ISO/IEC 27701 introduces privacy-specific requirements and controls that change what “good evidence” looks like in audits: lawful basis decisions must be defensible, purposes must remain stable across systems and third parties, and rights handling must work reliably within required timeframes. In practice, audits often drift into document checking (policies, notices, registers) without testing whether the underlying processing reality matches what the organisation claims.

This audit add-on focuses on privacy risk and controls through the lens of the data subject. Participants learn how to evaluate the credibility of privacy risk logic, test lawful basis and purpose limitation across the processing lifecycle, and assess rights handling as an operational capability. The module is designed for internal auditors and third-party auditors (including certification bodies and independent assurance providers) and stays strictly within audit judgement and evidence—without re-teaching generic audit craft or generic risk methods.