Learn how a Privacy Information Management System (PIMS) works under ISO/IEC 27701:2025 and maps to the Australian Privacy Principles and GDPR — flexible Self-Study from $399 + GST, with the official PECB exam voucher and one free resit; instructor-led in Melbourne & Sydney available on request across Australia.
Available Australia-wide, in New Zealand and across Asia Pacific — and, because self-study and eLearning are delivered online through the myPECB platform, from anywhere in the world. Live online classes run in Australian time zones; in-person classroom delivery in Melbourne and Sydney is available on request. Base prices are published in AUD, and every course page supports available local currencies including NZD. An Australian billing address adds 10% GST; a non-Australian billing address has no Australian GST.
The PECB ISO 27701 Foundation training course costs $399 + GST through Aegentra Academy, an official PECB authorised training partner in Australia. That price includes the official PECB examination voucher, the full course materials, 12 months of myPECB access, and one free exam resit within 12 months. The eLearning format is $449 + GST.
Online classes are arranged through the Aegentra Academy team for individual learners and groups.
Contact us for online classLearn · Practise · Implement
Aegentra combines official PECB training with free exam-preparation resources, practical ISO 27701 implementation tools and optional full exam practice through Aegentra Labs.
Learn
Included with courseThis is what the $399 + GST Self-Study price covers, or $449 + GST with PECB eLearning.
Choose your courseImplement
Free · No email requiredGo beyond passing the exam. Practical resources built around the work itself — the documents you will actually have to produce.
Explore free ISO 27701 resourcesISO 27701 Foundation is $399 + GST as self-paced study, or $449 + GST with guided eLearning. There is no separate ISO 27701 exam cost — the official PECB examination voucher is included, and so is a second attempt. PECB puts it plainly in its own course documentation: the fee paid for the training course includes a first exam attempt and one retake within 12 months. You also get 12 months of myPECB access, over 200 pages of course material, and 14 CPD credits.
| Course | What it qualifies you to do | Exam | Self-Study | eLearning |
|---|---|---|---|---|
| Foundation | Understand a PIMS — the controller/processor split, the clause structure and the Annex A tables | 40 questions, 1 hour, closed book | $399 + GST | $449 + GST |
| Lead Implementer | Build the PIMS — scope it, run the privacy risk assessment, write the Statement of Applicability, take it to certification | 80 questions, 3 hours, open book | $849 + GST | $928 + GST |
| Lead Auditor | Audit the PIMS — plan and lead privacy audits against ISO 19011 and ISO/IEC 17021-1 | 80 questions, 3 hours, open book | $849 + GST | $928 + GST |
Two questions are worth asking any ISO 27701 training provider before you compare prices. First, which certification body issues the credential? Aegentra Academy is an official PECB authorised training partner, and PECB is accredited under ISO/IEC 17024 by UKAS, IAS and COFRAC — some providers sell privacy training against an unnamed scheme. Second, is the exam included? A course fee with the examination billed separately is not the figure you end up paying.
No — and this is the single most out-of-date fact circulating about the standard. ISO/IEC 27701 was first published in 2019 as a privacy extension that could only be implemented on top of an ISO 27001 ISMS. The standard was revised in October 2025, and ISO/IEC 27701:2025 is a stand-alone privacy information management system standard. PECB states it directly: the 2025 edition introduces a stand-alone PIMS, no longer requiring ISO/IEC 27001-based security management.
If a course page or a consultant tells you ISO 27701 requires ISO 27001 first, they are describing the superseded 2019 edition. You can still integrate the two — most organisations with an existing ISMS do, because it avoids duplicating clauses 4 to 10 — but integration is now a choice rather than a prerequisite.
The annex structure changed with it. Annex A is now a single normative annex of 78 controls across three tables: Table A.1 for PII controllers (31), Table A.2 for PII processors (18), and Table A.3 shared security controls (29). Annex B is now implementation guidance — the “how” matching Annex A’s “what” — not the processor control set it was in 2019.
