Download the certification brochure (Spanish): Click here

Exam Details

• Exam Name: ISO/IEC 27701:2025 Internal Auditor Certified (27701-IAE)
• Exam Format: Multiple choice, online with remote supervision (proctoring)
• Exam Delivery: Safe Exam Browser
• Number of Questions: 50 questions: 70% scenarios / 30% conceptual
• Exam Duration: 90 minutes
• Passing Score: 70% (35 out of 50 correct answers)
• Available Languages: Spanish / English
• Attempts: Maximum 2 attempts (minimum 14 days between attempts)
• Validity: 3 years · 15 CPD credits per year

Main Subjects

• Audit fundamentals and data protection principles (10%): ISO 19011 auditing principles; High-level structure and PDCA cycle; Internal, external and certification audits; Criterion, evidence, finding, nonconformity and observation.
• PIMS audit planning and preparation (20%): Risk-based annual program; Scope, criteria and objectives; Independent and competent audit team; Review of the policy, SoA, PIA/DPIA and risk map; Checklists and audit plan.
• Conducting the audit: clauses 4 to 10 (30%): Context and leadership; Planning: privacy risks and impact; Support and operation, including data service providers; Performance evaluation and improvement; Interviews, sampling, document tracing and difficult situations.
• Evaluating privacy controls: Annexes A and B (20%): Annex A controls: Tables A.1, A.2 and A.3; Consent, data subject rights, minimization, retention and transfers; Sector-specific suitability of the PIMS; Auditing the Statement of Applicability.
• Communication, reporting and follow-up (10%): Writing nonconformities and observations; Final audit report; Closing meeting with management; Effectiveness of corrective actions.
• Integrated auditing and regulatory context (10%): Integration with ISO/IEC 27001, ISO 9001, ISO 22301 and ISO/IEC 42001; GDPR, LGPD, CCPA and national frameworks; Relationship with the NIST Privacy Framework; Regulated sectors: healthcare, finance and telecommunications.

Who is this certification for?

• Management system internal auditors: Who want to extend their competence to personal data protection.
• Compliance officers (DPO, Compliance): Who must verify regulatory compliance of personal data processing.
• Data protection consultants: Who carry out independent diagnostics and assessments of a PIMS.
• Privacy risk leads: Who assess the effectiveness of the controls implemented in the PIMS.
• 27701-IC certified professionals: Who want to complement their implementer profile with audit skills.

Prerequisites

Mandatory: ISO/IEC 27701:2025 Implementer Certified (27701-IC). The internal auditor needs to master the requirements they will audit. Next level: ISO/IEC 27701:2025 Lead Auditor Certified (27701-LA).