ISO 27701 Implementations
Senior-led ISO 27701 implementation, extending your ISO 27001 ISMS to formal privacy management.
operating since 2017.
ISO 27701 is the international standard for Privacy Information Management Systems (PIMS), structured as an extension of ISO 27001 rather than a standalone certification. Organisations pursuing it are typically already ISO 27001 certified and need to demonstrate that privacy is managed with the same rigour as information security — often in response to customer expectations, contractual obligations as a PII controller or processor, or regulatory exposure.
Your implementation extends your existing Information Security Management System (ISMS) with privacy-specific controls, identifies and treats privacy-specific risks, aligns with the Australian Privacy Principles (APPs) and the Notifiable Data Breach (NDB) Scheme, and prepares your organisation for integrated ISO 27001 and ISO 27701 certification.
Privacy governance becomes part of how you already govern, not a parallel layer that has to be maintained separately.
Best for
Organisations who have an ISO 27001 implementation (or one that's underway) whose handling of personally identifiable information is material to the business, and who need demonstrable privacy governance to satisfy customer, contractual, or regulatory expectations.
Why choose us for ISO 27701
We have ISO 27701 expertise
Acumenis consultants have experience in helping clients to implement ISO 27701 and achieve certification. We have ISO 27701 Lead Auditors on staff.
Aligned with Australian privacy obligations
Your implementation isn't just about the standard; it's structured to align with the Australian Privacy Principles and the Notifiable Data Breach Scheme, so the PIMS is fit for the regulatory environment you actually operate in.
Privacy risk grounded in actual PII flows
Our implementation process maps where PII actually moves through your organisation, so the PIMS reflects how you really handle personal information rather than how it's described on paper.
Integrated audit and management review
Internal audit covers both ISO 27001 and ISO 27701, and management review is integrated with your existing ISO 27001 review rather than run separately. The PIMS becomes part of how you already govern.
Internal audit included, with consultant segregation
The integrated internal audit is conducted by a different consultant from the implementation lead, preserving the impartiality the standard requires and surfacing gaps before the certification body does. The internal audit can be performed at the same time as your ISO 27001 internal audit.
Senior consultants, based in Australia
Scoped and delivered by senior consultants based in Brisbane and surrounds, working with clients across Australia. On-shore data handling, local context, and clear accountability.
How your ISO 27701 implementation runs
Every engagement follows the same four-phase approach, tailored to your PII handling and existing ISMS maturity. Typical end-to-end timeframe is three to six months.
Phase 1 - Plan
You and your lead consultant map out the PIMS scope, identify privacy-specific risks that need to be managed, and determine the strategies best suited to treating them. PII flows are mapped so the PIMS is built on an accurate understanding of how personal information moves through your organisation. Integration points with your existing ISO 27001 ISMS are identified during this phase.
Phase 2 - Do
Your consultant prepares the privacy policies and processes required to implement the privacy controls identified in planning. Where the PIMS extends an existing ISMS, controls are added or adjusted rather than duplicated.
Phase 3 - Check
Your consultant conducts the initial integrated internal audit covering ISO 27701 and the underlying ISO 27001 framework, with a different consultant from the implementation lead to ensure independence. The Management Review Meeting is typically integrated into your existing ISO 27001 management review rather than run separately.
Phase 4 - Act
Your consultant reviews the outcomes of monitoring, internal audit, and management review, and applies the feedback to make final improvements. The focus is on ensuring you fully understand and feel confident with your PIMS processes so you can handle the certification audit independently. Optional audit assistance is available where you'd like additional support through the certification process.
Challenges you'll avoid
Privacy governance not covered by ISO 27001 alone
ISO 27001 covers information security broadly, and personal information is in scope. What it doesn't address are the specific obligations that come with being a PII controller or processor: consent management, data subject rights, lawful basis for processing, PII transfer arrangements, breach notification under the NDB Scheme. ISO 27701 fills that gap without duplicating what the ISMS already does.
