Plan and conduct ISO/IEC 27701 privacy audits — standalone or as part of a combined management-system audit. Published Self-Study or eLearning enrolment starts from $849 + GST and includes the official exam access stated on this page. Training is delivered online. Available formats and booking arrangements are listed on this course page.
Available Australia-wide, in New Zealand and across Asia Pacific — and, because self-study and eLearning are delivered online through the myPECB platform, from anywhere in the world. Academy training is online only. Where a course offers live online teaching, dates and booking arrangements are confirmed before booking. Base prices are published in AUD, and every course page supports available local currencies including NZD. An Australian billing address adds 10% GST; a non-Australian billing address has no Australian GST.
The PECB ISO 27701 Lead Auditor Self-Study course costs A$849 excluding GST (A$933.90 including 10% GST for an Australian billing address) through Aegentra Academy, an official PECB authorised training partner in Australia. That price includes the official PECB examination voucher, the full course materials, 12 months of myPECB access, and one free exam resit within 12 months. Typical total learning effort is 30–40 hours. The eLearning format is A$928 excluding GST (A$1,020.80 including Australian GST), with 30–40 hours of typical total learning effort. For non-Australian billing addresses, Australian GST is not charged and any applicable local taxes are determined at checkout.
Academy training is online only. Check the available formats and booking arrangements on this page. Any published live online option is arranged by enquiry; Self-Study and eLearning are available without waiting for a cohort.
Brochures describe the published course material and may retain an earlier examination or credential version. Check the current PECB examination record and confirm your assigned edition before enrolment.
Download course brochurePDFThis course publishes 12 months of material access. Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply.
Australian totals above include 10% GST. For non-Australian billing addresses, Australian GST is not charged; any applicable local taxes are determined at checkout.
Ask Aegentra Academy about the online formats currently available for this course and their booking arrangements. An enquiry does not confirm live-class availability.
Contact us for online classAsk about prerequisites, delivery, employer invoicing, or which course fits your goal.
We normally reply within one Australian business day.
Learn · Implement
Official PECB training is included. The practical ISO 27701 resources are free to use after the course, with no email required.
Learn
Included with courseThis is what the A$849 + GST Self-Study price covers, or A$928 + GST with PECB eLearning.
Choose your courseImplement
Free · No email requiredGo beyond passing the exam. Practical resources built around the work itself — the documents you will actually have to produce.
Explore free ISO 27701 resources$849 + GST self-paced, or $928 + GST with guided eLearning. The official PECB examination voucher is included along with two attempts — PECB’s course documentation states the training fee includes a first exam attempt and one free retake within 12 months — so there is no separate ISO 27701 exam cost to budget for. All ISO 27701 training through Aegentra Academy is official PECB certification training. Also included: 12 months of myPECB access, over 400 pages of course material, and 31 CPD credits. The course is equivalent to five days of classroom training.
| Course | Course focus | Exam | Self-Study | eLearning |
|---|---|---|---|---|
| Foundation | Understand a PIMS — the controller/processor split, the clause structure and the Annex A tables | 40 questions, 1 hour, closed book | $399 + GST | $449 + GST |
| Lead Implementer | Build the PIMS — scope it, run the privacy risk assessment, write the Statement of Applicability, take it to certification | 80 questions, 3 hours, open book | $849 + GST | $928 + GST |
| Lead Auditor | Audit the PIMS — plan and lead privacy audits against ISO 19011 and ISO/IEC 17021-1 | 80 questions, 3 hours, open book | $849 + GST | $928 + GST |
80 multiple-choice questions across 7 competency domains, open book, 3 hours, 70% to pass. The seven domains follow the audit lifecycle: fundamental principles and concepts of a PIMS; PIMS requirements; fundamental audit concepts and principles; preparing an ISO/IEC 27701 audit; conducting the audit; closing the audit; and managing an audit programme.
Note that the domain split differs from the Lead Implementer exam, which follows the implementation lifecycle instead. Same question count, same duration, different ground. The course itself is taught against ISO 19011 (auditing management systems), ISO/IEC 17021-1 (requirements for certification bodies) and ISO/IEC 27706 — the last of which almost no provider mentions.
