ISO 27701 security awareness training
ISO/IEC 27701:2025 is a privacy management system you can certify on its own. Clauses 7.2 and 7.3 ask you to prove that people who handle personal data know the privacy policy and are competent to follow it.
Five-to-ten-minute 3D exercises mapped to each ISO 27701 duty, with completion evidence your auditor can export.
At a glance
- Edition
- ISO/IEC 27701:2025, published 14 October 2025
- Training duty
- Clauses 7.2 competence and 7.3 awareness
- Control
- A.3.17 information security awareness, education and training
- Outcome
- No fines; an auditor raises nonconformities instead
Where the 2025 edition asks for people, not paperwork
Two management-system clauses and one shared control decide whether your staff training passes the audit.
- 7.2 Competence Decide what each privacy-relevant role must know, train the gap, keep evidence.
- 7.3 Awareness Staff know the privacy policy, their part in the PIMS and what a lapse costs.
- A.3.17 Awareness, education and training The shared Annex A control both controllers and processors apply.
Annex A holds 78 controls: 31 for controllers, 18 for processors and 29 for both.
The ISO 27701 path, ready to assign
Seven courses, six required and one optional, assigned again every 12 months.
- Privacy at the centre
- The GDPR Compliance course carries DSARs, consent, RoPA, DPIA and breach response.
- Security underneath
- Phishing, sensitive data, safe sharing and incident reporting sit around it.
- Records for clause 7.2
- Per-user PDF certificates, a tenant CSV and a compliance report page.
From scope to surveillance audit
What the clauses say, who they reach and how the 2025 edition changed them.
01 Stage 1: Decide your role in PII processing
Annex A is split by role. Table A.1 applies to PII controllers, Table A.2 to PII processors, and Table A.3 to both.
Many SaaS companies are both. Your role decides which controls end up in scope and which teams need privacy scenarios.
02 Stage 2: Define competence per role (clause 7.2)
List the jobs whose work affects PII:
- support agents who receive access requests
- marketers who collect consent
- engineers who design data flows
- procurement and legal staff who sign with processors
Write down what each role must be able to do, then close the gap with training.
03 Stage 3: Build awareness for everyone (clause 7.3)
Every person under your control needs to know the privacy policy and their part in it. That includes contractors.
A short annual course is the usual baseline. The auditor will check that it actually reached the whole population.
04 Stage 4: Keep documented information
Clause 7.2 asks for documented evidence of competence. In practice that means who was assigned what, when they finished and what the content covered.
A spreadsheet assembled the week before the audit rarely survives sampling.
05 Stage 5: Certification and surveillance audits
An accredited certification body audits the PIMS in two stages, then returns for surveillance audits during the certificate cycle.
Training records are sampled at each visit, so a program that lapses after the first audit shows up in the second.
06 Stage 6: Move from the 2019 edition
Organisations certified to the 2019 edition need a transition audit. DNV said the IAF was still setting the transition rules, because the standard became standalone.
Some certification bodies plan around October 2028, three years after publication. Confirm the date with your own certification body.
07 How RansomLeak covers ISO 27701
The ISO 27701 Privacy Information Management Training path has seven steps:
- Security Policies & Your Role
- Phishing & Impersonation Attacks
- GDPR Compliance
- Protecting Sensitive Information
- Safe Communication & Sharing
- Incident Reporting
- AI Basics for Everyone (optional)
GDPR Compliance is the privacy core. Its exercises cover DSAR handling, fraudulent DSAR detection, consent, RoPA and data mapping, DPIA, processor vetting, cross-border transfers, PII redaction and breach response.
The GDPR wording is useful even outside the EU, because these are the same tasks the Annex A controller and processor controls describe.
The path is assigned again every 12 months. Completion evidence comes as a per-user PDF certificate, a tenant CSV and a compliance report page, and can sync to Vanta or Drata.
PIMS duties next to the exercises that cover them
Controller and processor obligations staff touch every week, each paired with a scenario.
B.7.2 Conditions for Collection & Processing B.7.3 Obligations to PII Principals (DSAR) B.7.4 Privacy by Design & Default B.7.5 PII Sharing, Transfer & Disclosure C.8.5 Customer Obligations & Notification A.6.3 / A.5.10 ISMS Awareness Foundation A.5.23 Privacy in AI / Cloud Services Recommended exercises
Privacy scenarios for the teams that open requests, contracts and data sets.
