I85PREP
⌘ K
ISO 27701 Transition study materials
ISO 27701 Transition study resources

ISO 27701 Transition practice questions

One question at a time. Build your ISO 27701 Transition understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Foundations of ISO/IEC 27701:2025

ISO/IEC 27701:2025 is best described as which type of standard?

  1. A certification scheme operated by an accreditation body
  2. A sector-specific technical specification for healthcare data
  3. A management system standard extension for privacy information management Correct answer.
  4. A national law transposing the GDPR into domestic legislation

Explanation

ISO/IEC 27701 is a management system standard that extends ISO/IEC 27001 and ISO/IEC 27002 with privacy-specific requirements and guidance. It is not a law, a certification scheme in itself, or a sector technical specification.

Question 2Foundations of ISO/IEC 27701:2025

Which pair of standards does ISO/IEC 27701:2025 extend with privacy-specific requirements and guidance?

  1. ISO/IEC 29100 and ISO/IEC 29134
  2. ISO/IEC 22301 and ISO/IEC 22313
  3. ISO/IEC 27017 and ISO/IEC 27018
  4. ISO/IEC 27001 and ISO/IEC 27002 Correct answer.

Explanation

ISO/IEC 27701 is structured as an extension to the information security management requirements of ISO/IEC 27001 and the controls of ISO/IEC 27002. The other pairs cover cloud controls, business continuity, or privacy framework and impact assessment guidance.

Question 3Foundations of ISO/IEC 27701:2025

The 2025 edition of ISO/IEC 27701 is aligned with which edition of ISO/IEC 27001?

  1. The 2013 edition
  2. The 2019 edition
  3. The 2005 edition
  4. The 2022 edition Correct answer.

Explanation

The 2025 revision of ISO/IEC 27701 was restructured to align with the harmonized structure and the 2022 edition of ISO/IEC 27001. This alignment is the main reason organizations transitioning from the 2019 edition must rework their documentation.

Question 4Foundations of ISO/IEC 27701:2025

In ISO/IEC 27701:2025, the roles of PII controller and PII processor are addressed primarily through which mechanism?

  1. A voluntary annex that organizations may ignore during audit
  2. Separate sets of additional requirements and guidance for each role Correct answer.
  3. A single undifferentiated control set applied identically to all organizations
  4. A contractual clause template supplied by the certification body

Explanation

The standard provides distinct additional requirements and guidance depending on whether the organization acts as a PII controller, a PII processor, or both. This role-based structure lets each organization apply the provisions relevant to its actual processing position.

Question 5Foundations of ISO/IEC 27701:2025

Which term does ISO/IEC 27701 use for information that relates to an identified or identifiable individual and is processed under the privacy management system?

  1. Proprietary data
  2. Personally identifiable information (PII) Correct answer.
  3. Trade secret
  4. Classified information

Explanation

ISO/IEC 27701 consistently uses the term personally identifiable information, abbreviated PII, which is defined in ISO/IEC 29100 and adopted by the privacy management system standards. The other terms describe different categories of sensitive or restricted information.

Question 6Foundations of ISO/IEC 27701:2025

An organization already certified to ISO/IEC 27001 wants to add privacy information management. How does ISO/IEC 27701:2025 relate to that existing certification?

  1. It requires a separate management system built from scratch without shared processes
  2. It replaces ISO/IEC 27001 certification with a standalone privacy certificate
  3. It applies only to organizations that are not yet certified to ISO/IEC 27001
  4. It adds privacy-specific requirements that extend the existing ISMS scope and controls Correct answer.

Explanation

ISO/IEC 27701 is an extension, so it builds on the existing information security management system rather than replacing or duplicating it. Organizations integrate the additional privacy requirements into their current ISMS scope, risk assessment, and control set.

Question 7Foundations of ISO/IEC 27701:2025

Which document does ISO/IEC 27701:2025 expect an organization to maintain to record its role and processing position relative to PII?

  1. A privacy information management system scope statement and supporting documentation Correct answer.
  2. A list of software licences in use
  3. A marketing consent register held by the sales department
  4. A network diagram of firewall rules

Explanation

The privacy extension requires documented scope and supporting information describing the organization's role and the processing it covers. Firewall diagrams and licence inventories support security management but do not establish the privacy management system scope.

Question 8Foundations of ISO/IEC 27701:2025

What is the primary purpose of the privacy-specific guidance that ISO/IEC 27701:2025 adds to the ISO/IEC 27002 controls?

