Privacy Information Management System Consultants in Dubai, Abu Dhabi & Saudi Arabia
Nathan ISO Consulting implements and certifies ISO/IEC 27701 Privacy Information Management Systems for organisations facing UAE PDPL, Saudi PDPL, DIFC, ADGM and GDPR obligations across the UAE, Saudi Arabia and the wider GCC.
Data protection law arrived in the Gulf quickly and comprehensively. The UAE Federal Personal Data Protection Law, the Saudi Personal Data Protection Law, and the separate regimes operating inside DIFC and ADGM have moved privacy from a compliance afterthought to a board-level obligation with defined penalties. ISO 27701 is the international standard that turns those obligations into an auditable management system rather than a policy document and a hope.
What Is ISO/IEC 27701?
ISO/IEC 27701 is an extension to ISO/IEC 27001 and ISO/IEC 27002 that establishes a Privacy Information Management System. It adds privacy-specific requirements and controls to the information security management structure, covering both the organisation’s role as a controller determining why and how personal data is processed, and as a processor handling data on behalf of others.
One structural point matters commercially: ISO 27701 cannot be certified on its own. It is an extension, so you must hold ISO 27001 certification or be pursuing it in parallel. Any provider offering standalone ISO 27701 certification is describing something that does not exist. In practice this is rarely a problem, since organisations serious about privacy generally need the underlying security controls anyway, and implementing both together is more efficient than sequencing them.
| Component | What it adds |
|---|---|
| PIMS-specific management requirements | Extensions to ISO 27001 Clauses 4 to 10 addressing privacy context, roles, risk assessment and objectives |
| PIMS-specific guidance for ISO 27002 controls | Privacy interpretation of the information security controls already implemented under ISO 27001 |
| Controller-specific controls (Annex A) | Lawful basis, consent, purpose limitation, data subject rights, privacy by design, records of processing, transfers |
| Processor-specific controls (Annex B) | Acting on controller instructions, sub-processor management, assisting controllers with data subject requests, breach notification to controllers |
| Mapping annexes | Correspondence to GDPR articles and other privacy frameworks, supporting regulatory evidence |
| Records of processing | Documented inventory of processing activities, purposes, categories, recipients and retention |
Determining your role for each processing activity is the first substantive piece of work, and organisations routinely get it wrong. A SaaS provider is usually a processor for customer data and a controller for its own employee and marketing data. A recruitment agency may be a controller for candidate records and a processor for client-supplied data. The applicable Annex A or Annex B controls, and the contractual obligations flowing from them, differ accordingly.
Getting this wrong early is expensive, because processing records, contractual clauses, data subject request handling and breach notification obligations all depend on the role determination being correct.
Why ISO 27701 Certification Matters in the UAE and GCC
The UAE PDPL establishes obligations around lawful processing, data subject rights, cross-border transfer, breach notification and appointment of data protection officers in defined circumstances. It does not name ISO 27701, but it requires appropriate technical and organisational measures — and a certified PIMS is the most widely recognised way to evidence that those measures exist, operate and are independently assessed.
The Saudi PDPL, administered under the Saudi Data and Artificial Intelligence Authority framework, imposes comparable obligations with its own registration, transfer and breach requirements. Organisations operating across both markets need a system handling each jurisdiction’s specifics rather than a single generic privacy policy.
Both financial free zones operate their own data protection laws, closely modelled on GDPR, with their own commissioners, registration requirements and enforcement powers. Entities licensed in DIFC or ADGM face these obligations independently of the federal PDPL, and the distinction catches out organisations assuming one framework covers everything.
Gulf organisations serving European clients, processing EU resident data, or acting as processors for GDPR-regulated controllers face extraterritorial obligations. ISO 27701 includes mapping to GDPR articles, which materially shortens the evidence burden when a European client sends a data protection assessment.
Enterprise clients now include data protection assessments in supplier onboarding as a matter of course. For processors — SaaS providers, BPO operations, managed service providers, marketing agencies — a certified PIMS answers most of that assessment and frequently determines whether a contract proceeds.
Nathan ISO Consulting’s ISO 27701 Services
Controller and processor roles established per processing activity, with scope defined against the entities, systems and jurisdictions the PIMS covers.