PII flows that haven't been mapped
You can't govern PII you can't see. Phase 1 maps PII flows through your organisation as a foundation for the PIMS, so risk assessment and control decisions rest on how personal information actually moves, not how it's assumed to move.
Concern about running parallel management systems
Most organisations approaching ISO 27701 are already running an ISO 27001 ISMS and don't want a second governance system to maintain. Your implementation extends the ISMS: policies located in existing places, controls are added or adjusted rather than duplicated, internal audit is integrated, and management review is integrated. The PIMS becomes part of how you govern, not alongside it.
Australian Privacy Act reform on the horizon
The Privacy Act is being reformed in stages, with changes to consent, individual rights, and enforcement landing across 2024 to 2026. A structured PIMS puts you in a materially stronger position to adapt as specific obligations land, compared with retrofitting new requirements into ad hoc privacy practice.
Customer, contractual, or regulator pressure for privacy assurance
Customers and partners are increasingly asking how privacy is managed as a distinct question from how security is managed. Contracts are naming ISO 27701 as evidence of privacy governance, and regulator expectations are tightening. The PIMS provides a recognised, certifiable framework for showing privacy is managed deliberately rather than reactively.
Outcomes
After your ISO 27701 implementation, you'll have:
- A practical, audit-ready PIMS tailored to your PII handling, integrated with your existing ISMS
- Mapped PII flows, privacy risk register, and privacy risk treatment plan
- Core privacy policies and processes that reflect how you actually operate
- Alignment with the Australian Privacy Principles and the Notifiable Data Breach Scheme
- Evidence the PIMS is operating, including integrated internal audit and management review outputs
- Confidence to handle the integrated ISO 27001 and ISO 27701 certification audit independently
Proof in practice.
A snapshot of how we've helped Australian organisations strengthen security, meet stakeholder expectations, and move forward with confidence.
Frequently asked questions.
Straight answers to the questions we hear most. Can't find yours? We're happy to help.
Effectively, yes. ISO 27701 is structured as an extension of ISO 27001; it isn't a standalone standard. The two need to be implemented together, or ISO 27001 needs to be in place first. Where you want both, they can be scoped as a combined engagement, which is often more efficient than doing them sequentially.
ISO 27001 covers information security broadly, including personal information. What it doesn't address are the specific obligations that come with being a PII controller or processor: consent management, data subject rights, lawful basis for processing, PII transfer arrangements, breach notification under the NDB Scheme. Where customers, contracts, or regulators are asking specifically about privacy governance, ISO 27701 is the credible structured answer.
Your PIMS is designed to align with the Australian Privacy Principles and the Notifiable Data Breach Scheme as part of implementation, not as an afterthought. Where Privacy Act reforms land during or after the engagement, the structured PIMS makes it materially easier to adapt than retrofitting new requirements into ad hoc privacy practice. Note that legal interpretation of the Privacy Act sits with your legal counsel; the PIMS operationalises the interpretation they provide.
Yes. Acumenis is platform-agnostic. Whether you're using SharePoint, Jira, a commercial compliance platform like Vanta or Drata, or privacy-specific tooling, the PIMS is built to fit the tools you already have.
While we have certified lead auditors in our team, we don't perform certification audits for our clients to avoid a conflict of interest.
Yes! Acumenis can help implement ISO 27001 using compliance platforms such as Vanta or Drata.
Yes. We include an initial internal audit with your implementation, and can perform your internal audits each year after certification.
All Acumenis consultants are based in Australia, with team members in Brisbane and Toowoomba. We support clients nationally and internationally, meeting in person across South East Queensland and travelling as engagements require. Engagements are handled by the same consultant from start to finish, giving you clear accountability and on-shore data handling throughout.
Let's talk about where you are and where you need to be.
Whether you're preparing for certification, validating your controls, or building security foundations for growth, we'll help you get there with clarity and confidence.