  1. To define penalties for privacy breaches
  2. To replace the security controls with privacy controls
  3. To explain how each control should be applied when PII is involved Correct answer.
  4. To specify the technical encryption algorithms to be used

Explanation

The guidance clarifies how the information security controls should be interpreted and applied where PII processing is in scope. It does not set penalties, prescribe specific cryptographic algorithms, or remove the underlying security controls.

Question 9Foundations of ISO/IEC 27701:2025

A company acts as a PII processor for several client organizations and also processes employee data for its own HR purposes. How should it apply ISO/IEC 27701:2025?

  1. Apply only the processor provisions because most of its processing is on behalf of clients
  2. Apply the processor provisions to client processing and the controller provisions to its own HR processing Correct answer.
  3. Apply only the controller provisions because employees are its own staff
  4. Choose one role for the whole organization and document that choice as a scope exclusion

Explanation

Organizations that act in both capacities apply the relevant role-specific provisions to each processing activity. Employee data processed for the organization's own purposes is controller processing, while client data processing is processor activity.

Question 10Foundations of ISO/IEC 27701:2025

During a transition audit, an auditor asks how the organization determined which privacy requirements apply to a new customer analytics platform. Which approach best reflects ISO/IEC 27701:2025 expectations?

  1. Copy the control set used for an unrelated payroll system
  2. Defer the decision until after the platform goes live
  3. Apply every control in the standard regardless of risk
  4. Perform a privacy risk assessment covering the platform and select controls accordingly Correct answer.

Explanation

The privacy extension works through the ISMS risk process, so new processing should be assessed for privacy risk and controls selected on that basis. Blanket application of every control or copying controls from an unrelated system does not demonstrate a risk-based rationale.

Question 11Foundations of ISO/IEC 27701:2025

An organization is transitioning from the 2019 edition of ISO/IEC 27701. What is the most significant structural change it must accommodate?

  1. The privacy impact assessment has been removed from the standard
  2. The standard no longer covers PII processors
  3. The standard now requires ISO/IEC 27017 certification as a prerequisite
  4. The standard now defines a standalone PIMS that can be certified independently of ISO/IEC 27001 Correct answer.

Explanation

The 2019 edition extended ISO/IEC 27001 and ISO/IEC 27002. The 2025 edition establishes a standalone privacy information management system (PIMS), allowing certification independently of ISO/IEC 27001. Transition planning must therefore account for the standalone PIMS requirements rather than treating privacy solely as an ISMS extension.

Question 12Foundations of ISO/IEC 27701:2025

Which statement correctly describes how ISO/IEC 27701:2025 handles the relationship between privacy and information security objectives?

  1. Privacy objectives are set only by the legal department
  2. Privacy objectives replace the information security objectives
  3. Privacy objectives are integrated with the ISMS rather than managed as a disconnected parallel system Correct answer.
  4. Privacy objectives are optional and need not be documented

Explanation

The standard integrates privacy requirements into the existing management system, including its objectives, so that privacy and security are planned and reviewed together. Privacy objectives do not displace security objectives, and they must be documented and monitored like other management system objectives.

Question 13Foundations of ISO/IEC 27701:2025

A privacy manager wants to demonstrate conformity with ISO/IEC 27701:2025 to a client. Which statement about certification is accurate?

  1. ISO/IEC 27701 certificates are issued directly by ISO
  2. Certification is issued against ISO/IEC 27701 by a certification body as an extension of the ISMS certificate Correct answer.
  3. Certification is unnecessary because the standard is self-declared only
  4. Certification requires membership of an industry privacy association

Explanation

Conformity certification is performed by accredited certification bodies, and privacy extension certification is issued alongside the ISO/IEC 27001 certificate. ISO itself develops standards and does not issue certificates to organizations.

Question 14Foundations of ISO/IEC 27701:2025

Which activity best demonstrates that an organization has integrated ISO/IEC 27701:2025 requirements into its existing management review process?

  1. Reviewing privacy performance indicators and risk treatment progress in the same management review as security topics Correct answer.
  2. Delegating all privacy decisions to the IT service desk
  3. Relying on customer complaints as the only privacy performance measure
  4. Holding a separate annual privacy meeting with no recorded inputs or outputs

Explanation

Integration means privacy performance and risk information feed the existing management review cycle alongside security topics, with recorded decisions. A disconnected meeting or reliance on complaints alone does not show a functioning integrated review.

