ISO 27701 Lead Implementer Course enables professionals to plan, implement and maintain a Privacy Information Management System (PIMS) aligned with ISO/IEC 27701. The training focuses on integrating privacy into management systems, ensuring coherence with the GDPR and producing evidence for assessment and certification.
Quick Access: Introduction· Why this course exists· What this course enables· Frameworks and standards· Value· Objectives· Target audience· Prerequisites· Programme· Exam & Certification· Other information· Benefits· Logistics· Registration
Upcoming dates
Confirmed dates.
Synchronous, live training. Interaction with the trainer and the group.
Live Online • next edition
Live Online • base price
Language: available in Portuguese or English
Training: practical and case-study based
Exam: 3h
EXCELLENCE AND LEADERSHIP LEVEL — technical authority and leadership in governance.
Why this course exists
To transform ISO/IEC 27701 and GDPR requirements into real, evidence-based and auditable implementation.
Many organisations recognise the criticality of privacy and data protection, but struggle to move from intention to governance, processes, controls, evidence and continual improvement. This course prepares professionals to lead the implementation of a PIMS with method, consistency and the ability to progress towards ISO/IEC 27701 certification audits and GDPR compliance audits.
What this course enables you to do
Plan
Define the PIMS implementation approach and methodology, including drivers, context, interested parties and scope, and ISO/IEC 27701–GDPR mapping.
Implement
Build privacy policies, processes, procedures and controls, integrating ISO/IEC 27001/27002 with ISO/IEC 27701 extensions and GDPR requirements.
Evaluate
Establish monitoring, indicators, internal audits and management reviews to ensure PIMS performance, compliance and maturity.
Improve
Manage findings, nonconformities and corrective actions, strengthening continual improvement and preparing the organisation for ISO/IEC 27701 certification audits and GDPR audits.
Frameworks, standards and best practices addressed throughout the course
GDPR (Reg. EU 2016/679)
Integration with ISO/IEC 27001 & ISO/IEC 27002
PIMS context & scope
Governance, roles & responsibilities
Risks & opportunities (privacy and IS)
Documented information & evidence
Control implementation (27002 + 27701 extensions)
Communication, training & awareness
Monitoring, internal audit & management review
Continual improvement & audit readiness
EDPB / ENISA / NIST (correlated references)
BEHAVIOUR methodology (step-by-step)
Value for the organisation
- Consistent and auditable implementation of a PIMS, aligned with ISO/IEC 27701 and prepared for certification.
- Strengthened ability to demonstrate GDPR compliance through governance, controls and sustained evidence.
- Efficient integration with the ISMS (ISO/IEC 27001), reducing duplication and increasing consistency across processes and documentation.
- Accelerated execution through practice, case study and templates that reduce rework and improve deliverable quality.
Introduction
The ISO 27701 Lead Implementer course was designed to transform the standard into practice. Supported by a case study adapted to a real-world context, the course challenges participants to establish and maintain a Privacy Information Management System (PIMS), based on the requirements of ISO/IEC 27701, the GDPR, correlated standards and a customised BEHAVIOUR methodology, developed by specialists in information security and privacy.
In addition to mastering concepts, principles and requirements, participants learn how to put a Privacy Management Programme into practice, including: defining context and scope, governance structures, assessment and treatment of risks and opportunities, objectives and plans, documented information, implementation of controls (based on ISO/IEC 27002 and ISO/IEC 27701 extensions), transition to operation, performance evaluation, internal audits, management reviews and continual improvement.
The ISO 27701 Lead Implementer course also covers the most relevant requirements and guidance to support GDPR compliance, including the framework of EDPB guidelines and correlated best practices (e.g., ENISA and NIST), enabling a clear connection between requirements, regulation and execution.
This Training Plan and all associated documents are protected by Copyright and registered as a literary work with IGAC.
General Objectives
At the end of this course, participants will be able to:
- Understand the fundamental concepts of privacy, data protection and information security.
- Know and understand the requirements of the GDPR and ISO/IEC 27701 and the correlation between GDPR, ISO/IEC 27701, ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 29100 and other privacy management standards and frameworks.