40 multiple-choice questions across 2 competency domains, closed book, 1 hour, 70% to pass. The two domains are the fundamental principles and concepts of a privacy information management system, and the PIMS itself. There are no prerequisites — no prior certification, no experience requirement, and no need to hold ISO 27001 Foundation first.
Foundation is the only ISO 27701 level sat closed book. Lead Implementer and Lead Auditor are both open book with 80 questions over three hours. That difference should shape how you study: at Foundation you are being tested on recall of the vocabulary — PII principal, PII controller, PII processor — so it needs to be genuinely memorised rather than looked up.
ISO 27701 does not replace the Privacy Act 1988 — it gives you a management system that makes compliance demonstrable rather than asserted. The Act’s 13 Australian Privacy Principles sit in Schedule 1, and a PIMS produces the evidence for them: APP 1 maps onto the privacy policy and Clause 5 leadership, APP 8 onto cross-border transfer controls, and APP 11 — security of personal information — onto the Table A.3 shared security controls and the retention and disposal process.
That mapping is why Australian privacy roles ask for ISO 27701 rather than the Act itself: the regulator tells you what to achieve, and the standard gives you a repeatable way to show you achieved it. We publish the full APP mapping below, free.
Foundation teaches the vocabulary and the clause structure. Seeing both applied to a real Australian organisation is the fastest way to make them stick, so we publish the working documents in full — no email required.
Foundation certifies you, not your organisation. Certifying a company to ISO/IEC 27701 is a separate project — the ISO 27701 certification guide for Australia covers what that costs and how long it takes.
The official PECB course and exam package starts at $399 + GST — with no separate exam fee after enrolment. Optional Aegentra Labs exam preparation is clearly priced separately.
The exam voucher is included in your enrolment, and so is one free resit if you don't pass first time. Both the exam and the credential are issued directly by PECB.
On passing, you become a "PECB Certificate Holder" in the Foundation credential for that standard. No professional experience required — Foundation is the entry-level PECB qualification.
/ Before you enrol
These answers use this course's current catalogue record and PECB's published exam, certification, and maintenance policies.
The published price is A$399 for Self-Study or A$449 for eLearning, before tax. It includes the official PECB course materials, 12 months of access, the first exam attempt, one free retake, and the certification application fee. PECB’s partner-course policy also includes the first year of the Annual Maintenance Fee where maintenance applies; Foundation and Provisional credentials are maintenance-exempt. There is no separate first-exam or certification-application charge after enrolment.
No ongoing PECB maintenance fee or CPD submission is required for a Foundation credential. PECB’s current maintenance policy lists Foundation, Provisional, and Transition credentials as maintenance-exempt.
Yes. Every Academy course supports AUD and multiple local currencies, including NZD, USD, SGD, GBP, EUR, INR, AED, MYR, PHP, IDR, and VND when a live quote is available. Currency and tax are separate: an Australian billing address adds 10% GST, while a non-Australian billing address has no Australian GST. For example, an Australian working in New Zealand may pay in NZD and use an Australian billing address, but 10% GST will still be added because the billing address is Australian.
Self-Study costs A$399 before tax and uses the official PECB slide-based materials. eLearning costs A$449 before tax — A$50 more — and adds recorded trainer-led lessons and interactive learning activities. Both routes lead to the same PECB exam and credential, and both include the same exam package. Choose eLearning if explanations and video guidance help you learn; choose Self-Study if you are comfortable working through standards-based material independently and want the lowest price.
Yes. PECB publishes remote online exam sessions that candidates can take from home or another suitable location through the PECB Exams application. The published course record lists these exam facts: duration — 1 hour; format — Multiple-choice; assessment — 40 multiple-choice questions worth 100 points in total, across 2 competency domains — the fundamental principles and concepts of the standard, and the management system requirements themselves. Each question has one correct answer and two distractors; pass mark — 70%; language — English (other PECB languages available on request). New Zealand candidates should choose a published session that suits their local time, meet PECB’s identity and technical requirements, and complete the system check before exam day. PECB’s general exam policy does not publish a New Zealand restriction.
