PRIVACY GOVERNANCE & ISO 27701 CERTIFICATION READINESS

Protect Personal Information.
Strengthen Privacy Governance.
Build Trust.

Protecting personal information requires more than security controls and privacy policies. Organizations must establish clear accountability, understand how personal data is collected and used, manage privacy risks, and demonstrate effective oversight throughout the information lifecycle. ISO/IEC 27701 provides an internationally recognized framework for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS). I help organizations prepare for ISO 27701 certification through practical privacy governance assessments, personal data inventories, privacy risk evaluations, control implementation, and certification preparation. My approach emphasizes effective, efficient, and right-sized privacy management that supports regulatory obligations, strengthens customer confidence, and integrates with existing cybersecurity and compliance programs.

Schedule a Privacy Governance Consultation >>

THE BUSINESS CASE

Privacy Governance & Accountability

Privacy Compliance Requires More Than a Privacy Policy

Organizations face increasingly complex expectations for how personal information is collected, processed, shared, retained, and protected. Without clear governance, defined responsibilities, and consistent processes, privacy obligations can become fragmented across business functions. ISO 27701 provides a structured approach to establishing accountability, formalizing privacy practices, and integrating privacy management into everyday operations.

Personal Information Risk Management

Unmanaged Personal Data Creates Business Risk

Organizations cannot effectively protect personal information without understanding what data they hold, why it is processed, where it resides, and with whom it is shared. Incomplete inventories, unclear retention practices, and insufficient third-party oversight can increase privacy, regulatory, and reputational exposure. A structured Privacy Information Management System helps organizations identify, assess, and manage privacy risks throughout the personal information lifecycle.

Customer Trust & Independent Assurance

Demonstrable Privacy Governance Strengthens Trust

Customers, business partners, and other stakeholders expect organizations to demonstrate responsible handling of personal information. ISO 27701 provides a recognized framework for establishing and evaluating privacy management practices. Independent certification can help demonstrate organizational commitment to privacy governance, support customer assurance activities, and strengthen confidence in how personal information is managed.

WHAT I BRING

With more than 25 years of experience spanning executive technology leadership, cybersecurity, privacy risk management, regulatory compliance, and independent assurance, I bring a practical, business-focused perspective to ISO 27701 readiness. Having served as a CIO and national cybersecurity and information assurance practice leader, I understand the challenges organizations face in protecting sensitive information, managing regulatory obligations, and establishing effective governance. My approach connects privacy management with business strategy, operational accountability, and risk-based decision-making to help organizations build sustainable privacy programs without unnecessary complexity.

I help organizations establish and strengthen Privacy Information Management Systems aligned with ISO/IEC 27701, including defining PIMS scope, identifying personal information processing activities, evaluating privacy risks, and establishing appropriate governance and controls. This includes addressing responsibilities associated with personally identifiable information (PII) controllers and processors, developing privacy policies and procedures, evaluating third-party data processing relationships, and strengthening oversight throughout the personal information lifecycle. Where appropriate, I also align privacy management with existing ISO 27001, SOC 2, and enterprise risk management programs to reduce duplication and improve efficiency.

Beyond readiness assessments and gap analysis, I help organizations operationalize privacy governance through practical control implementation, documented processes, clearly assigned responsibilities, and ongoing program oversight. This includes coordinating remediation, supporting privacy impact assessments, preparing internal audits and management reviews, organizing evidence, and preparing for independent ISO 27701 certification. My objective is to help organizations establish an effective, efficient, and right-sized PIMS that strengthens accountability, supports applicable privacy obligations, and promotes continual improvement long after the initial certification assessment.

WHAT I HELP WITH

Effective privacy management requires more than policies, consent notices, and technical security controls. I help organizations establish practical, risk-based Privacy Information Management Systems (PIMS) that bring together governance, personal information inventories, privacy risk assessments, operational controls, and ongoing oversight. Whether you're developing a privacy program from the ground up or preparing for ISO 27701 certification, my approach emphasizes regulatory alignment, operational efficiency, and sustainable privacy practices that protect personal information and support business objectives.

PIMS Governance, Scope & Program Design

Establish the scope, governance structure, leadership responsibilities, and objectives of a Privacy Information Management System. Define privacy roles, organizational accountability, and appropriate management processes aligned with ISO/IEC 27701 and applicable business requirements.

ISO 27701 Gap & Readiness Assessments

Evaluate existing privacy governance practices against ISO/IEC 27701 requirements and applicable controls. Identify deficiencies in policies, documentation, risk management, personal information handling, and operational processes, then develop a prioritized roadmap toward certification readiness.