- Legitimate DSAR Processing Support staff answer an access request on time and with the right data. Try the exercise
- Fraudulent DSAR Detection Spot an attacker posing as a data subject to pull someone else’s records. Try the exercise
- Marketing Consent Management Consent collection and recording, a Table A.1 controller topic. Try the exercise
- Data Mapping and Records of Processing Build the inventory a PIMS auditor asks for first. Try the exercise
- Data Protection Impact Assessment Assess a high-risk change before it ships. Try the exercise
- Third-Party Data Processor Vetting Check a processor before procurement signs the contract. Try the exercise
- Cross-Border Data Transfers Engineering and legal check where personal data is allowed to go. Try the exercise
- PII Document Redaction Remove personal data properly before a document leaves the team. Try the exercise
- Data Breach Response Recognise a personal data breach and escalate it fast. Try the exercise
Where audits find training gaps
Certification bodies, not regulators, decide whether the training holds up.
Training that only covers security
An organisation moves from ISO 27001 to a standalone PIMS and reuses its security awareness course. The auditor asks how support staff verify the identity of someone asking for their data.
Nobody was trained on that. Clause 7.2 competence for a privacy-relevant role is missing.
Contractors outside the assignment
Clause 7.3 covers persons doing work under the organisation’s control, not only employees.
A records sample that leaves out the outsourced support desk handling access requests is a common finding.
No proof the training worked
Clause 7.2 asks you to evaluate whether the actions you took to build competence were effective.
Attendance alone does not show that. Scenario results do, because they show the decision the learner made.
Annex A areas your staff carry
Annex A areas where a trained employee makes the control work.
Requests from PII principals
Controllers must handle access, correction and deletion requests. Staff need to tell a real request from a fraudulent one before they send anyone data.
The GDPR course includes both a legitimate DSAR and a fraudulent DSAR scenario.
Consent and lawful basis
Table A.1 covers how consent is obtained and recorded. Marketing and product teams practise it in the consent exercise.
Records of processing and impact assessments
Knowing what data you hold and where it goes is basic PIMS hygiene.
The data mapping and DPIA exercises walk through building a record and assessing a risky change.
Processors and transfers
Vetting a new processor and checking a cross-border transfer are tasks for procurement, legal and engineering. Each has its own exercise.
Breach recognition and reporting
A privacy breach usually starts as a security event someone notices. The breach response exercise and the Incident Reporting course teach staff to escalate fast and keep the evidence.
Phishing and impersonation
Most stolen personal data leaves through a compromised account. Phishing drills tie A.3.17 awareness to the attacks your staff actually receive.
Further reading
Related glossary terms
References
- Revision of ISO/IEC 27701 DNV
- ISO 27701 Updates: What You Need to Know A-LIGN
- ISO 27701:2025 Annex A structure ISMS.online
- ISO 27701:2025 Clause 7 Support ISMS.online
Give your auditor a training record that reads like a PIMS
Assign the privacy path once and let it come back every year on its own.
Frequently asked questions
What is ISO 27701 security awareness training?
ISO/IEC 27701 sets out a privacy information management system (PIMS). Since the 2025 edition you can certify it without holding ISO 27001, and the auditor will still ask how you know your people can handle personal data correctly.
Does ISO 27701 require awareness training?
Yes. Clause 7.3 requires that people working under your control are aware of the privacy policy, their contribution to the PIMS and the implications of not conforming.
Clause 7.2 adds competence for roles whose work affects privacy, with documented evidence.
Which Annex A control covers training in the 2025 edition?
A.3.17, information security awareness, education and training. It sits in Table A.3, which applies to both PII controllers and PII processors.
Do I still need ISO 27001 to certify ISO 27701?
Not under the 2025 edition. It is a standalone management-system standard.
The 2019 edition was an extension that required an ISO 27001 ISMS.
When must 2019 certificates move to the 2025 edition?
A transition audit is needed. Some certification bodies plan around October 2028, three years after publication, while others were waiting for the IAF to publish the rules.
Ask your certification body for its date.
Are there fines for failing ISO 27701?
No. ISO 27701 is a voluntary standard. The consequence of weak training is an audit nonconformity, and unresolved major nonconformities put the certificate at risk.
Privacy law fines, such as under GDPR, are a separate matter.
How often should ISO 27701 training run?
The standard sets no interval. Annual training is a common baseline that auditors accept, and RansomLeak reassigns the path every 12 months.