Short answer: ISO/IEC 27701 privacy certification with us costs $12,600 to $25,200 for the full three-year cycle for organisations of 10 to 50 people, excluding GST, at one site and typical complexity. The price depends mostly on your role with personal information: a processor pays the least, a controller more, and an organisation that is both pays the most. Audit time follows ISO/IEC 27706.
ISO 27701 certification prices by role and size
One site, typical complexity. A controller decides why and how personal information is used, such as its own customers' or staff details. A processor handles personal information for another organisation, following its instructions, such as a payroll or cloud provider.
| People in scope | Processor | Controller | Both |
|---|---|---|---|
| 10 | $12,600 | $13,800 | $21,000 |
| 50 | $15,000 | $19,200 | $25,200 |
| 100 | $16,800 | $22,200 | $30,600 |
Year one, the certification audit and certificate, is $4,700 for a 10-person processor and $5,300 for a 10-person controller.
What is included?
Every figure on this page is the full three-year certification cycle, in Australian dollars, excluding GST. It covers:
- the stage 1 and stage 2 certification audit;
- the certification decision and certificate;
- a surveillance audit in year two and in year three, with the annual certification fee;
- the recertification audit before the certificate expires.
There is no application fee. Travel is charged at cost and shown in the quote. Prices are as at October 2026.
What drives the price of ISO 27701 certification?
- Your role. ISO/IEC 27706 has separate audit-time columns for controllers, processors and organisations that are both. For 1 to 10 people the starting point is 3.5 auditor days for a processor, 4 for a controller and 6.5 for both.
- People handling personal information. Time scales with the people who handle personal information or have access to it. People doing identical work with restricted or read-only access can count for less.
- Privacy risk. Sensitive or special-category information, transfers across jurisdictions, profiling and large volumes of records add time. Low-risk processing reduces it, though never by more than 30 per cent.
- ISO 27001 alongside. Auditing ISO/IEC 27701 with ISO/IEC 27001 as one integrated system reduces the combined time.
How much does ISO 27701 cost with ISO 27001?
For 30 people, a controller with one integrated system pays $35,100 for both certifications over three years, against $41,700 when the two systems are run separately. The 2025 edition of ISO/IEC 27701 can also be certified on its own, without ISO 27001. See ISO 27701 vs ISO 27001.
What is not in the certification price?
Your own costs sit outside the certification fee: staff time to run the management system, any tools you choose, and any outside help you buy to build the system. As a certification body, we audit and certify. We do not design, implement or maintain management systems, and we do not recommend consultants, because that would compromise the independence of the audit.
How do I get a fixed price?
Use the price calculator for an estimate in under a minute, with no call and no email needed. Then send us your scope, sites and headcount. We confirm one fixed price for the full three-year cycle in writing, and it changes only if your scope changes or a major nonconformity needs a return visit to verify. See our commitments.
Common questions
Do we need ISO 27001 before ISO 27701?
No. ISO/IEC 27701:2025 is a stand-alone management system standard and can be certified on its own. Many organisations still certify both together, because the systems share structure and an integrated audit costs less than two separate ones.
Are we a controller or a processor?
If you decide why and how personal information is used, you are a controller. If you handle it for another organisation on its instructions, you are a processor. Many organisations are both, for example a payroll provider is a controller for its own staff and a processor for its clients.
Does ISO 27701 certification prove Privacy Act compliance?
No. Certification shows that your privacy management system meets the standard and works in practice. Whether you comply with the Privacy Act 1988 is a separate legal question.
How much is the ISO 27701 surveillance audit?
With us, $2,200 to $2,800 a year for 10 to 50 people at typical complexity, including the annual certification fee.
Can we estimate our ISO 27701 price online?
Yes. The price calculator asks one extra question for ISO/IEC 27701, your role with personal information, and shows the full three-year cost straight away.
Related information:
- ISO/IEC 27701 certification
- ISO 27701 vs ISO 27001
- ISO 27001 certification cost in Australia
- ISO 9001 certification cost in Australia
- ISO 42001 certification cost in Australia
- ISO certification price calculator
- Our commitments
- Start an enquiry
Sources
Prices are estimates for the scope described, in Australian dollars excluding GST, as at October 2026. Your fixed price is confirmed in writing after a short scope review, and the signed agreement governs.