Sessions
Date, delivery mode, trainer and fee are specific to each session. Fees are per person.
Request a quote for a date for your organisation or for the next run.
Application formNo membership required
Get a quote
Training content
Overview
ISO/IEC 27701 Privacy Information Management System Auditor Training has been designed to provide the knowledge and auditor skills required to assess privacy risks, controls and management system requirements relating to the processing of personally identifiable information (PII), and to conduct effective audits.
The training is based on the current ISO/IEC 27701:2025 requirements and ISO 19011:2026 guidance for management system audits. ISO/IEC 27701:2025 provides requirements and guidance for organisations to establish, implement, maintain and continually improve a Privacy Information Management System (PIMS).
The language of the training is Turkish. The training is delivered online.
About the Training
The training covers the structure of the ISO/IEC 27701:2025 standard, PIMS requirements, its relationship with ISO/IEC 27001 and ISO/IEC 27002, the context of the organisation, leadership, privacy risk management, the obligations of PII controllers and PII processors, the PII lifecycle, third-party and supplier relationships, data subject rights, personal data breach management, audit planning, gathering objective evidence, reporting nonconformities and following up corrective actions.
Who Should Attend?
- ISO/IEC 27701 auditors and auditor candidates
- Privacy Information Management System managers
- ISO/IEC 27001 auditors and information security teams
- Personal data protection and privacy teams
- Data protection and compliance officers
- Information technology and information security personnel
- Risk and compliance teams
- Personnel working in the fields of law and personal data protection
Internal audit and management system professionals
Objectives and Outcomes
The aim is to enable participants to interpret the requirements of ISO/IEC 27701:2025 correctly, evaluate the Privacy Information Management System using a risk-based approach and objective evidence, and conduct audits in accordance with the principles of ISO 19011:2026.
By the End of the Training
Participants will be able to:
- Explain the purpose, scope and structure of ISO/IEC 27701:2025.
- Evaluate the relationship between ISO/IEC 27701, ISO/IEC 27001 and ISO/IEC 27002.
- Evaluate the roles of PII controller and PII processor.
- Audit privacy risks and the relevant controls.
- Evaluate the processes for collecting, using, sharing, retaining and disposing of PII.
- Audit data subject rights and the relevant privacy obligations.
- Establish the audit scope, criteria and plan.
- Collect and evaluate objective audit evidence.
- Apply interviewing and sampling techniques.
- Report nonconformities objectively.
- Monitor the implementation and effectiveness of corrective actions.
Programme and Method
Training Topics
- Relationship between ISO/IEC 27701:2025, ISO/IEC 27001 and ISO/IEC 27002
- Privacy Information Management System (PIMS) Requirements
- Context of the Organisation, Leadership, Planning and Privacy Risk Management
- Roles and Obligations of PII Controllers and PII Processors
- PII Lifecycle, Data Subject Rights and Privacy Controls
- Management of Suppliers, Third Parties, Data Transfers and Privacy Incidents
- ISO 19011:2026 Auditing Principles and Auditor Competence
- Audit Planning and Determination of Scope and Audit Criteria
- Conducting the Audit, Interviewing, Sampling and Objective Evidence
- Audit Findings, Writing Nonconformities and Reporting
- Follow-up of Corrective Actions and Evaluation of Audit Effectiveness
Training Method
The training is delivered through presentations, evaluation of ISO/IEC 27701 requirements and privacy controls, PII controller and PII processor scenarios, audit planning exercises, interviewing and sampling activities, objective evidence assessments, case studies and nonconformity writing exercises.
Attendance and Certificate
Certification Rule
A certificate of attendance is issued to all participants whose attendance has been confirmed. To receive a certificate of achievement, participants must achieve a passing grade in the examination at the end of the training; participants who use all their examination attempts but do not pass will be issued a certificate of attendance.
FAQ and Resources
Who is the ISO/IEC 27701 Privacy Information Management System Auditor Training suitable for?
It is intended for professionals working in privacy, personal data protection, information security, risk, compliance, information technology, law, management systems and auditing.
What is the main objective of the training?
To enable participants to assess Privacy Information Management System requirements systematically and objectively and to conduct effective ISO/IEC 27701 audits.
Which areas are assessed during the audit?
Privacy policies, PII processing activities, privacy risks, data controller and data processor obligations, data subject rights, access and sharing controls, third parties, data transfers, retention and disposal processes, privacy incidents and relevant management system requirements are assessed.
Which organisations is ISO/IEC 27701 intended for?
ISO/IEC 27701:2025 can be implemented by public-sector, private-sector and non-profit organisations that collect, process, store or control personally identifiable information (PII).
Does the training include practical exercises?
Yes. The training includes audit planning, assessment of PII processing activities and privacy controls, objective evidence gathering, interviewing, sampling, case studies and nonconformity-writing exercises.
Is there an examination at the end of the training?
Yes. An assessment examination is administered at the end of the training.
References
- ISO/IEC 27701:2025 Information Security, Cybersecurity and Privacy Protection — Privacy Information Management Systems — Requirements and Guidance
- ISO/IEC 27001 Information Security Management Systems
- ISO/IEC 27002 Information Security Controls
- ISO/IEC 29100 Privacy Framework
- ISO/IEC 27018 Protection of Personally Identifiable Information (PII) in Public Clouds
- ISO 19011:2026 Guidelines for Auditing Management Systems
- Regulation (EU) 2016/679 General Data Protection Regulation (GDPR)
- Personal Data Protection Law No. 6698 (KVKK)
Similar trainings
EXEMPLAR002ISO/IEC 27701 Privacy Information Management System Transition Training8 hours · No session plannedEXEMPLAR018ISO/IEC 27019 Information Security, Cybersecurity and Privacy Protection Internal Auditor Training16 hours · No session plannedEXEMPLAR013ISO/IEC 27701 Privacy Information Management System Awareness Training8 hours · No session planned