What personal data you hold, where it originates, why it is processed, what lawful basis applies, who it is shared with, where it is stored and transferred, and how long it is retained. This is the foundation document for everything else, and the one regulators ask for first.
Privacy risk assessment methodology, plus data protection impact assessment procedures and templates for high-risk processing — new systems, profiling, large-scale sensitive data handling and monitoring activities.
Establishing and documenting lawful basis for each processing purpose, with consent capture, withdrawal and record-keeping mechanisms where consent is the chosen basis.
Request handling for access, correction, deletion, objection, restriction and portability, with identity verification, response timelines and evidence trails that survive regulatory scrutiny.
Transfer mechanisms appropriate to each jurisdiction — adequacy positions, contractual safeguards and consent-based transfers — which is one of the more complex areas for GCC organisations with international group structures and cloud hosting outside the region.
Contractual clauses, due diligence, sub-processor authorisation and flow-down obligations, plus the controller assistance commitments a processor must be able to honour.
Procedures for identifying a personal data breach, assessing risk to data subjects, and notifying the relevant authority and affected individuals within jurisdictional timeframes — which differ between UAE, Saudi, DIFC, ADGM and GDPR regimes.
Data protection officer role definition where required, privacy awareness across the organisation, and deeper training for roles handling personal data routinely — HR, marketing, customer service and technology.
Where ISO 27001 is not already held, we implement both together as one system and coordinate a combined certification audit, which is materially more efficient than sequencing them.
Our ISO 27701 Certification Process
Consultation and fixed proposal. Discussion of your processing activities, jurisdictions, ISO 27001 status and client requirements, followed by a fixed written quotation.
ISO 27001 position assessment. Confirming whether you hold certification or need it implemented in parallel.
Role determination. Controller and processor roles established per processing activity.
Data mapping and records of processing. Full processing inventory built with business function owners.
Privacy risk assessment. Risks to data subjects assessed and treatment planned.
Gap analysis against Annex A and B controls. Applicable controls determined and current position assessed.
Policy and procedure development. Privacy policy, notices, rights procedures, transfer framework, retention schedule and breach response.
Contractual framework. Processing agreements, sub-processor terms and controller assistance commitments.
Training rollout. Organisation-wide privacy awareness plus role-based training and internal auditor qualification.
Internal audit and management review. Full PIMS audit with genuine findings, then a properly minuted review.
Stage 1 and Stage 2 audits. Combined with ISO 27001 where applicable, with our consultant present throughout.
Certification and surveillance support. Nonconformity closure, certificate issue and ongoing support across the three-year cycle.
Why Choose Nathan ISO Consulting
Multi-jurisdiction privacy expertise. UAE PDPL, Saudi PDPL, DIFC, ADGM and GDPR each carry different obligations. We build one system handling all applicable regimes rather than a generic privacy policy that satisfies none of them properly.
Role determination done correctly at the outset. Controller versus processor drives everything downstream. Getting it wrong is expensive to unwind.
Data mapping conducted with business owners. Not a questionnaire. Shadow processing — data collected by marketing, HR or operations that IT has never seen — surfaces during interviews, not templates.
Transfer mechanisms addressed properly. Cloud hosting outside the region and international group structures make transfers one of the most consequential areas for GCC organisations, and one of the most commonly under-documented.
Honest about the ISO 27001 dependency. ISO 27701 cannot be certified alone. Where you do not hold ISO 27001, we implement both together rather than selling a certification that cannot be issued.
Practical rights request procedures. Designed to be executed within regulatory timeframes by staff who handle them occasionally, not by privacy specialists.
One dedicated lead consultant throughout. Continuity from data mapping through surveillance audits.
Combined audit coordination. ISO 27001 and 27701 assessed together, reducing audit days and disruption.
Fixed written pricing. Agreed upfront with audit attendance included.
Independent of certification bodies. Certification is issued independently under ISO/IEC 17021.
Industries We Serve
Technology and SaaS providers. Processor obligations, sub-processor chains, data residency and customer data protection assessments.
Healthcare providers and insurers. Patient data as sensitive personal data, with DHA, DoH, MOH and ADHICS requirements alongside privacy law.