They are different jobs, and the distinction decides which course to buy.
An internal auditor audits their own organisation’s PIMS against Clause 9.2 — checking that what the Statement of Applicability claims is actually operating, before a certification body arrives. The course covers this audit context; competence, independence, experience and organisational requirements still apply.
A lead auditor plans and leads audits of other organisations — as a consultant, in supplier assurance, or on a certification body assessment team. That is what ISO/IEC 17021-1 competence requirements exist for, and it is the ground domains 4 to 7 cover. There is no separate PECB "internal auditor" credential for ISO 27701; the Lead Auditor course covers both contexts, and the credential you are awarded depends on attested audit experience rather than on which role you intend to fill.
Since the October 2025 revision this is a live question rather than a theoretical one. ISO/IEC 27701:2025 is a stand-alone standard — PECB states the 2025 edition introduces a stand-alone PIMS, no longer requiring ISO/IEC 27001-based security management — so an auditor now meets both shapes in the field.
A standalone PIMS audit covers clauses 4 to 10 and Annex A in their own right. The scope statement stands alone, and Table A.3 shared security controls are audited as part of the PIMS rather than inherited from an ISMS.
A combined ISO 27001 + ISO 27701 audit shares the management-system clauses and audits the privacy controls as an extension of the existing ISMS scope. It is more efficient, and it is what most certified organisations still do — but the auditor has to be explicit about which certificate each finding attaches to. Getting that wrong is a common quality-review failure.
Either way you are auditing against 78 Annex A controls in three tables — A.1 for PII controllers (31), A.2 for PII processors (18), A.3 shared security (29) — with Annex B as the implementation guidance you read to understand what good looks like. An auditee that is both controller and processor is in scope for all three.
Privacy assurance is a smaller market than information security, and that cuts both ways — fewer roles, far fewer qualified people. The demand sits in four places: internal audit and second-line privacy teams in organisations holding or seeking certification; supplier assurance functions assessing processors, which the Privacy Act 1988 makes an obligation rather than a courtesy under APP 11 and APP 8; consultancies running readiness and pre-certification reviews; and certification body assessment teams, where ISO/IEC 17021-1 competence requirements make the credential close to mandatory.
Australian organisations handling health information, financial services data, or EU personal data are where the work concentrates.
The artefacts an auditor asks for first — published in full, free, no email required.
Building a PIMS rather than auditing one is the Lead Implementer track. For what organisational certification involves, see the ISO 27701 certification guide for Australia.
The official PECB course and exam package starts at A$849 + GST — with no separate exam fee after enrolment. Optional Aegentra Labs exam preparation is clearly priced separately.
The exam voucher is included in your enrolment, and so is one free resit if you don’t pass first time. Both the exam and the credential are issued directly by PECB.
PECB credential ladder: Provisional Auditor (no experience) → Auditor (2 years, 1 in privacy management, 200 audit hours) → Lead Auditor (5 years, 2 in privacy management, 300 audit hours) → Senior Lead Auditor (10 years, 7 in privacy management, 1,000 audit hours). Above these sits PECB Certified ISO/IEC 27701 Master, which requires 20 years of professional experience with 10 in a leadership role, 5,000 hours of combined audit and project activity, and passing both the ISO/IEC 27701 and Lead Auditor exams. All tiers require signing the PECB Code of Ethics. Provisional credentials are exempt from maintenance; other tiers follow the applicable CPD and fee requirements.
An exam pass is the first step. You must submit PECB's certification application and required declarations and references. PECB decides whether the requirements for the requested credential tier are met.
/ Before you enrol
These answers use this course's current catalogue record and PECB's published exam, certification, and maintenance policies.
The published price is A$849 for Self-Study or A$928 for eLearning, before tax. It includes the official PECB course materials, the first exam attempt, one free retake, and the certification application fee. This course publishes 12 months of material access. Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply. PECB’s partner-course policy also includes the first year of the Annual Maintenance Fee where maintenance applies; Foundation and Provisional credentials are maintenance-exempt. There is no separate first-exam or certification-application charge after enrolment.
