Direct answer: the 2025 edition changes where the budget starts. ISO 27701:2025 is now a stand-alone management-system standard that can be implemented and certified on its own, no longer requiring ISO 27001 as a prerequisite; companies that already hold ISO 27001 can integrate it and reuse what they have. Decide which route you are taking first, then budget.
Two routes with different cost structures
| Route | When it applies | Budget focus |
|---|---|---|
| Stand-alone implementation | No ISO 27001 yet; the main need is personal-data protection | The management-system structure (scope, risk, audit, management review) must be built from scratch |
| Integration with ISO 27001 | ISO 27001 certification already held | Reuse the existing system and audits; focus on privacy-specific controls and role definition |
Five factors determine the cost
- Role: PII controllers and PII processors have different controls; holding both roles means more work.
- Scope: the business units, systems, sites and categories of personal data included.
- Regulatory mapping: the more regulations to map (Taiwan's Personal Data Protection Act, the GDPR and so on), the more mapping and documentation work.
- Consulting: personal-data inventory, role definition, control design, internal audit and a rehearsal before certification, quoted by scope and route (stand-alone or integrated).
- Certification: quoted by the certification body according to scope; an external cost.
For the EU market, ISO 27701 is not GDPR compliance
An ISO 27701 certificate is issued by a certification body and is a management-system certification; it is not a certification mechanism under Article 42 of the GDPR. GDPR certification must be approved by a data protection authority or the European Data Protection Board (EDPB), and the EDPB register lists the approved mechanisms, such as the Europrivacy European data protection seal. So a company that processes EU personal data needs, beyond the ISO 27701 management system, to implement the GDPR obligations item by item: records of processing activities, data protection impact assessments, cross-border transfer mechanisms, 72-hour breach notification and so on. Winners handles the mapping among ISO 27701, the GDPR and Taiwan's Personal Data Protection Act at the same time, so one system answers the requirements of several markets.
Personal data meets AI: plan ISO 27701, ISO 42001, the GDPR and the AI Act together
When personal data is used to train or operate an AI system, the GDPR's lawful basis, data protection impact assessment and data-subject rights still apply; if it is a high-risk AI system under the AI Act, the data-governance requirements of Article 10 must also be met. ISO 27701 governs personal data and ISO 42001 governs AI; both use the common structure of ISO management-system standards and can be integrated into one system: a single inventory covers personal data and AI systems, and a single internal audit and management review covers both standards. ISO 42001 and AI Act budget and timeline
Winners' view
What companies that already hold ISO 27001 most often overspend on is "building a second system". Although the 2025 edition is stand-alone, the integrated route reuses risk management, internal audit and management review; the budget should go first to the personal-data inventory and to defining controller and processor roles, because if those two are wrong, every later control is aimed at the wrong target.
How the three disciplines divide the work: legal compliance maps the applicable regulations such as the GDPR and Taiwan's Personal Data Protection Act and defines controllers and processors; process builds the privacy information management system, records of processing activities and data-subject request procedures; technology implements encryption, access control, data minimisation and breach detection. Integrated, one system answers the certification auditor, the regulator and customers at the same time.
How to budget the consulting fee
Companies with ISO 27001 taking the integrated route have consulting work concentrated on privacy-specific controls and role definition, so the scope is smaller; a stand-alone implementation from zero needs the full management-system structure built. Run a mechanism diagnosis first to confirm the route, then obtain a quote by scope.
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.