Personal Data Inventories & Privacy Risk Assessments

Identify and document personal information processing activities, data flows, retention practices, and third-party relationships. Support privacy risk and impact assessments, including evaluation of how personal information is collected, used, shared, stored, and disposed of throughout its lifecycle.

Privacy Policies, Controls & Operational Implementation

Develop and implement privacy policies, procedures, and operational controls addressing personal information handling, individual rights, retention, disclosure, incident management, and third-party oversight. Establish clear accountability for privacy activities and integrate controls into everyday business operations.

Internal Audits & Certification Preparation

Support PIMS documentation, internal audit planning, management reviews, corrective actions, and preparation for independent ISO 27701 certification audits. Organize supporting evidence, evaluate implementation readiness, and coordinate certification activities while maintaining appropriate independence.

Ongoing Privacy Governance & Continual Improvement

Establish recurring privacy risk reviews, control monitoring, compliance reporting, issue management, and program performance evaluations. Provide ongoing advisory and fractional leadership to help organizations maintain PIMS effectiveness, address evolving privacy requirements, and continually improve privacy management practices.

FREQUENTLY ASKED QUESTIONS

Establishing an effective privacy management program raises important questions about personal information protection, regulatory obligations, governance responsibilities, and certification requirements. The following frequently asked questions explain how ISO 27701 helps organizations establish a structured Privacy Information Management System, manage privacy risks, demonstrate accountability, and build sustainable privacy practices that strengthen customer and stakeholder confidence.

What is ISO 27701, and why should my organization pursue certification?

ISO/IEC 27701 is an internationally recognized standard for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS). It provides a structured approach to privacy governance, personal information protection, risk management, and accountability. Organizations may pursue certification to demonstrate that their privacy management system meets recognized requirements, strengthen customer confidence, support contractual expectations, and establish consistent oversight of personal information processing.

Do we need ISO 27001 certification before pursuing ISO 27701?

No. ISO/IEC 27701:2025 establishes standalone requirements for a Privacy Information Management System, allowing organizations to pursue ISO 27701 certification without first obtaining ISO 27001 certification, subject to applicable certification arrangements. Organizations with an existing ISO 27001 Information Security Management System can still integrate privacy governance into their established management processes, sharing governance structures, risk management activities, and supporting controls.

Does ISO 27701 certification demonstrate compliance with GDPR or U.S. privacy laws?

ISO 27701 can help organizations establish governance, accountability, and privacy controls that support compliance with applicable privacy laws, including GDPR and U.S. state privacy regulations. However, certification does not automatically establish legal compliance. Organizations must separately evaluate applicable legal requirements, processing activities, individual rights, contractual obligations, and jurisdiction-specific responsibilities. I help align privacy management practices with relevant requirements and coordinate with legal counsel where appropriate.

What is the difference between a PII controller and a PII processor?

A personally identifiable information (PII) controller determines the purposes and means of processing personal information, while a PII processor processes that information on behalf of a controller. Organizations may perform both roles depending on their activities and relationships. ISO 27701 addresses privacy governance and control considerations associated with these roles. I help organizations identify their responsibilities, document processing activities, and establish appropriate controls and third-party oversight.

How long does it take to prepare for ISO 27701 certification?

Readiness timelines depend on organizational size, the complexity of personal information processing, existing privacy governance maturity, applicable legal obligations, and available resources. Organizations with established information security and privacy programs may be able to leverage existing processes, while others require more extensive implementation. I help develop a practical roadmap covering PIMS scope, data inventories, privacy risk assessments, control implementation, internal audits, management review, and certification preparation.

What happens after an organization achieves ISO 27701 certification?

Maintaining an effective PIMS requires ongoing privacy risk reviews, monitoring of personal information processing, internal audits, management reviews, corrective actions, and continual improvement. Organizations must also respond to changes in business activities, third-party relationships, technology, and applicable privacy obligations. I provide ongoing advisory and program management support to help maintain certification readiness, strengthen privacy accountability, and keep privacy governance integrated with everyday operations.

LET'S STRENGTHEN YOUR PRIVACY GOVERNANCE

Protect Personal Information. Demonstrate Accountability. Build Lasting Trust.

Whether you're establishing privacy governance for the first time, strengthening an existing privacy program, or preparing for ISO 27701 certification, I can help you move forward with clarity and confidence. Together, we'll evaluate your privacy management maturity, identify gaps and risks, establish practical governance and controls, and build an effective Privacy Information Management System aligned with your business objectives. The result is a right-sized, sustainable approach to privacy management that strengthens accountability, supports regulatory obligations, protects personal information, and builds lasting stakeholder trust.