ISO 27701 Certification Timeline: Complete 2026 Guide

Key takeaways

• The ISO 27701 certification timeline runs 4–10 months from kickoff to certificate, depending on what you already have running.
• The 2025 edition made PIMS standalone, so an ISO 27001 certificate is no longer a prerequisite — but it is still the single biggest accelerator.
• Accredited certification to the 2025 edition only became widely bookable during 2026, so auditor availability is now a real scheduling constraint.
• Certificates issued against the 2019 edition lapse on 31 October 2028. Work backwards from that date, not forwards from today.

The ISO 27701 certification timeline runs 4–10 months for most organizations, and the 2025 edition of the standard changed which parts of that schedule you actually control. Privacy information management is no longer an add-on audited on the back of an existing ISMS — it is a management system in its own right, with its own scope, its own risk process and its own certification bodies. That is good news if you have no ISO 27001 certificate. It is a schedule risk if you assumed your existing auditor could tack a privacy module onto next year’s surveillance visit.

This guide sets out the phases, what sets the floor under each one, how the schedule shifts depending on where you start, and the fixed deadline that should be driving your planning.

The realistic ISO 27701 certification timeline, phase by phase

The phases below assume a single legal entity, one or two sites, and a scope covering the systems that actually process personal data. Every range is typical practice rather than a rule in the standard — no clause of ISO/IEC 27701 sets a duration.

Phase	Typical duration	What has to be finished
Scoping and gap analysis	2–4 weeks	PIMS boundary agreed, controller/processor roles decided per processing activity, gap list signed off
Documentation build	4–10 weeks	Policies, privacy risk methodology, records of processing, applicability statement covering the consolidated Annex A
Implementation and evidence	8–16 weeks	Controls operating for long enough to leave records: PII principal requests, processor due diligence, incident handling
Internal audit and management review	2–4 weeks	One full internal audit across the PIMS, findings raised, management review minuted
Certification body selection and booking	2–8 weeks (run in parallel)	Accredited body confirmed for the 2025 edition, audit dates held
Stage 1 audit	1–2 days on site or remote	Documentation and readiness review; findings issued
Gap between stages	2–12 weeks	Stage 1 findings cleared
Stage 2 audit	2–5 days	Evidence that the PIMS is actually operating
Nonconformity closure and certificate issue	2–8 weeks	Corrective actions accepted, certification decision made

Add those up and a well-resourced mid-sized company lands at roughly five to seven months. What stretches the honest ISO 27701 certification timeline to ten is almost never the audit — it is the evidence phase, where records accumulate at the speed your business generates them.

What the 2025 edition changed about the ISO 27701 certification timeline

ISO/IEC 27701:2025 was published in October 2025 as edition 2, replacing the 2019 edition on 14 October 2025. The structural change is that the standard no longer sits on top of ISO 27001. It carries its own clauses 4 to 10 and a consolidated Annex A that now includes information security controls inside the standard itself, rather than pointing at ISO 27002.

Three consequences land directly on the ISO 27701 certification timeline:

• You can start without ISO 27001. A privacy-only path now exists, removing 6–12 months of prerequisite work for organizations previously told to certify an ISMS first.
• Your Statement of Applicability has to be rebuilt. It must cover the consolidated Annex A, including the security control table. If you are transitioning from 2019, this is the single largest document task and it is not a find-and-replace job.
• Scope and risk are no longer inherited. Under 2019 the PIMS borrowed its scope and risk methodology from the ISMS underneath. Now you write both, and the privacy risk method has to score impact on the PII principal, not only on your own organization.

We cover the change in detail in ISO 27701:2025 vs 2019, including which documents carry over untouched and which have to be built from nothing.

Accreditation availability is now a scheduling constraint

This is the part most planning guides leave out of the ISO 27701 certification timeline. A certification body cannot issue an accredited certificate against the 2025 edition until its own accreditation body has assessed it against the new requirements. Those requirements moved too: ISO/IEC 27706:2025 replaced ISO/IEC TS 27006-2:2021 as the standard governing bodies that audit and certify a PIMS.

UKAS published a technical bulletin on PIMS transition arrangements setting out the sequence: UKAS was ready to assess in April 2026, assessment of certification bodies began on 1 May 2026, bodies had to submit their gap analysis no later than December 2026, and UKAS will have transitioned all of its accredited bodies by 31 October 2027. Only then does it fall to those bodies to transition every certified client by 31 October 2028.

Ask any prospective auditor two questions before you sign: are you accredited to issue against ISO/IEC 27701:2025 today, and what is your lead time for Stage 1? A body still working through its own transition may quote dates six months out, and that sits on top of your implementation schedule rather than inside it.

Stage 1, Stage 2 and the gap between them

Certification follows the same two-stage structure as every other accredited management system audit. Stage 1 is a readiness and documentation review: the auditor checks that your PIMS scope makes sense, that the applicability statement justifies every inclusion and exclusion, and that you have run an internal audit and a management review. Stage 2 tests whether it operates.