Banking, fintech and insurance. Customer data, profiling and automated decision-making, alongside DIFC, ADGM and SAMA obligations.
HR, recruitment and outsourcing. Candidate and employee data across controller and processor roles simultaneously.
Marketing, media and e-commerce. Consent management, tracking technologies, profiling and direct marketing obligations.
Education. Student and parent data, including data relating to minors which attracts additional protection.
Retail and hospitality. Loyalty programmes, guest data, CCTV and cross-border group data sharing.
Government suppliers and semi-government entities. Citizen and resident data with additional sectoral obligations.
Legal and professional services. Client confidential data alongside privilege and regulatory retention obligations.
Locations We Serve
ISO 27701 consultants across Dubai — Business Bay, Deira, Jebel Ali and Dubai South — with particular activity in Dubai Internet City, Dubai Media City, Dubai Silicon Oasis, Dubai Healthcare City, DMCC, JAFZA, DAFZA and DIFC, where the separate DIFC data protection regime applies.
Abu Dhabi city, Mussafah, ICAD, KEZAD, Masdar City, Abu Dhabi Global Market, Hub71 and Al Ain — including ADGM-licensed entities under the ADGM data protection regulations and healthcare organisations subject to ADHICS alongside privacy obligations.
Sharjah city, Sharjah Publishing City, Hamriyah Free Zone and SAIF Zone; Ajman and Ajman Free Zone; Ras Al Khaimah and RAKEZ; Umm Al Quwain Free Trade Zone; Fujairah and Fujairah Free Zone.
Riyadh, Jeddah, Dammam, Al Khobar, Dhahran, Mecca, Medina and Tabuk — including King Abdullah Economic City and NEOM, and organisations working through Saudi PDPL registration, transfer and breach notification requirements.
Qatar — Doha, Lusail, Qatar Free Zones and the Qatar Financial Centre. Kuwait — Kuwait City and Shuwaikh. Oman — Muscat, Sohar and Knowledge Oasis. Bahrain — Manama, Seef and Bahrain Bay, where the Kingdom operates its own personal data protection law.
What Determines the Cost of ISO 27701 Certification?
Because ISO 27701 is an extension, certification body fees are usually calculated as additional audit days on top of the ISO 27001 assessment rather than as a separate full audit. Where both are implemented together, the combined assessment is materially cheaper than certifying sequentially.
Our consultancy fee is separate and fixed in writing before engagement, driven by the number of processing activities and systems in scope, whether you act as controller, processor or both, the number of jurisdictions whose law applies, the complexity of cross-border transfers and group data sharing, and whether ISO 27001 already exists or must be implemented alongside.
Get Started with ISO 27701 Certification
For ISO/IEC 27701 privacy certification and UAE or Saudi PDPL compliance support in Dubai, Abu Dhabi, Sharjah, Saudi Arabia, Qatar, Kuwait, Oman or Bahrain, call +971 50 258 5024, email info@nathanisoconsulting.com, or visit our contact page for a privacy gap assessment and a fixed written proposal.
Frequently Asked Questions About ISO 27701 Certification
No. ISO 27701 is an extension to ISO 27001 and cannot be certified standalone — you must hold ISO 27001 certification or be obtaining it in parallel. Any provider offering standalone ISO 27701 certification is describing something that cannot be issued by an accredited body.
It provides the management system, controls and evidence that support compliance, and includes mapping to major privacy frameworks. It is not a legal certification of compliance — that determination rests with the regulator and your legal advisers. In practice, a properly implemented PIMS addresses the substantive obligations UAE PDPL imposes and produces the documentation a regulator would expect to see.
A controller determines the purposes and means of processing personal data. A processor processes it on the controller’s behalf and under its instructions. Most organisations are both, depending on the activity — a SaaS provider is typically a processor for customer data and a controller for its own employee data. Different Annex controls and contractual obligations apply to each role.
Entities licensed in DIFC or ADGM fall under those zones’ own data protection regimes, administered by their respective commissioners, rather than the federal PDPL. This catches out organisations assuming one framework covers their whole UAE footprint, particularly groups with entities both onshore and inside a financial free zone.
