This is an extension standard
ISO/IEC 27701 is certified as an add-on to ISO 27001, not on its own. You need ISO 27001 in place or in progress first. The calculator reflects the lighter, add-on audit effort.
What ISO/IEC 27701 is
ISO/IEC 27701 extends information security into privacy. It adds the controls needed to manage personal data properly: consent, data-subject rights, retention and sharing. It turns a security program into a privacy program as well.
Here is the important part: you cannot certify to ISO/IEC 27701 on its own. It is an extension of ISO 27001, so you must hold or pursue ISO 27001 first, then add 27701 on top. The audit for the extension is lighter because it builds on the security work already done.
For US companies it helps demonstrate privacy maturity to customers and supports obligations under laws like the California Consumer Privacy Act (CCPA) and GDPR for those with European users.
How to get certified
- Make sure ISO 27001 is in place or in progress. 27701 cannot stand alone.
- Map how you collect, use, share and retain personal data.
- Add the privacy controls: consent, data-subject rights, and privacy roles.
- Run the extended system and complete an internal audit and management review.
- Add ISO/IEC 27701 to your ISO 27001 audit scope with your certification body.
- Pass the combined audit and maintain both through surveillance.
Always use an accredited certification body
In the US, look for a body accredited by ANAB. An accredited certificate is the one customers, regulators and buyers actually trust — and you can confirm any certificate through IAF CertSearch.
How much ISO/IEC 27701 costs
Because it extends ISO 27001, the extra audit effort is modest. The calculator here applies a reduced factor to reflect that.
If you do not yet have ISO 27001, budget for that first. It is the larger cost.
The privacy mapping work is the main internal effort for the extension itself.
Calculate your cost range → Get free quotes →