Question 15Foundations of ISO/IEC 27701:2025

How should an organization treat the privacy-specific guidance in ISO/IEC 27701:2025 when completing its statement of applicability?

  1. Attach the standard's table of contents as the statement of applicability
  2. List every privacy control as applicable without justification
  3. Record how the applicable privacy requirements and controls are addressed or justified as excluded Correct answer.
  4. Omit privacy controls because the statement of applicability covers security only

Explanation

The statement of applicability must reflect the extended control set, including privacy-specific controls, with justification for inclusion or exclusion. Omitting privacy controls or listing them all without rationale defeats the purpose of the document.

Question 16Foundations of ISO/IEC 27701:2025

An organization processes biometric data for access control and also handles customer payment records. What does ISO/IEC 27701:2025 require regarding the treatment of these processing activities?

  1. Payment records fall outside the standard because they are financial data
  2. They should be identified and assessed according to their privacy risk, with appropriate controls applied Correct answer.
  3. Both must be treated identically because all PII is equivalent
  4. Biometric data must be excluded from the privacy management system scope

Explanation

The standard expects PII processing activities to be identified and assessed for privacy risk, with controls proportionate to that risk. Different categories of PII carry different risk profiles and are not treated as interchangeable.

Question 17Foundations of ISO/IEC 27701:2025

Which outcome best indicates that an organization has correctly applied the role-based structure of ISO/IEC 27701:2025?

  1. All staff are designated as PII processors to simplify training
  2. The organization declares itself a controller for all processing to avoid client obligations
  3. Documented responsibilities distinguish controller obligations from processor obligations for each processing activity Correct answer.
  4. Role assignment is left undocumented and decided case by case by operational staff

Explanation

Correct application means the organization has analysed each processing activity and documented which role-specific obligations apply. Blanket role declarations or undocumented case-by-case decisions do not reflect a controlled approach.

Question 18Foundations of ISO/IEC 27701:2025

What is the effect of ISO/IEC 27701:2025 on the ISO/IEC 27002 controls that an organization has already implemented?

  1. They become optional for organizations processing PII
  2. They are withdrawn and replaced by a new privacy control catalogue
  3. They are renumbered so that previous implementations become invalid
  4. They remain in place and are supplemented by privacy-specific guidance on their application to PII Correct answer.

Explanation

The security controls remain the foundation, and the privacy extension adds guidance on applying them where PII is processed. The standard does not withdraw, replace, or make the security controls optional.

Question 19Foundations of ISO/IEC 27701:2025

An auditor finds that an organization's privacy management system scope statement covers only its marketing website. What is the most likely finding under ISO/IEC 27701:2025?

  1. The scope is acceptable because websites are the main privacy risk
  2. The scope is acceptable if approved by the marketing director
  3. The scope is irrelevant because the standard does not require a defined scope
  4. The scope is incomplete because it omits other PII processing such as HR and client services Correct answer.

Explanation

The privacy management system scope must reflect the organization's actual PII processing, which typically includes employee and client data as well as web activity. A scope limited to one channel leaves significant processing outside the management system.

Question 20Foundations of ISO/IEC 27701:2025

Which statement best captures the relationship between ISO/IEC 27701:2025 and privacy laws such as the GDPR?

  1. The standard is a legally binding regulation enforceable by data protection authorities
  2. The standard applies only where no privacy law exists
  3. The standard provides a management framework that can support legal compliance but does not itself create legal obligations Correct answer.
  4. The standard supersedes national privacy laws for certified organizations

Explanation

ISO/IEC 27701 is a voluntary management system standard that helps organizations operationalize privacy obligations, but legal duties come from applicable law. Certification does not displace or override legislation, and the standard is relevant even where privacy laws are in force.

Question 21Foundations of ISO/IEC 27701:2025

An organization claims its ISO/IEC 27701:2025 implementation is complete because it has written a privacy policy and trained staff. Which element is most clearly missing from this claim?

  1. A larger privacy team
  2. A new brand identity for the privacy programme
  3. A separate building for privacy staff
  4. A risk-based control framework with documented applicability and performance monitoring Correct answer.

Explanation

A functioning privacy management system requires risk assessment, a statement of applicability, and monitoring of performance, not just a policy and training. The other options are organizational or cosmetic choices that the standard does not require.