On passing, you become a "PECB Certificate Holder" in the Foundation credential for that standard. No professional experience required — Foundation is the entry-level PECB qualification. A Foundation certificate does not require professional experience or project hours. After you pass, PECB processes the applicable certificate requirements.
No project or audit hours are required for the Foundation credential, so there is no project-hour evidence to submit.
Yes. You can hold both the ISO 27701 Lead Implementer and ISO 27701 Lead Auditor credentials. They are separate, complementary certifications: Lead Implementer demonstrates that you can build and operate the management system, while Lead Auditor demonstrates that you can audit and verify it. To earn both, complete each course, pass each exam, and apply for each credential. PECB assesses implementation-project experience for the Implementer tier and audit experience for the Auditor tier separately. If you pass an exam before meeting its full experience requirements, you can receive the applicable Provisional credential and upgrade later when those requirements are met; you do not need to retake that exam. Neither credential automatically grants the other.
5 modules, fully on-demand. Click any module to see the topics inside.
PECB credentials stack — Foundation establishes the language, Lead Implementer builds the system, Lead Auditor verifies it. Pick the level that matches the work you will actually be doing.
Privacy Information Management fundamentals — PII processors, controllers, lifecycle controls.
8–12 hours · self-paced
Build a Privacy Information Management System to ISO/IEC 27701:2025 — standalone or alongside an existing ISMS.
30–40 hours · self-paced
Plan and conduct ISO/IEC 27701 privacy audits — standalone or as part of a combined management-system audit.
30–40 hours · self-paced
PECB ISO 27701 Foundation tells a hiring manager you understand a Privacy Information Management System — the difference between a PII Controller and a PII Processor, the GDPR-aligned Annex A controls across its controller, processor and shared-security tables, the relationship between the PIMS and the underlying ISO 27001 ISMS. It is the lowest-friction way to put a privacy credential on a CV without taking weeks off, and it sets the baseline for any privacy-officer, GRC-analyst, or compliance-coordinator role advertised in Australia.
Privacy Officer, Data Protection Lead, Privacy Analyst, GRC Analyst (privacy), Compliance Manager, and Trust and Safety Analyst roles all list ISO 27701 awareness as a competitive advantage. Australian SaaS companies selling into Europe weight it heavily on hires for privacy programme support. Healthcare providers, CDR data recipients, and government suppliers all treat the Foundation credential as the minimum literacy bar for staff who touch privacy-management evidence.
Foundation is not a substitute for Lead Implementer or Lead Auditor — it is the on-ramp. The Controller / Processor vocabulary, the GDPR cross-walks, and the structure of Annex A — one consolidated annex of 78 controls split across Table A.1 (controller), Table A.2 (processor) and Table A.3 (shared security) — are assumed knowledge in every Aegentra Lead course. Many Foundation alumni progress to Lead Implementer within twelve months, often once they are assigned to a real PIMS readiness project at work.
Foundation stacks cleanly with ISO 27001 (the underlying ISMS), ISO 42001 (AI management — particularly where AI processes personal data), and SOC 2 (US-market privacy criteria). If your organisation operates across multiple compliance regimes, a Foundation credential is the cheapest way to ensure a junior team member can read every privacy controls register without translation.
EU and UK GDPR make privacy assurance the procurement hurdle for Australian SaaS companies selling cross-border, not just information security. Foundation-credentialled staff on the account and solutions-engineering team reduce the volume of privacy escalations to legal and shorten privacy questionnaire turnaround. For companies pursuing the organisational ISO 27701 certificate, Foundation is the minimum literacy for engineers and product managers contributing to the readiness programme.
My Health Records Act compliance, HRIPA NSW reviews, and ADHA assessments routinely lean on ISO 27701 as the framework for the privacy controls overlay. Foundation gives clinical, product, and operations staff the vocabulary to follow privacy-by-design discussions and respond to audit findings without needing a translator from legal.
