Direct answer: choosing an ISO 27701 consultant comes down to two things: whether they can map ISO 27701 to the regulations you actually have to follow (the GDPR and Taiwan's Personal Data Protection Act), and whether they can correctly determine, for each processing scenario, whether you are a data controller or a processor. An ISO 27701 certificate is a management-system certification, not a certification mechanism under Article 42 of the GDPR; a consultant who talks only about certification and not about legal obligations leaves a gap when you enter the EU market.
Eight criteria
| Criterion | A question you can put to any consultant |
|---|---|
| Choice of route | Should I implement it on its own or integrate it with ISO 27001? |
| Regulatory mapping | Which GDPR and Taiwan PDPA obligations fall outside ISO 27701? |
| Role determination | In each processing scenario, am I a controller or a processor? |
| Personal data inventory | Which systems and outsourced vendors must the inventory cover? |
| Technical controls | How far must encryption, access control and breach detection go? |
| Who leads | Who actually runs the engagement? What are their qualifications? |
| Named cases and reference customers | Can you provide named cases or reference contacts in my industry and at my scale? |
| Clarity of the quote | Which deliverables are included? Which are not? How are extras charged? |
How Winners addresses these criteria
What follows is Winners' own account. Use the questions above to test us in exactly the same way you test any other consultant.
- Choice of route: decided from your existing systems; the integrated route reuses risk management, internal audit and management review
- Regulatory mapping: records of processing activities, data protection impact assessments, cross-border transfers and breach notification are mapped item by item
- Role determination: determined scenario by scenario, with controls selected according to the role
- Personal data inventory: data categories, flows and purposes are inventoried, including outsourced vendors
- Technical controls: legal, process and technical expertise are planned together
- Who leads: VP- and director-level consultants guide the whole engagement and nothing is outsourced; consultants hold ISO 27001/27701 lead-auditor credentials
When you may not need a consultant
If you only need the ISO 27701 certificate, do not process EU personal data, and already run ISO 27001 well, your internal team plus a certification body may be enough.
Related questions
- How do I estimate an ISO 27701 budget? ISO 27701 budget
- How long does ISO 27701 implementation take? ISO 27701 timeline
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.