Question 22Foundations of ISO/IEC 27701:2025

How does ISO/IEC 27701:2025 support interoperability between an organization's privacy programme and its suppliers' programmes?

  1. By mandating a single global privacy certification for all suppliers
  2. By providing a common set of role-based requirements that can be referenced in supplier agreements Correct answer.
  3. By removing the need for contracts between controllers and processors
  4. By requiring suppliers to adopt the customer's internal policies verbatim

Explanation

A shared standard gives controllers and processors a common reference for requirements, which can be reflected in contracts and assurance activities. It does not impose a single mandatory certification, require verbatim adoption of another organization's policies, or eliminate contracts.

Question 23Foundations of ISO/IEC 27701:2025

A certification body assesses an organization against ISO/IEC 27701:2025 and finds that its risk assessment excludes all processing carried out by a subsidiary. What is the soundest conclusion?

  1. The exclusion is acceptable if the subsidiary is profitable
  2. The exclusion undermines the risk assessment because subsidiary processing within scope must be assessed Correct answer.
  3. The exclusion is acceptable because subsidiaries are separate legal entities
  4. The exclusion is acceptable because risk assessment is optional under the standard

Explanation

If subsidiary processing falls within the defined privacy management system scope, it must be covered by the risk assessment; separate legal identity does not automatically remove it. Risk assessment is a core requirement, not an optional activity.

Question 24Foundations of ISO/IEC 27701:2025

Which interpretation of the 2025 edition's extension approach is most accurate for an organization rewriting its documentation?

  1. All ISMS documents must be discarded and rewritten from a blank template
  2. Documentation may be reduced to a single privacy statement signed by the chief executive
  3. Privacy documentation must be kept entirely separate from ISMS documentation
  4. Existing ISMS documents can be retained and supplemented with privacy-specific content mapped to the new clause structure Correct answer.

Explanation

The extension approach allows existing ISMS documentation to be retained and augmented with privacy-specific material mapped to the revised clause and control structure. Wholesale rewriting or complete separation wastes effort and undermines integration.

Question 25Foundations of ISO/IEC 27701:2025

An organization wants to use ISO/IEC 27701:2025 to demonstrate accountability to regulators. Which characteristic of the standard makes this credible?

  1. It guarantees that no privacy breach will occur
  2. It replaces the need for records of processing activities
  3. It exempts certified organizations from regulatory investigation
  4. It requires documented evidence of risk-based decisions, roles, and monitoring that can be independently assessed Correct answer.

Explanation

Accountability is supported by documented, assessable evidence of risk-based decisions, defined roles, and ongoing monitoring. The standard cannot guarantee the absence of breaches, exempt organizations from investigation, or remove the need for processing records.

Question 26Foundations of ISO/IEC 27701:2025

In ISO/IEC 27701:2025, which two organizational roles anchor the privacy-specific requirements?

  1. Auditor and auditee
  2. Data steward and data custodian
  3. PII controller and PII processor Correct answer.
  4. Security officer and privacy officer

Explanation

The 2025 edition organizes its privacy-specific requirements around the roles of PII controller and PII processor. This role-based structure lets organizations select the requirements that match their actual processing position.

Question 27Foundations of ISO/IEC 27701:2025

Which ISO/IEC 27001 element does ISO/IEC 27701:2025 extend rather than duplicate?

  1. The supplier contract negotiation process
  2. The product design lifecycle of the organization
  3. The financial reporting controls of the organization
  4. The management system clauses covering context, leadership, planning, support, operation, and improvement Correct answer.

Explanation

ISO/IEC 27701 extends the ISO/IEC 27001 management system clauses with privacy-specific requirements, so organizations integrate privacy into the existing ISMS rather than build a parallel system. Financial, product design, and contract negotiation processes are outside the standard's structure.

Question 28Foundations of ISO/IEC 27701:2025

What does ISO/IEC 27701:2025 add to the ISO/IEC 27002 control set?

  1. A set of financial audit procedures
  2. A list of mandatory encryption products
  3. A completely separate control catalogue that replaces 27002
  4. Privacy-specific implementation guidance mapped to the existing control themes Correct answer.

Explanation

The standard provides privacy-specific guidance that elaborates on the ISO/IEC 27002 controls rather than replacing them. Organizations keep the 27002 control structure and apply the additional privacy guidance where relevant.

Question 29Foundations of ISO/IEC 27701:2025

Which term does ISO/IEC 27701:2025 use for the individuals whose data is processed?

