# ISO 27701 Israel | International Privacy Standard on Top of ISO 27001 > Guide to ISO 27701 — the international privacy standard that builds on ISO 27001. What the standard requires, who needs it, the difference from ISO 27001, and how long certification takes. Relevant for SaaS targeting US/EU Enterprise, healthcare entities, and organizations seeking combined privacy + security compliance. **Canonical:** https://dpoisrael.com/en/learn/iso-27701/ **Locale:** en-IL --- **ISO/IEC 27701:2019** is the international standard for personal data management (Privacy Information Management System, PIMS). It builds _on top of_ **ISO 27001** and adds 49 specific privacy controls. For Israeli organizations after **Amendment 13** — ISO 27701 is a compliance proof increasingly demanded by global Enterprise customers, and it improves the ability to win complex public tenders. ## ISO 27701 at a glance - **What it is:** International privacy management standard (PIMS) - **Built on:** ISO 27001 (mandatory) - **Addition:** 49 privacy controls - **Fits:** SaaS, healthcare, public-sector vendors, finance - **Time to achieve:** 12-18 months from scratch (including 27001) - **Auditor cost:** 30,000-80,000 ILS - **Framework build cost:** 80,000-300,000 ILS or GRC Lite - **Conflict of interest:** We build — we do not audit ## What ISO 27701 is **ISO/IEC 27701:2019** is an international standard extending ISO 27001 (information security) into privacy. It builds a **Privacy Information Management System (PIMS)** on top of an existing ISMS, adding 49 specific privacy controls. In short: if you have ISO 27001, adding 27701 is an extension — not a standard from scratch. ## Who needs it Three main groups: **(1) SaaS companies targeting Enterprise** in the US or Europe — large customers increasingly require this standard as a substitute for or complement to SOC 2; **(2) Healthcare entities** handling special-sensitive data at scale; **(3) Public-sector vendors** demonstrating to municipal procurement that they have a structured privacy framework. ## Difference from ISO 27001 ISO 27001 = information security (CIA — Confidentiality, Integrity, Availability). ISO 27701 = personal data management (Privacy controls). They are complementary — not substitutes. ISO 27701 requires an active ISO 27001. You cannot certify 27701 without 27001. ## Difference from GDPR / Amendment 13 GDPR and Amendment 13 are **laws** — mandatory compliance. ISO 27701 is a **voluntary standard** — not required, but serves as compliance evidence to the laws. An organization with ISO 27701 essentially tells customers and the regulator: "We have a documented privacy management framework, verified by an external body." ## What the standard requires ISO 27701 adds 49 privacy controls to ISO 27001, divided into 4 groups: **(1) Context and roles** — DPO appointment, data category definition, purpose specification; **(2) Data subject rights** — access, correction, deletion procedures, consent flow; **(3) Sharing and retention** — sub-processors, cross-border transfer, retention periods, secure deletion; **(4) Privacy principles** — Privacy by Design, minimization, informed consent, accountability. ## How long it takes Starting from ISO 27001 (if not already): **9-12 months** to initial certification. Adding PIMS for 27701 on top of existing 27001: **3-5 additional months**. An organization starting from scratch can achieve both standards together within **12-18 months**, depending on size, internal engagement, and resources invested. Certification requires an external auditor (BSI, SGS, etc.) — a company I am not party to (that is a conflict of interest). ## What it brings to your customers When selling to Enterprise — shortens vendor onboarding time (instead of an 80-question survey, the Enterprise receives a certificate and spec). In public tenders — gives a strong signal of a managed framework. During an incident — reduces the expected scope of investigation; the Authority and enforcement bodies tend to trust a certified organization. ## Difference from SOC 2 SOC 2 is an American standard mainly serving the US market. ISO 27701 is international. Most SaaS companies targeting EU + US — do both. Many EU customers accept ISO 27701 even without SOC 2; US customers often accept SOC 2 even without ISO. ## Frequent questions about ISO 27701 ### We are not ISO 27001 certified — can we start with 27701? No. ISO 27701 builds on top of 27001 — you cannot certify one without the other. A path starting with ISO 27001 and then 27701 is required (or both in parallel, as resources allow). ### How much does it cost? The certification costs themselves (external auditor) — roughly 30,000-80,000 ILS for both standards together, depending on organization size and number of sites. Professional engagement costs for building the framework — 80,000-300,000 ILS for a full project, or 15,000-28,000 ILS per month on a GRC Lite retainer. See [GRC + Privacy package](/en/services/grc-privacy). ### Difference from PCI DSS? PCI DSS = dedicated standard for credit card processing. ISO 27701 = broad standard for general privacy management. An organization processing credit cards **must** have PCI DSS (no choice). ISO 27701 is voluntary. A financial organization dealing with both — implements both standards, sometimes also ISO 27001. ### We are a nonprofit — is it worth it? Usually not, unless there is international funding requiring it. A mid-size Israeli nonprofit is typically exempt from ISO 27701 — it is significant overhead that does not affect your market. Large nonprofits with American/European funding — sometimes obligated to meet such standards. ### Do you perform the certification itself? No. Conflict of interest. We **build** the framework (Privacy controls, documentation, procedures, risk assessments) and accompany the external auditor (BSI, SGS, Standards Institute of Israel, etc.). The auditor is the one issuing the certificate. ### Relationship between DPO and ISO 27701? ISO 27701 explicitly requires a DPO appointment (or role-holder with DPO duties). An organization maintaining our DPO as a Service — already meets this requirement. The DPO is a built-in part of PIMS, not an external addition. ### Do you have ISO 27701 experience? Yes. In [GRC + Privacy package](/en/services/grc-privacy) we build the ISO 27001/27701 framework for SaaS clients, healthcare entities, and public-sector vendors. The CISO on our bench leads 27001, and I as DPO lead 27701. ## Aiming for ISO 27701? The GRC + Privacy package supports the entire path — ISO 27001 + 27701 + DPO. [GRC + Privacy package](/en/services/grc-privacy)