ISO/IEC 27701 Foundation study guide
ISO/IEC 27701 Foundation · Work through your exam, one topic at a time.
The ISO/IEC 27701 Foundation credential is an entry-level privacy certification offered through PECB's Privacy and Data Protection training category, alongside its GDPR course. It is aimed at candidates who need a working vocabulary of privacy information management rather than hands-on implementation depth: newcomers to privacy programmes, IT and security staff whose duties now touch personal data, auditors and consultants building awareness, and managers who support a privacy information management system (PIMS) without running it. The ISO/IEC 27701 Foundation study guide has 5 sections and about 1,979 words.
01Fundamental Concepts and Principles of Privacy and Data Protection
This domain tests vocabulary and principles. The exam expects you to separate privacy from data protection, use ISO/IEC 27701's own terms rather than national ones, and connect each principle to a control family later in the standard.
382 words, about 2 min02ISO/IEC 27701: Structure, Scope and Relationship with ISO/IEC 27001 and ISO/IEC 27002
This domain tests how 27701 is built. Expect questions on the clause architecture, on which parts are auditable requirements versus guidance, and on how an existing ISMS is extended rather than replaced.
385 words, about 2 min03PIMS Requirements and Guidance for PII Controllers
This domain tests Clause 5's additions to the management system and the controller-specific guidance in Clause 7 and Annex A. Questions usually present a scenario and ask which control family applies.
420 words, about 2 min04Guidance for PII Processors
This domain tests Clause 8 and Annex B. The core idea is narrow authority: a processor does only what the controller's documented instructions allow, and the controls exist to keep it inside that boundary.
391 words, about 2 min05Privacy Risk Assessment, Controls and Continual Improvement
This domain tests how privacy risk is assessed, how controls are selected and justified, and how the PIMS keeps improving. Questions often hinge on the difference between organisational risk and harm to individuals.
401 words, about 2 min