The Consumer Data Right places explicit privacy-management obligations on accredited data recipients (banks, energy retailers, non-bank lenders). APRA-regulated entities under CPS 234 face an information-security obligation that necessarily includes personal-data systems. Foundation is the minimum bar for staff in the operational privacy and consumer-data teams.
Federal and state agencies bound by the Privacy Act and state-equivalent privacy laws (e.g. NSW PPIPA, Vic IPA) are increasingly citing ISO 27701 in tenders. Suppliers handling personal data on behalf of agencies inherit those obligations contractually. Foundation prepares operational staff to participate in supplier-assurance reviews and OAIC enquiries on a credible footing.
The exam is closed-book, so plan for recall rather than lookup. Work through these checkpoints before you sit it.
Free learning resources
Use Aegentra’s existing templates, checklists, registers and mappings alongside your course. No account or email is required.
Free companion reading for anyone studying or implementing ISO/IEC 27701:2025, the privacy information management standard:
Compare the family
The ISO 27701 family page compares current levels, prices, delivery, audiences and exam facts before you choose a pathway.
Compare ISO 27701 pathwaysSource and review status
Price, delivery and course content are generated from Aegentra’s authoritative catalogue record. The official PECB course page and exam policy are linked directly below. Source-link checks and substantive human review are tracked separately so one is never presented as the other.
Official PECB sources
Editorial accountability
Harry Sidhu owns publication of this record. A separate course-specific substantive reviewer has not yet been recorded.
Substantive review status
Official source links are checked separately. A course-specific substantive review date will be published when completed.
Yes. PECB certifications are internationally accredited and are accepted on Australian resumes, tender responses and procurement panels. Australia has no separate national licence for ISO 27701 Foundation — the recognition comes from the accreditation behind the credential, which is international.
PECB’s Foundation certificate programs are accredited by ANAB (ANSI National Accreditation Board) under ANSI/ASTM E2659 — the standard for certificate programs. Its professional certifications are separately accredited under ISO/IEC 17024, the international standard for bodies certifying persons, by IAS, UKAS, KAB and COFRAC.
Aegentra Academy is an official PECB authorised training partner in Australia, which is what allows this course to include the official PECB examination voucher rather than billing it separately. You can confirm that directly with PECB through the official PECB partner directory.
This official PECB course is sold and supported by Aegentra Academy. PECB supplies the course material, examination and professional credential scheme. Aegentra's wider practice also runs privacy and GRC engagements and Microsoft 365 hardening for Australian organisations. Named eLearning trainers are credited separately on this page when the course record supplies them.
Courses run online and self-paced through the myPECB platform, so professionals across Melbourne, Sydney, Brisbane, Perth, Adelaide, Canberra and New Zealand enrol online. Instructor-led cohorts and in-person delivery in Melbourne and Sydney are available on request. Multi-seat team pricing is available for five or more seats — email Academy@aegentra.com.au for an enterprise quote. Tax invoices with GST and ABN are issued automatically at checkout.
Yes — and since 14 October 2025 it is a standalone one. The ISO/IEC 27701:2025 revision restructured the standard as an independent management system standard, so an organisation can now be certified against ISO 27701 without first holding ISO 27001. Under the superseded 2019 edition it was an extension and could only be audited as an add-on to an existing ISMS certification. Much of the ISO 27701 content online still describes the old arrangement. Individuals are certified separately, through PECB credentials such as this Foundation course.
Individual training and organisational certification are two different costs. Through Aegentra Academy the PECB ISO 27701 Foundation course is $399 + GST and both Lead Implementer and Lead Auditor are $849 + GST, each including the official PECB examination voucher, 12 months of myPECB access and one free resit within 12 months. Certifying your organisation is a separate project: for an Australian SMB, readiness typically runs $18,000 to $35,000 when you are adding a PIMS to an existing ISO 27001 ISMS, or $45,000 to $80,000 greenfield with both built together, plus $12,000 to $25,000 for the Stage 1 and Stage 2 audit.
Five modules covering the structure of ISO/IEC 27701:2025, the relationship between the PIMS and the underlying ISO 27001 ISMS, the PII Controller vs PII Processor distinction, the privacy-specific controls in Annexes A and B, and exam preparation. Total effort is 8-12 hours of self-paced study.