  1. Control owners
  2. Data subjects under the GDPR only
  3. System owners
  4. PII principals Correct answer.

Explanation

The standard uses the term PII principals to refer to the individuals to whom PII relates, keeping the vocabulary technology- and jurisdiction-neutral. System owner and control owner are governance roles, not references to individuals.

Question 30Foundations of ISO/IEC 27701:2025

An organization wants to use ISO/IEC 27701:2025 as evidence of its privacy accountability. What does the standard provide for this purpose?

  1. A structured set of requirements and guidance that can be audited against Correct answer.
  2. A substitute for registering with a data protection authority
  3. A guarantee that no regulatory fine will be imposed
  4. A legal opinion confirming compliance with every privacy law

Explanation

ISO/IEC 27701:2025 gives organizations an auditable framework of privacy requirements and guidance that supports accountability. It does not provide legal opinions, immunity from fines, or replace regulatory registration duties.

Question 31Foundations of ISO/IEC 27701:2025

Which relationship does ISO/IEC 27701:2025 describe between privacy and information security?

  1. Privacy completely replaces information security in the management system
  2. Privacy requirements only apply when no security controls exist
  3. Privacy relies on information security controls while adding requirements that go beyond them Correct answer.
  4. Privacy and information security are identical disciplines with the same objectives

Explanation

Privacy protection depends on robust information security, but the standard also adds privacy-specific requirements that security controls alone do not address. The two disciplines are complementary, not identical or mutually exclusive.

Question 32Foundations of ISO/IEC 27701:2025

What does ISO/IEC 27701:2025 expect an organization to produce when it applies the standard's privacy requirements?

  1. Documented information showing how applicable requirements are implemented Correct answer.
  2. A verbal briefing to senior management only
  3. A list of competitors' privacy policies
  4. A marketing statement about privacy leadership

Explanation

Like other management system standards, ISO/IEC 27701 relies on documented information as evidence that applicable requirements are implemented and maintained. Verbal briefings, marketing claims, and competitor analysis do not demonstrate conformity.

Question 33Foundations of ISO/IEC 27701:2025

A mid-sized firm handles customer data as a processor for one client and also runs its own marketing database as a controller. How should it apply ISO/IEC 27701:2025?

  1. Apply only the processor requirements because processing dominates its revenue
  2. Apply only the controller requirements because it owns the marketing database
  3. Apply the controller requirements to marketing and the processor requirements to client processing Correct answer.
  4. Choose one role for the whole organization and ignore the other

Explanation

The role-based structure allows an organization to apply controller requirements to activities where it determines purposes and means, and processor requirements where it acts on another party's instructions. A single organization can hold both roles for different processing activities.

Question 34Foundations of ISO/IEC 27701:2025

An organization is defining the scope of its privacy information management system under ISO/IEC 27701:2025. Which approach aligns with the standard?

  1. Base the scope on the ISMS scope and identify the PII processing activities and roles within it Correct answer.
  2. Set scope to the entire organization regardless of what the ISMS covers
  3. Limit scope to the department that writes the privacy policy
  4. Exclude all processing performed by suppliers

Explanation

Because 27701 extends the ISMS, its scope should build on the ISO/IEC 27001 scope and clearly identify the PII processing activities and roles covered. Narrowing scope to a policy-writing team or ignoring supplier processing creates gaps.

Question 35Foundations of ISO/IEC 27701:2025

A privacy team maps each ISO/IEC 27701:2025 privacy requirement to an existing ISO/IEC 27001 control or a new control. What is this activity called in management system practice?

  1. Drafting a press release
  2. Performing a gap analysis and updating the statement of applicability Correct answer.
  3. Conducting a penetration test
  4. Negotiating a service level agreement

Explanation

Comparing existing controls against new requirements and recording the outcome is a gap analysis, and the results feed into the statement of applicability. Penetration tests, press releases, and service level agreements serve different purposes.

Question 36Foundations of ISO/IEC 27701:2025

An auditor asks how the organization decided which ISO/IEC 27701:2025 requirements apply to a specific processing activity. What is the most defensible basis?

  1. The personal preference of the privacy officer
  2. The number of employees in the department
  3. The age of the IT systems involved
  4. A documented assessment of the organization's role and the nature of the processing Correct answer.

Explanation

Applicability should rest on an assessed determination of the organization's role and the characteristics of the processing, recorded as documented information. Personal preference, headcount, and system age are not valid bases for deciding applicability.