- Understand the requirements for implementing a PIMS based on ISO/IEC 27701, supported by an ISMS (ISO/IEC 27001) and oriented towards GDPR compliance.
- Establish, implement, maintain and improve a Privacy Information Management System (PIMS), in accordance with ISO/IEC 27701 and in compliance with the GDPR and relevant EDPB guidance.
- Advise an organisation on data protection and privacy best practices that support business objectives.
- Acquire the skills to lead the organisation in achieving ISO/IEC 27701 and ISO/IEC 27001 certifications and sustaining continual GDPR compliance.
- Possess the knowledge required to successfully take the BEHAVIOUR Certified Data Protection 27701 Lead Implementer certification exam and obtain a personal certification.
Target Audience
- Information security, privacy and data protection professionals, including consultants and IT specialists.
- IT teams involved in GDPR and/or ISO/IEC 27701 implementation.
- Project managers responsible for ISO/IEC 27701 implementation programmes.
- Consultants and auditors supporting ISO/IEC 27701 compliance and legal/regulatory requirements in the EU and outside the EU.
- DPOs and professionals with formal data protection responsibilities.
- Any professional wishing to implement a PIMS aligned with ISO/IEC 27701 and the GDPR.
Prerequisites
There are no mandatory formal prerequisites. However, experience or exposure to privacy and data protection, information security, compliance, governance and risk management contexts is recommended, as well as familiarity with the structure of ISO standards.
Other specific requirements may also apply, where relevant, depending on the quotation or proposal presented.
Programme
Fundamentals and preparation (P – Plan)
- Introduction to the course
- Introduction to the GDPR; privacy and data protection concepts and principles
- Privacy and data protection structures; PIMS based on ISO/IEC 27701 and the GDPR
- Requirements mapping: ISO/IEC 27001, ISO/IEC 27701 and GDPR
- Preparation for PIMS implementation — approach and methodology
- Understanding the organisation’s drivers and establishing the data protection context
Establish (Plan) the PIMS
- Definition of the PIMS scope
- Assessment of the current state and desired state; preparation of a gap analysis
- Leadership and commitment; establishment of the PIMS programme
- Preparation of the Data Protection / Privacy Policy
- PIMS organisational structures: roles, responsibilities and authorities
- Assessment and treatment of risks and opportunities (privacy and information security)
- Data protection objectives and planning
Implement and Operate (Do)
- Resource planning and management
- Competence, training and awareness
- Internal and external communication for data protection
- Management of documented information; documentation required for ISO/IEC 27701 and the GDPR
- Selecting and creating the necessary documents and templates
- Designing and implementing controls based on ISO/IEC 27002 and ISO/IEC 27701 guidelines
- Transitioning the PIMS into operation
Monitor, Review, Improve (Check/Act) & Certification
- Monitoring, measurement, analysis and evaluation
- Internal audit programme
- Management review
- Management of findings, including nonconformities, and application of corrective actions
- Continual improvement process
- Progressing towards ISO/IEC 27701 certification audits and GDPR compliance audits
- Personal certification and course closing
Exam(s) and Certification
Exam “BEHAVIOUR Certified Data Protection 27701 Lead Implementer”
The exam covers the following competence domains:
- Domain 1: Privacy and data protection concepts and principles
- Domain 2: EU GDPR, ISO/IEC 27701 and related frameworks
- Domain 3: Establish (Plan) a PIMS based on ISO/IEC 27701 and the GDPR
- Domain 4: Implement and Operate (Do) a PIMS based on ISO/IEC 27701 and the GDPR
- Domain 5: Monitor and Review (Check) a PIMS based on ISO/IEC 27701 and the GDPR
- Domain 6: Maintain and Improve (Act) a PIMS based on ISO/IEC 27701 and the GDPR
- Domain 7: Progress towards ISO/IEC 27701 Certification Audit and GDPR compliance audits
Language(s): Portuguese and English (consult BEHAVIOUR for availability in other languages).
Duration: 3 hours (180 minutes).
Format: 12 open questions based on a case study.
Pass mark: 700/1000 points.
Results: Pass or Fail.
Issuing entity: Behaviour (legal entity), through its certification service Behaviour Certification Services.
Retake: 1 free retake within a maximum period of 2 months after the exam result release date.