Yes. PECB is accredited by UKAS, IAS and COFRAC under ISO/IEC 17024 for personnel certification — the same accreditation framework JAS-ANZ uses in Australia. The credential is recognised by Australian Commonwealth and state government tenders, APRA-regulated financial-services hiring, OAIC supplier-assurance reviews, and every certification body operating in Australia.
ISO 27001 protects information generally; ISO 27701 protects personal information specifically — with additional controls for lawful basis, consent, data subject rights, retention, breach notification, and supplier processing. If your organisation handles personal data in any meaningful volume, especially for EU customers, ISO 27701 is the natural next step. The Foundation credential is the cheapest way to get your team aligned on the additional vocabulary.
A Controller decides why personal information is processed — your company for your own employees, customers, marketing list. A Processor processes personal information on behalf of a Controller — your SaaS product handling customer data on their instruction. Most SaaS companies are both, in different parts of their business. ISO 27701 applies different controls by role — Table A.1 for PII controllers, Table A.2 for PII processors, and Table A.3 shared by both — and the Statement of Applicability declares which apply.
One-hour, multiple-choice, online-proctored. The exam covers two competency domains — fundamental concepts of a PIMS, and privacy-management based on ISO/IEC 27701. Pass mark is 70%. You receive your PECB digital certificate within a few business days of passing.
Every authorised PECB Foundation course leads to the same credential — the certificate is identical wherever you buy it. The differences are price, format, and who supports you. Aegentra delivers Foundation at $399 + GST with the exam, one free resit, and 12 months access included. Aegentra is also an active Australian security and privacy consultancy, so Academy support is informed by current PIMS practice.
The Annex A controls — Table A.1 for controllers, Table A.2 for processors, Table A.3 shared — map directly onto the Australian Privacy Principles (APPs). ISO 27701 is the standard documentary answer to OAIC enquiries about the privacy-management programme, and the most commonly cited framework in supplier-assurance reviews for APP-bound entities.
ISO 27701 is not a certification of GDPR compliance — only EU regulators can determine that. But the standard was written with GDPR in mind. Annex D and Annex E provide explicit cross-walks to GDPR articles. EU procurement teams accept ISO 27701 as the most efficient third-party evidence base for privacy-management capability under GDPR.
Indirectly. Procurement teams ask whether your organisation holds the ISO 27001 + ISO 27701 certifications (which are awarded to companies, not individuals). What Foundation does is make the staff completing those questionnaires meaningfully faster and more accurate — they understand the question being asked and the evidence that satisfies it. If the goal is the organisational certificate, talk to us about the Govern service.
PECB awards 14 CPD credits on completion of the ISO 27701 Foundation course. These count toward maintenance of other PECB credentials and toward CPD requirements at most professional bodies (IAPP, ISACA, (ISC)², AISA) on submission.
The Foundation credential does not expire and does not require renewal. The certificate is dated and refers to the ISO/IEC 27701:2025 edition; if the standard is significantly revised in future you may choose to take a refresher course, but there is no mandatory recertification.
Yes. Either complete checkout yourself and forward the Stripe tax invoice for reimbursement, or write to Academy@aegentra.com.au and we will issue an invoice direct to your organisation with payment terms. Groups of five or more receive a discount.
Immediately after payment. The Academy team confirms your seat with PECB and you receive login details by email — usually within one business day.
You have 12 months of access from enrolment. That window covers the course material, the official PECB exam, and one free resit if you need it.
One PECB-issued resit is included in your enrolment at no extra cost. Aegentra does not publish a pass-rate claim without an audited cohort dataset.
Questions about invoicing, GST, group bookings, refunds or instructor-led delivery? Read the Academy FAQ.
Build a Privacy Information Management System to ISO/IEC 27701:2025 — standalone or alongside an existing ISMS.
Plan and conduct ISO/IEC 27701 privacy audits — standalone or as part of a combined management-system audit.