The gap between the two is the most commonly mismanaged part of the ISO 27701 certification timeline. It has to be long enough to clear Stage 1 findings but short enough that your Stage 1 evidence is still current. Two to six weeks is the comfortable band. Book both stages together; going back for a Stage 2 slot after Stage 1 closes is how a six-month plan becomes a nine-month one.

One hard floor catches people every year: you cannot pass Stage 2 on a system that has never run. Most certification bodies want at least two to three months of live records — completed PII principal requests, processor due diligence files, an incident log, training completions. If your controls went live last week, no amount of documentation quality closes that gap.

ISO 27701 certification timeline by starting point

Where you begin matters far more than how big you are.

Starting point	Typical timeline	What drives it
Certified to ISO 27001, mature privacy practice	4–6 months	Scope, risk process, internal audit and management review machinery already exist; work is privacy-specific documents and Annex A mapping
Transitioning a 2019 PIMS certificate to 2025	3–6 months	Rebuild the applicability statement, re-map control references, stand up the scope and risk documents that used to be inherited; the audit can often be combined with a scheduled surveillance or recertification visit
GDPR program in place, no ISO certification	6–9 months	Records of processing and DPIA practice carry over; the management system layer — scope, objectives, internal audit, management review — is new
Standing start, no privacy program	9–12 months	Everything, including the data mapping that has to precede the PIMS itself

The transition row is the one worth reading twice. If you already hold a 2019 certificate, your ISO 27701 certification timeline is short but your deadline is fixed, and transition audits are usually combined with a surveillance or recertification visit you already had scheduled. That is the cheapest route available — and it disappears the moment you miss the window.

Five things that stretch the ISO 27701 certification timeline

1. Scope arguments. Deciding which entities, products and processing activities sit inside the PIMS is a commercial decision disguised as a technical one, and it routinely runs three weeks over.
2. Controller and processor roles left undecided. Most organizations are both, for different processing activities. Until you have written that down activity by activity, you cannot pick the right Annex A controls or the right records.
3. The applicability statement. Under the 2025 edition this document has to justify every control in a consolidated annex. Teams that treat it as a spreadsheet chore lose a month at Stage 1.
4. Processor agreements. Chasing signed terms and due diligence evidence out of suppliers is external dependency work, and no internal deadline moves it.
5. Auditor lead time. See above — in 2026 this is a live constraint rather than a formality.

None of these are technical problems. That is the pattern across every ISO 27701 certification timeline that overruns: the standard is rarely the obstacle, the decisions are.

The 31 October 2028 deadline

Certificates issued against ISO/IEC 27701:2019 remain valid until 31 October 2028 and then lapse. If your certificate expires before that date on its normal three-year cycle, your real deadline is the earlier one — you transition at recertification, not at the scheme deadline.

Miss the window and you do not get a transition audit. You get a fresh Stage 1 and Stage 2 against the 2025 edition, with a gap in your certification history that procurement teams will ask about. A transition typically takes three to six months, and certification bodies have their own capacity limits as the deadline approaches, so planning to start in 2028 is planning to fail. Work backwards from your next scheduled surveillance or recertification visit instead.

After certification, the cycle is the familiar one: a three-year certificate, surveillance audits in years one and two, and a recertification audit before the three years are up. Budget for that continuing effort when you build the business case — we break the numbers down in ISO 27701 certification cost.

ISO 27701 certification timeline: frequently asked questions

Do I need ISO 27001 before I can certify to ISO 27701?
No. The 2025 edition is a standalone management system standard, so a PIMS can be certified on its own. Most organizations holding ISO 27001 still run the two together, because the shared scope, internal audit and management review save both money and weeks.

Can I certify to the 2019 edition instead?
In practice, no. New certification against a superseded edition is not a sensible use of an audit, and any certificate you obtained would lapse on 31 October 2028 anyway.

How long is the audit itself?
Stage 1 is typically one to two days and Stage 2 two to five days for a small to mid-sized scope. Audit duration is set by your certification body against the rules in ISO/IEC 27706:2025, based on headcount, number of sites, and the complexity and volume of your processing — not by a figure you can look up.

What is the fastest realistic ISO 27701 certification timeline?
Around three to four months, and only if you hold a current ISO 27001 certificate, a working privacy program already generating records, and a booked auditor. Anything faster is a claim about documentation, not about a certifiable management system.

Does GDPR compliance shorten it?
Yes, materially. Records of processing, DPIA practice, breach procedures and subject request handling all carry across. What GDPR does not give you is the management system layer, which auditors test hardest. See our guide to ISO 27701 and privacy information management for how the two fit together.

Where to start

Pick your certification body before you finish your documentation, not after. Their accreditation status against the 2025 edition and their lead time are the two variables you cannot compress later, and pinning them down turns a vague ISO 27701 certification timeline into a dated one. Then work backwards: certificate decision, Stage 2, Stage 1, internal audit, three months of evidence, documentation.

The documentation phase is the one you can genuinely shorten. Our ISO 27701 Toolkit ships 75+ editable templates aligned to the 2025 edition — policies, privacy risk methodology, records of processing and an applicability statement built against the consolidated Annex A — for $99. It will not operate your controls, but it removes the four to ten weeks most teams spend drafting from a blank page.