacy owner or lead with documented responsibilities
Clear escalation paths for incidents, complaints and high-risk decisions
Defined approval roles for privacy assessments and responses

Privacy policies and procedures are current, approved, communicated and actively followed — not just published and forgotten

Policies must be version-controlled, dated and demonstrably acknowledged. A policy no one follows is a finding.

View evidence examples ->

A current privacy notice published on your website or portal
Internal procedures for handling privacy requests and incidents
Documented retention, deletion and acceptable use rules

Privacy objectives and KPIs are defined, tracked and reviewed by leadership — such as SRR response times and training completion rates

Leadership can see whether privacy is improving or declining — not just whether incidents happened.

View evidence examples ->

Targets for responding to privacy requests within a set timeframe
Regular reporting on incidents, complaints or near-misses
Tracking privacy training completion rates across the organisation

🗺️

Data Mapping & Risk Assessment

Your ROPA, data flows, and DPIA methodology.

Progress

0/3

A Record of Processing Activities (ROPA) is maintained — covering purpose, data types, systems, vendors, lawful basis and retention for each processing activity

The ROPA is your single source of truth for data processing. Auditors will sample it against your actual systems.

View evidence examples ->

A register covering support, billing, marketing, product usage and HR processing
Each entry lists purpose, data types, systems, vendors and retention period
The register is reviewed when new systems or vendors are introduced

Personal data flows are mapped — you can explain where PII is collected, stored, shared and with whom, including overseas transfers

You need to understand how data moves across systems and vendors before you can control it.

View evidence examples ->

A simple diagram showing data flow from collection to storage to deletion
A list of third parties receiving personal data and their locations
Identification of offshore hosting, access or transfers

A DPIA (privacy risk assessment) methodology is defined and applied before high-impact changes, new processing or vendor onboarding

DPIAs for high-risk processing are mandatory under ISO 27701. Not running them is a common major nonconformity.

View evidence examples ->

Privacy assessments completed for new features, products or data uses
Reviews conducted when onboarding new vendors with access to personal data
Documented risks and agreed mitigations with owner sign-off

🔐

Everyday Privacy Controls

Minimisation, retention, consent, SRRs and training.

Progress

0/4

Privacy-by-design controls are implemented — data minimisation, defined retention periods, role-based access and automated deletion

Controls must actually be configured in your systems, not just stated in policy. Auditors will sample system configuration.

View evidence examples ->

Defined retention periods for customer and employee data, enforced in systems
Role-based access restricting sensitive information to authorised staff only
Automated deletion or anonymisation when data is no longer needed

Where consent is required, it is captured, auditable and can be shown when it was given, changed or withdrawn

Consent decisions must be traceable and defensible — a checkbox with no timestamp is not sufficient.

View evidence examples ->

Records showing when and how consent was captured (with timestamp and mechanism)
Preference management or opt-out capability connected to your systems
Audit logs of consent changes visible to the privacy team

Individual rights requests (access, erasure, correction, portability) are handled through a defined workflow within a committed timeframe

SRR handling is one of the most sampled controls in a PIMS audit. You need a ticket trail and response records.

View evidence examples ->

A workflow or ticket system for privacy requests with SLA tracking
Identity verification steps before releasing or deleting personal data
Closed records showing responses were sent on time with evidence

Privacy training is role-based, assigned to all relevant staff and completion is tracked with records available for audit

Training awareness is mandatory evidence. Auditors will ask to see completion reports and curriculum scope.

View evidence examples ->

Mandatory privacy training for all new starters within the first 30 days
Additional or tailored training for high-risk roles (e.g. support, sales, data teams)
Completion reports reviewed by management at least annually

🌐

Vendors & Overseas Data

Processor due diligence, DPAs and transfer safeguards.

Progress

0/2

Third-party processors are assessed before onboarding, contracts include privacy obligations (DPAs), and ongoing reviews are documented

Supply chain privacy risk is heavily scrutinised. A vendor with access to PII and no DPA is a significant finding.

View evidence examples ->

Vendor risk assessments completed before onboarding any processor with PII access
Privacy clauses and DPAs included in all relevant supplier contracts
Annual review of critical processors including SOC reports, certificates or questionnaires

Cross-border data transfers are identified, assessed for risk, documented, and safeguards (SCCs, TIAs) are in place where required

Offshore access or hosting without transfer assessment is a common audit gap — especially for cloud-hosted platforms.

View evidence examples ->

Identification of all systems with offshore access or hosting (including SaaS vendors)
Documented assessment of overseas transfer risks and applicable safeguards
Controls and contractual clauses in place to monitor and manage transfers

📊

Evidence & Monitoring

Evidence management, metrics, internal audit and review.

Progress

0/4

Privacy evidence is centralised, version-controlled and retrieval-ready — auditors should never need to chase documents

Evidence is the PIMS backbone. Centralised, structured evidence reduces audit stress significantly.

View evidence examples ->

Central storage of policies, registers and assessments with version history enabled
Clear ownership for maintaining each document type
Retention policies applied to privacy evidence in M365 or equivalent

Privacy metrics are reported to leadership on a regular cadence — request volumes, incidents, training rates and trend analysis

Metrics support informed decision-making and demonstrate active governance. Auditors will ask to see reporting history.

View evidence examples ->

Regular reporting on SRR volumes, incidents, DPIAs completed and complaints received
Trend analysis identifying recurring issues or problem areas
Metrics reviewed and actioned by leadership at least quarterly

Internal privacy audits are performed against a plan — covering PIMS controls — with findings tracked to verified closure

Internal audit is mandatory under ISO 27701. Findings must be owned, dated and verified closed.

View evidence examples ->

Annual internal audit plan covering ISO 27701 controls and a rotating sample of processing activities
Audit reports with findings, root cause, corrective actions, owners and due dates
Evidence that corrective actions are verified closed — not just marked done

Management reviews are held at planned intervals — covering PIMS performance, risks, incidents, KPIs and improvement decisions

Management review minutes are mandatory evidence and one of the first documents auditors request.

View evidence examples ->

Management review agenda and minutes covering all required ISO 27701 inputs
Recorded decisions on resourcing, policy changes, risk acceptance and improvement priorities
Action register with owners, due dates and closure tracking

Overall readiness

Answer questions to score

Leadership & Governance -

Data Mapping & Risk Assessment -

Everyday Privacy Controls -

Vendors & Overseas Data -

Evidence & Monitoring -

0 of 17 questions answered

Available once all questions are answered

ISO 27701 Privacy Readiness Checklist

Tell us about your environment

Leadership & Governance

Data Mapping & Risk Assessment

Everyday Privacy Controls

Vendors & Overseas Data

Evidence & Monitoring

Your report is ready