Question 37Foundations of ISO/IEC 27701:2025

How does ISO/IEC 27701:2025 treat the privacy-specific guidance when an organization prepares its statement of applicability?

  1. It should be considered alongside the 27002 controls and justified when excluded Correct answer.
  2. It must be copied verbatim without justification
  3. It should be replaced by the organization's marketing policy
  4. It must be ignored because only 27002 controls belong in the statement

Explanation

The statement of applicability records which controls are applied and why, so privacy-specific guidance should be evaluated and exclusions justified. Ignoring it, copying verbatim, or substituting marketing material undermines the document's purpose.

Question 38Foundations of ISO/IEC 27701:2025

An organization already certified to ISO/IEC 27001 adds ISO/IEC 27701:2025. Which benefit does this alignment offer?

  1. All prior security controls must be re-implemented
  2. Privacy requirements are managed within the existing ISMS governance and audit cycle Correct answer.
  3. A separate privacy management system must be built from scratch
  4. The existing ISMS certification is automatically revoked

Explanation

Because 27701 extends 27001, privacy requirements can be folded into existing governance, risk, and audit processes. This avoids duplication and does not revoke certification or require re-implementing existing controls.

Question 39Foundations of ISO/IEC 27701:2025

What is the most significant structural change introduced by the 2025 edition of ISO/IEC 27701 compared with the 2019 edition?

  1. The standard was withdrawn and replaced by a national law
  2. Privacy requirements are organized by PII controller and PII processor roles rather than by separate annexes Correct answer.
  3. The standard dropped all references to ISO/IEC 27001
  4. The standard was merged into ISO/IEC 27002

Explanation

The 2025 edition restructures privacy requirements around the controller and processor roles and aligns them with the harmonized structure of 27001 and 27002. It was not merged into 27002, withdrawn, or detached from 27001.

Question 40Foundations of ISO/IEC 27701:2025

A supplier asks whether ISO/IEC 27701:2025 certification is available. Which statement is accurate?

  1. Accredited certification is possible where a certification body offers it against the standard combined with 27001 Correct answer.
  2. Certification is issued directly by the standard's publishers
  3. Certification replaces the need for any contractual privacy terms
  4. Certification is prohibited by the standard

Explanation

Certification against ISO/IEC 27701 is performed by certification bodies, typically in conjunction with ISO/IEC 27001, where accreditation arrangements exist. The standard's publishers do not certify organizations, and certification does not remove the need for contracts.

Question 41Foundations of ISO/IEC 27701:2025

An organization processes health data for patients and also handles payroll data for its staff. How does ISO/IEC 27701:2025 help it address both?

  1. By excluding employee data from privacy consideration
  2. By treating all data as public to simplify handling
  3. By applying privacy requirements to each processing activity according to its role and context Correct answer.
  4. By applying requirements only to the larger data set

Explanation

The standard applies privacy requirements to each processing activity based on the organization's role and the context of that activity. Employee data is not excluded, and simplifying by treating data as public would be inappropriate.

Question 42Foundations of ISO/IEC 27701:2025

Which outcome best shows that an organization has correctly applied the role-based structure of ISO/IEC 27701:2025?

  1. Each processing activity is documented with its role and the corresponding requirements are implemented Correct answer.
  2. Roles are assigned once at company founding and never reviewed
  3. Only the processor role is documented regardless of activity
  4. A single generic privacy policy is applied uniformly without role analysis

Explanation

Correct application means identifying the role for each processing activity and implementing the matching requirements, with periodic review as activities change. A single undifferentiated policy, static role assignment, or documenting only one role falls short.

Question 43Foundations of ISO/IEC 27701:2025

An auditor finds that an organization's ISO/IEC 27701:2025 scope statement covers only its public website. What is the most likely concern?

  1. The website is too large to audit
  2. The scope is too broad to be credible
  3. Public websites cannot be included in any scope
  4. Material PII processing activities may fall outside the declared scope Correct answer.

Explanation

A scope limited to a public website may exclude significant processing such as HR, customer, or supplier data, leaving requirements unaddressed. The concern is under-inclusion, not excessive breadth or an inherent prohibition on websites.

Question 44Foundations of ISO/IEC 27701:2025

An organization claims its ISO/IEC 27701:2025 implementation is complete because it has written a privacy policy and trained staff. Which assessment is most accurate?

