Skip to main content

ISO/IEC 27701 Privacy Information ManagementProfessionalI27701-LI

Certified ISO/IEC 27701 Lead Implementer

Demonstrates the competence to implement a privacy information management system based on ISO/IEC 27701:2019, extending an ISMS to protect personally identifiable information.

Exam
2 h
Questions
60
Pass mark
70%
Valid for
3 years

About this certification

Holders can extend an ISO/IEC 27001-based ISMS into a privacy information management system, determining the organisation’s role as PII controller and/or PII processor. They apply the additional PIMS requirements and the controller and processor controls in Annexes A and B, conduct privacy impact assessments and map PIMS controls to data protection obligations such as the UK GDPR.

Who it is for: Data protection officers, privacy managers, information security managers and consultants.

Syllabus

What you'll be assessed on — 5 modules. The percentage is each module's share of the exam.
  1. 01Privacy Principles and PIMS Concepts15% of the exam
    • Explain privacy principles and the concept of personally identifiable information
    • Distinguish between PII controllers and PII processors
  2. 02Extending the ISMS to a PIMS20% of the exam
    • Apply the PIMS-specific requirements that extend ISO/IEC 27001 clauses
    • Analyse privacy-specific context, interested parties and scope
  3. 03Privacy Risk and Impact Assessment20% of the exam
    • Apply privacy risk assessment alongside information security risk assessment
    • Design a privacy impact assessment process
  4. 04Controller and Processor Controls25% of the exam
    • Apply Annex A controls for PII controllers including lawful basis, consent and data subject rights
    • Apply Annex B controls for PII processors including sub-processor management
    • Analyse mappings between PIMS controls and data protection legislation
  5. 05Operating and Improving the PIMS20% of the exam
    • Design records of processing, breach notification and retention arrangements
    • Apply monitoring, internal audit and management review to the PIMS

Competencies assessed

  • PIMS Design — Extends an ISMS to address privacy requirements.
  • Role Determination — Determines controller and processor obligations correctly.
  • Privacy Risk — Conducts privacy risk and impact assessments.
  • Privacy Controls — Implements controller and processor controls.
  • Regulatory Alignment — Maps PIMS controls to data protection obligations.

Exam blueprint

Closed-book, timed examination with single-choice, multiple-response and scenario-based questions.
Questions per module60 questions · 2 h · pass 70%
  • Privacy Principles and PIMS Concepts9
  • Extending the ISMS to a PIMS12
  • Privacy Risk and Impact Assessment12
  • Controller and Processor Controls15
  • Operating and Improving the PIMS12
Question types
Scenario-based 20% · Single choice 60% · Multiple response 20%
Delivery
Online (remote proctored), Test centre, On-site (corporate)
Retakes
Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

Your path to certification

  1. 1

    Register

    Create a free account and start the programme.

  2. 2

    Practice

    Online practice test, 8 questions.

  3. 3

    Training

    Optional

    Online course or classroom — or skip it.

  4. 4

    Certification

    Independent exam and certification decision.

  • Practice test8 questions · 20 min · 70% to pass · free with the programme
  • ISO/IEC 27701 Lead Implementer — online course28 h self-paced€699

Training is optional and does not by itself confer certification. Find a training partner

Eligibility & prerequisites

Required

  • Minimum 3 years' professional experience in privacy, data protection or information security
  • Experience contributing to management system implementation activities
  • Agreement to abide by the AQSCERT Code of Professional Conduct

Recommended

  • I27K-LI or equivalent ISMS implementation knowledge
  • Understanding of data protection principles

More information

Certification process
  1. 1. Application — Create an account and apply for this certification.
  2. 2. Eligibility review — AQSCERT checks the formal eligibility requirements.
  3. 3. Assessment — Sit the 2 h examination online or at a test centre.
  4. 4. Independent decision — A decision maker not involved in your training or assessment reviews all evidence.
  5. 5. Issuance — A digitally signed certificate with QR verification, valid for 3 years.
  6. 6. Recertification — Before expiry, evidence 60 hours of CPD or re-sit the examination.
  7. Certificates may be suspended, withdrawn or revoked in line with the Certification Scheme. Status is always shown on the public verification page.
Scheme & accreditation
Certification scheme
Information & Technology Certification Scheme
Scheme code
AQS-SCH-25
Scheme version
v1.0 (effective 1 Jan 2026)

Accreditation: AQSCERT is accredited by DA, an IAF MLA signatory, to ISO/IEC 17024. Our programmes are developed by leading experts from industry.

Ready to start I27701-LI?

Practise online, add optional training, then sit the independent exam.

Certified ISO/IEC 27701 Lead Implementer (I27701-LI) · AQSCERT