PECB’s maintenance policy exempts Foundation, Provisional and Transition credentials. Other credentials have tier-specific CPD requirements and maintenance fees. Confirm the applicable amount and currency directly with PECB before renewal; its public fee table uses an unqualified dollar symbol, which must not be read as an Australian-dollar quote. Course-completion CPD credits and ongoing credential maintenance are separate requirements.
Yes. Every Academy course supports AUD and multiple local currencies, including NZD, USD, SGD, GBP, EUR, INR, AED, MYR, PHP, IDR, and VND when a live quote is available. Currency and tax are separate: an Australian billing address adds 10% GST, while a non-Australian billing address has no Australian GST. For example, an Australian working in New Zealand may pay in NZD and use an Australian billing address, but 10% GST will still be added because the billing address is Australian.
Self-Study costs A$849 before tax and uses the official PECB slide-based materials. eLearning costs A$928 before tax — A$79 more — and adds recorded trainer-led lessons and interactive learning activities. Both routes lead to the same PECB exam and credential, and both include the same exam package. Choose eLearning if explanations and video guidance help you learn; choose Self-Study if you are comfortable working through standards-based material independently.
Yes. PECB publishes remote online exam sessions that candidates can take from home or another suitable location through the PECB Exams application. The published course record lists these exam facts: duration — 3 hours; format — Open-book, multiple-choice — stand-alone and scenario-based questions; assessment — 80 multiple-choice questions across 7 competency domains — fundamental principles and concepts of a PIMS, PIMS requirements, fundamental audit concepts and principles, preparing an ISO/IEC 27701 audit, conducting the audit, closing the audit, and managing an audit programme; pass mark — 70%; language — English (other PECB languages available on request). New Zealand candidates should choose a published session that suits their local time, meet PECB’s identity and technical requirements, and complete the system check before exam day. PECB’s general exam policy does not publish a New Zealand restriction.
PECB credential ladder: Provisional Auditor (no experience) → Auditor (2 years, 1 in privacy management, 200 audit hours) → Lead Auditor (5 years, 2 in privacy management, 300 audit hours) → Senior Lead Auditor (10 years, 7 in privacy management, 1,000 audit hours). Above these sits PECB Certified ISO/IEC 27701 Master, which requires 20 years of professional experience with 10 in a leadership role, 5,000 hours of combined audit and project activity, and passing both the ISO/IEC 27701 and Lead Auditor exams. All tiers require signing the PECB Code of Ethics. Provisional credentials are exempt from maintenance; other tiers follow the applicable CPD and fee requirements. Passing the exam does not by itself award a credential or guarantee the highest experience-based tier. PECB requires an online certification application and reference contact details, and its Certification Department decides whether the education, professional experience, and audit or assessment activity requirements are met.
PECB’s public certification-process page does not publish a closed list of documents that automatically proves project hours. It requires the online application and contact details for references who may be contacted to validate your experience. Keep a dated activity log showing the organisation or client, your role, the audit or assessment activity, dates, responsibilities, and hours; retain employer or client confirmations, statements of work, timesheets, or similar records in case PECB asks for support. The PECB Certification Department assesses the application and makes the final decision.
Yes. You can hold both the ISO 27701 Lead Implementer and ISO 27701 Lead Auditor credentials. They are separate, complementary certifications: Lead Implementer develops implementation knowledge, while Lead Auditor develops audit knowledge. To pursue both, complete each course, pass each exam, and apply for each credential. PECB assesses implementation-project experience for the Implementer tier and audit experience for the Auditor tier separately. If you pass an exam before meeting the full experience requirements, you may apply for the applicable Provisional credential and later request an upgrade. PECB evaluates each upgrade application and may determine whether an examination is required. Neither credential automatically grants the other.
6 modules, fully on-demand. Click any module to see the topics inside.
Foundation establishes the language, Lead Implementer builds the management system, and Lead Auditor verifies it. Choose the level that matches the work you will perform.
Privacy Information Management fundamentals — PII processors, controllers, lifecycle controls.
Build a Privacy Information Management System to ISO/IEC 27701:2025 — standalone or alongside an existing ISMS.