  1. Training is unnecessary if a policy exists
  2. These are useful elements, but the standard also expects risk assessment, documented controls, and continual improvement Correct answer.
  3. Policy and training alone fully satisfy all requirements
  4. The standard requires no documentation beyond a policy

Explanation

A policy and training are components of the management system, but 27701 also expects risk assessment, implemented controls, documented information, and continual improvement. Claiming completeness on the basis of two elements overlooks these requirements.

Question 45Foundations of ISO/IEC 27701:2025

A privacy manager must decide how to treat a new cloud service that stores customer PII. Which action best reflects the extension approach of ISO/IEC 27701:2025?

  1. Assess the new processing against existing ISMS risk processes and add privacy-specific requirements where gaps appear Correct answer.
  2. Delegate all privacy responsibility to the cloud provider
  3. Wait until the next annual audit before considering privacy
  4. Assume existing security controls cover every privacy obligation

Explanation

The extension approach means using the established ISMS risk process and layering privacy-specific requirements onto it as new processing appears. Delaying, delegating, or assuming full coverage by security controls leaves privacy obligations unaddressed.

Question 46Foundations of ISO/IEC 27701:2025

Two auditors disagree about whether a control is a security control or a privacy control under ISO/IEC 27701:2025. What does the standard's structure imply?

  1. The same underlying control may serve security and privacy purposes, with privacy guidance elaborating its use Correct answer.
  2. A control can only ever serve one discipline
  3. Security controls must be removed once privacy is adopted
  4. Privacy controls are entirely unrelated to 27002

Explanation

Because 27701 builds on 27002, many controls serve both security and privacy objectives, with privacy-specific guidance explaining how they support PII protection. Controls are not restricted to one discipline, and security controls are not removed.

Question 47Foundations of ISO/IEC 27701:2025

An organization is rewriting its documentation to align with the 2025 edition's extension approach. Which interpretation is most accurate?

  1. Privacy documentation must be kept secret from auditors
  2. The 2025 edition requires abandoning ISO/IEC 27001 certification
  3. Privacy requirements should be woven into existing ISMS documents rather than kept in a detached parallel set Correct answer.
  4. All ISMS documents must be discarded and rewritten from zero

Explanation

The extension approach favors integrating privacy requirements into the existing ISMS documentation set, avoiding a disconnected parallel system. Discarding all documents, concealing them, or abandoning 27001 certification misreads the standard.

Question 48Foundations of ISO/IEC 27701:2025

A certification body finds that an organization's privacy risk assessment excludes all processing performed by third parties. What does ISO/IEC 27701:2025 imply about this finding?

  1. Only the third party bears any privacy responsibility
  2. Third-party processing is always outside any privacy scope
  3. Risk assessment is optional for outsourced activities
  4. Outsourced processing still falls within the organization's privacy risk assessment where it involves the organization's PII Correct answer.

Explanation

Processing carried out by third parties on the organization's behalf remains part of its privacy risk landscape and must be assessed. Outsourcing does not automatically remove activities from scope, and responsibility is not transferred solely to the provider.

Question 49Foundations of ISO/IEC 27701:2025

How does ISO/IEC 27701:2025 support interoperability between an organization's privacy programme and those of its suppliers?

  1. A proprietary certification that only one vendor can issue
  2. A single global privacy law that all parties must adopt
  3. A shared, role-based requirements framework that both parties can reference in agreements and assessments Correct answer.
  4. A requirement to use identical software across parties

Explanation

A common role-based framework lets organizations and suppliers use the same vocabulary and requirements in contracts, assessments, and audits. The standard does not create a global law, a single-vendor certification, or mandate identical software.

Question 50Foundations of ISO/IEC 27701:2025

In the 2025 edition of ISO/IEC 27701, what is the primary role of the document relative to ISO/IEC 27001 and ISO/IEC 27002?

  1. It is a technical specification describing cryptographic methods for protecting personal data
  2. It is an extension that adds privacy-specific requirements and guidance to the information security management system Correct answer.
  3. It is a standalone certification scheme that replaces ISO/IEC 27001 for privacy processing
  4. It is a sector-specific regulation that applies only to healthcare and financial institutions

Explanation

The 2025 edition restructures ISO/IEC 27701 as an extension to ISO/IEC 27001 and ISO/IEC 27002, adding privacy-specific requirements and guidance on top of the general ISMS. It does not replace the ISMS standard nor function as a regulation or cryptographic specification.