Certification (levels and requirements)
After successfully completing the exam and accepting or signing the applicable agreement and Code of Ethics, the candidate may apply for one of three levels, according to experience:
- Certified Data Protection 27701 Associate Implementer: no previous experience required
- Certified Data Protection 27701 Implementer: 2 years of experience in privacy and/or data protection in the related competence domains
- Certified Data Protection 27701 Lead Implementer: 5 years of experience in privacy and/or data protection in the related competence domains
A Certificate and a Digital Certification Badge will be issued to participants who successfully complete the certification exam and satisfy all requirements of the certification for which they are applying. The certification is issued by Behaviour (legal entity), through its certification service Behaviour Certification Services.
The personal certification programme “Certified Data Protection 27701 Lead Implementer” is designed and maintained in accordance with ISO/IEC 17024.
Certification programmes are valid only for individuals, not companies, and the award and maintenance of certification depend on the exam result, professional experience and compliance with the applicable agreement and Code of Ethics.
If the professional does not comply with the agreement or the Code of Ethics, the certification is not granted or is revoked.
Other Information
General Information
- Training available in Portuguese or English.
- Online training materials, with online access, in accordance with the awarded conditions.
- Practical step-by-step implementation methodology.
- Behaviour digital Training Attendance Certificate with 40 CPD/CPE credits.
- Online Certification Exam, in Portuguese or English. The exam may be taken up to 2 months from the course start date.
- If the candidate does not pass the exam, they are entitled to one free retake within a maximum period of 2 months from the release date of the initial exam result.
- Digital Certification Diploma and Digital Certification Badge after passing the exam and completing the application process. This process has no associated cost.
Trainer(s)
Benefits
View benefits
- ISO/IEC 27701 defines requirements for an auditable and certifiable Privacy Information Management System (PIMS), recognised internationally.
- Strengthens the ability to demonstrate GDPR compliance and manage privacy in a sustained way, with governance, controls and evidence.
- The ISO/IEC 27701 Lead Implementer course is based on the BEHAVIOUR pedagogical model, with a personal certification programme designed in accordance with ISO/IEC 17024.
- Training focused on acquiring practical skills to plan, establish, implement, operate, maintain and improve a PIMS in accordance with ISO/IEC 27701.
- Enables privacy integration with an ISMS (ISO/IEC 27001), using ISO/IEC 27002 controls and ISO/IEC 27701 extensions.
- Enables consolidation of evidence for internal/external audits, management reviews and continual improvement.
- Accelerated execution through templates, practical exercises and case study, reducing rework and non-compliance risk.
- The certification exam is supervised by an official BEHAVIOUR administrator.
- The exam is taken after the course and consists of open/development questions, based on a case study.
- After passing the exam and applying for certification, the professional achieves the applicable certification level. If they do not pass, the candidate is entitled to one free retake, within the period defined in the applicable certification scheme.
Logistics
Useful information
- Live Online (synchronous time): 09h30–13h00 and 14h00–17h30 (Lisbon time), with short breaks
- Classroom (synchronous time): 09h30–13h00 and 14h00–17h30 (Lisbon time), with short breaks
- 28 hours of synchronous training, distributed across 4 consecutive days
- Estimated 12 hours of guided autonomous work, intended for content consolidation and exam preparation, carried out flexibly outside the synchronous sessions
- Requirements: computer with stable internet, updated browser, PDF reader and audio/video
Hotels in Lisbon
Frequently Asked Questions
Objective answers to the most common questions about the ISO 27701 Lead Implementer Course (coming soon).
For general questions about registration, delivery modes, exams, certification and recertification, please consult the BEHAVIOUR® FAQs.
Registration
Complete the form to request your registration for the preferred edition. Check the upcoming dates.
Request more information
If you would like help to frame the course within your professional or organisational context, contact us and we will indicate the most suitable path.
Request Information
Companies: request a proposal
For team registrations, we provide volume conditions and a proposal tailored to the organisational need.
Request Proposal
This course may be attended by individual professionals. It may also be integrated into capability-building paths for teams responsible for the structured implementation of a PIMS, integrating GDPR, ISO/IEC 27701 requirements and evidence.