ISO 27701 LA case studies
ISO 27701 LA · Put your knowledge to work in context.
The PECB Certified ISO/IEC 27701 Lead Auditor credential is aimed at professionals who audit privacy information management systems (PIMS). The associated training course is built around auditing a PIMS based on ISO/IEC 27701:2025 by applying widely recognized audit principles, procedures, and techniques, and it prepares participants to plan and carry out audits in line with ISO 19011, ISO/IEC 17021-1, and ISO/IEC 27706. The ISO 27701 LA case studies are 5 cases and about 3,971 words.
1Scoping a PIMS When the Organization Is Both Controller and Processor
A healthcare software vendor with 260 staff holds ISO/IEC 27001:2022 certification for its Dublin and Lisbon data centres and now seeks ISO/IEC 27701 certification. In the opening meeting the CISO describes the scope as "all PII processed in delivering our patient-management platform".
781 words, about 4 min2Testing the PIA Process Through Release Sampling
Northlane Payments (400 staff, EU and UK) has operated its PIMS for 14 months. Its PIA procedure states that a privacy impact assessment is required for changes assessed as "high risk", but never defines high risk and names no trigger criteria.
761 words, about 4 min3Impartiality, Objectivity and an Unrealistic Surveillance Budget
During planning for the first surveillance audit of Vantage Analytics (90 staff, combined ISO/IEC 27001 and ISO/IEC 27701 certification), the certification body assigns Ms Okafor as lead auditor. Fourteen months earlier she had been contracted to perform the gap analysis and draft the PIMS risk assessment and Statement of Applicability.
798 words, about 4 min4Stage 1 That Does Not Support a Stage 2
TerraLog Freight (1,400 staff, six sites in three countries) is preparing for its first combined ISO/IEC 27001 and ISO/IEC 27701 certification audit. Stage 1 was conducted remotely in three and a half hours by a single auditor and concluded "documentation complete, ready for Stage 2".
831 words, about 4 min5Closing Meeting, Corrective Action and the Certification Decision
Helix Medical Billing processes claims data for 40 hospital clients from India and Poland. At the closing meeting of its Stage 2 combined audit, the lead auditor has raised a major nonconformity: in two of eight contracts sampled, sub-processors were engaged without documented controller authorisation, and the sub-processor register lists five entities covered by no contract.
800 words, about 4 min