ISO 27701 includes annexes mapping its controls to GDPR articles, which substantially shortens the evidence burden when a European client or regulator asks how you address specific requirements. It does not replace GDPR compliance obligations, but it provides the management system and documentation through which those obligations are met and demonstrated.
Two to four months as an extension where ISO 27001 is already certified and mature. Where both are implemented together, plan on five to nine months in total. Data mapping is usually the longest single activity, particularly for organisations that have never inventoried their processing.
That depends on the applicable law rather than on ISO 27701. UAE PDPL requires a DPO in defined circumstances relating to the nature and scale of processing, and DIFC, ADGM, Saudi PDPL and GDPR each have their own triggers. The standard requires roles and responsibilities to be assigned; whether that role must be a formally designated DPO is a legal question we address during scoping.
A documented inventory of your processing activities — what data, for what purpose, under what lawful basis, shared with whom, transferred where, retained how long. It is the foundation document for the whole PIMS, and typically the first thing a regulator requests following a complaint or breach. Organisations without it struggle to answer even basic regulatory questions.
Both regimes restrict transfers of personal data outside the jurisdiction unless specific conditions are met — adequacy determinations, appropriate contractual safeguards, or defined exceptions including consent. For GCC organisations using cloud services hosted elsewhere or sharing data within international groups, this is one of the most consequential and commonly under-documented areas.
A structured assessment of privacy risk for processing likely to result in high risk to individuals — large-scale sensitive data processing, systematic monitoring, profiling with significant effects, or new technologies. Applicable laws define the triggers; the PIMS provides the methodology and record. Auditors examine whether DPIAs were conducted where they should have been, not merely whether a template exists.
Timeframes differ by jurisdiction, and this is precisely why a single generic procedure fails. Your breach response process must identify which regime applies to the affected data and act within that regime’s timeline. We build the procedure so the assessment happens quickly enough for the shortest applicable deadline to remain achievable.
Yes. Employee and candidate personal data falls within scope as processing where you act as controller, and HR is frequently the function with the least mature privacy practice in an otherwise well-governed organisation. Recruitment records, performance data, health-related absence information and monitoring of staff all require attention.
No, but it makes transfer documentation and sub-processor management central. You need to evidence the transfer mechanism, the contractual safeguards in place, and appropriate due diligence on the provider. Most major cloud providers offer the contractual instruments required; the gap is usually that organisations have not executed or documented them.
ISO 27018 is a code of practice for protecting personal data in public cloud environments, applicable to cloud service providers acting as processors. ISO 27701 is a full management system extension covering controller and processor obligations broadly across all processing, not only cloud. They are complementary, and cloud providers frequently implement both.
Yes, though scope must be coherent — a PIMS covering only one business unit while other units process the same categories of personal data offers limited assurance to a client or regulator. Because ISO 27701 extends ISO 27001, its scope also needs to sit sensibly within the ISMS scope.
Through a documented procedure covering receipt and logging, identity verification, locating data across all systems including backups and third parties, applying any exemptions, and responding within the statutory timeframe. The practical difficulty is usually locating data rather than the legal analysis, which is why the data mapping work matters so much.
Look for accreditation from a recognised IAF member — EIAC, ENAS, GAC in Saudi Arabia, UKAS or ANAB — with ISO/IEC 27701 in the accreditation scope alongside ISO 27001. We are independent of all certification bodies and advise during scoping.
It requires you to identify and address applicable privacy obligations, which include the enhanced protections most privacy laws apply to data relating to minors — around consent, transparency and profiling. Education providers, healthcare organisations and consumer businesses with young users need this addressed specifically rather than absorbed into general procedures.
Yes, included in our implementation programmes and available standalone. We also deliver DPIA and data subject rights handling workshops, which are typically the operational capabilities that most benefit from being held in-house.
By keeping records of processing current as new systems and activities are introduced, conducting DPIAs for new high-risk processing, reviewing transfer arrangements when providers or group structures change, handling rights requests within timeframes and retaining evidence, delivering refresher training, and holding management review on schedule. A processing inventory that has not been updated despite new systems going live is the most common surveillance finding.
0
Projects
0
Services
0
Clients Serving
0
Countries Serving