ISO/IEC 27701 Foundation
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The ISO/IEC 27701 Foundation credential is an entry-level privacy certification offered through PECB's Privacy and Data Protection training category, alongside its GDPR course. It is aimed at candidates who need a working vocabulary of privacy information management rather than hands-on implementation depth: newcomers to privacy programmes, IT and security staff whose duties now touch personal data, auditors and consultants building awareness, and managers who support a privacy information management system (PIMS) without running it. Foundation-level study typically covers the core privacy and data protection concepts and principles, the structure and scope of ISO/IEC 27701 and how it extends ISO/IEC 27001 and ISO/IEC 27002, the PIMS requirements and guidance that apply to PII controllers, the parallel guidance for PII processors, and the basics of privacy risk assessment, control selection and continual improvement. Preparation normally means working through the standard's clause structure, learning to distinguish controller and processor obligations, and testing yourself on definitions and clause intent rather than memorising legal text. Important caveat: the official PECB page for this certification returned a 404 error when retrieved on 2026-11-07, so no exam parameters (question count, duration, passing score, fee, retake policy, validity period) could be confirmed from an authoritative source. Those values are shown as null on this page and should be verified directly with PECB before you book. This page is independent study material and is not affiliated with, endorsed by, or sponsored by PECB or ISO.
What you'll study
About ISO/IEC 27701 Foundation preparation
Is this page an official PECB or ISO resource?
No. This is independent study material written for candidates searching this exam. It is not affiliated with, endorsed by, or sponsored by PECB or ISO, and it does not reproduce any commercial question bank. Always treat PECB's own published exam rules and certification policies as the authoritative source for booking, rules and results.
What are the exam format, question count and duration?
We cannot state them. The official PECB page for this certification returned a 404 error when retrieved on 2026-11-07, so question count, duration, format, passing score and fee are all recorded as null here rather than guessed. Check PECB's exam rules and online exam manual pages, or contact PECB support, for current confirmed figures.
How long is the certificate valid and what does maintenance involve?
Unconfirmed. No validity period or maintenance requirement could be sourced, because the certification page was unavailable at retrieval. PECB publishes a certification maintenance policy and a certification rules and policies page; read those before you enrol so you know what ongoing activity, if any, is expected after you pass.
How should I sequence my study across the five domains?
Start with privacy concepts and principles, because controller and processor duties are defined in that vocabulary. Then learn the ISO/IEC 27701 structure and its relationship to ISO/IEC 27001 and 27002, since the PIMS clauses build on that base. Only then work through controller guidance, processor guidance, and finally risk assessment and continual improvement.
How hard is a Foundation-level privacy exam?
Foundation exams test recognition and comprehension, not implementation judgement. The usual difficulty is terminology: candidates confuse controller and processor obligations, or blur privacy risk with information security risk. If you can explain each clause's purpose in your own words and correctly assign a scenario to controller or processor, you are generally well prepared.
What are the most common failure modes?
Three recur. First, memorising clause numbers without understanding intent, which collapses on scenario questions. Second, treating ISO/IEC 27701 as a standalone standard instead of an extension of ISO/IEC 27001 and 27002. Third, answering controller questions with processor logic, or vice versa. Read each scenario for who determines purpose and means before choosing.
Do I need ISO/IEC 27001 knowledge first?
Strongly advisable. ISO/IEC 27701 extends the information security management system with privacy-specific requirements and guidance, so the management-system language of ISO/IEC 27001 and the control structure of ISO/IEC 27002 underpin most of the material. Without that base, the PIMS clauses read as isolated rules rather than an extension of an existing system.
What is the difference between the controller and processor sections?
ISO/IEC 27701 provides separate guidance for organisations acting as PII controllers and those acting as PII processors. Controller guidance addresses determining purposes and means and related obligations; processor guidance addresses acting on behalf of another organisation. Learn to identify, from a short scenario, which role the organisation plays, because role assignment drives the correct answer.
Where can I confirm details before booking?
Use PECB's own channels: the exam rules and policies page, the online exam manual, the certification rules and policies page, and PECB support. Note that the dedicated certification page was returning a 404 error at retrieval on 2026-11-07, so follow the ISO/IEC 27701 link from PECB's Privacy and Data Protection training listing instead of a bookmarked deep link.