Plan and conduct ISO/IEC 27701 privacy audits — standalone or as part of a combined management-system audit.
The credential may support progression into risk, governance, implementation, audit and consulting roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
The credential may support progression into risk, governance, implementation, audit and consulting roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
Implementation and audit methods are complementary. Holding both credentials does not replace experience, sector competence or an employer’s engagement requirements.
The credential may support progression into risk, governance, implementation, audit and consulting roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
The credential may support progression into risk, governance, implementation, audit and consulting roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
The credential may support progression into risk, governance, implementation, audit and consulting roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
Large Australian enterprises and government agencies operate supplier-privacy programmes that include privacy-scope audits of critical suppliers. Lead Auditor is the credential the supplier-assurance team holds when conducting those audits — particularly for suppliers handling sensitive personal information or inheriting compliance obligations under the Privacy Act, CDR, or sector-specific health-privacy regimes.
CDR data recipients must operate audit-ready privacy management programmes. Lead Auditor is the credential most commonly held by the internal-audit staff and the supplier-assurance teams reviewing those programmes against the CDR privacy safeguards.
The exam is open-book, but the questions reward fluency, not lookup. Plan your study around these checkpoints.
Free learning resources
Use Aegentra’s existing templates, checklists, registers and mappings alongside your course. No account or email is required.
Free companion reading for anyone studying or implementing ISO/IEC 27701:2025, the privacy information management standard:
Compare the family
The ISO 27701 family page compares current levels, prices, delivery, audiences and exam facts before you choose a pathway.
Compare ISO 27701 pathwaysSource and review status
Price, delivery and course content are generated from Aegentra’s authoritative catalogue record. The official PECB course page and exam policy are linked directly below. Source-link checks and substantive human review are tracked separately so one is never presented as the other.
Official PECB sources
Editorial accountability
Harry Sidhu owns publication of this record. A separate course-specific substantive reviewer has not yet been recorded.
Substantive review status
Official source links are checked separately. A course-specific substantive review date will be published when completed.
Official PECB training through an authorised partner. PECB is accredited by IAS and UKAS as a personnel certification body under ISO/IEC 17024 and by ANAB as a certificate issuer under ANSI/ASTM E2659-24. Accreditation is program- and scope-specific—verify the applicable credential before enrolment.
Official PECB training and credential pathway. Check PECB’s current accreditation information and the applicable program scope before enrolment.
This official PECB course is sold and supported by Aegentra Academy. PECB supplies the course material, examination and professional credential scheme. Aegentra's wider practice also runs privacy and GRC engagements and Microsoft 365 hardening for Australian organisations. Named eLearning trainers are credited separately on this page when the course record supplies them.
Published Self-Study and eLearning courses run online through the myPECB platform, so professionals across Melbourne, Sydney, Brisbane, Perth, Adelaide, Canberra and New Zealand enrol online. Any live online option and its booking arrangements are stated on the relevant course page. Physical classroom and onsite Academy training are not offered. Multi-seat team pricing is available for five or more seats — email Academy@aegentra.com.au for an enterprise quote. Tax invoices with GST and ABN are issued automatically at checkout.
A Privacy Information Management System — the controls governing how an organisation collects, uses, stores, discloses and disposes of personally identifiable information, in both the controller and processor roles. Since the ISO/IEC 27701:2025 revision made the standard standalone, a PIMS can be audited on its own rather than only as an extension to an ISO 27001 ISMS audit. In practice many Australian audits still cover both together, because the two share the same management-system structure.
The PECB ISO 27701 Lead Auditor course costs $849 + GST through Aegentra Academy, including the official PECB examination voucher, course materials, 12 months of myPECB access, and one free resit within 12 months. There is no separate examination fee. The exam is open-book and remotely proctored, so it can be sat from anywhere in Australia.
Six modules covering the foundations of auditing under ISO 19011, audit planning and resource allocation for stand-alone and combined PIMS audits, the on-site audit programme, privacy-specific nonconformity classification and finding-writing, the stage 1 / stage 2 / surveillance / recertification cycle for combined audits, and certification-body practice for the privacy extension. Total effort is 30-40 hours.
Helpful, but not required. Since the ISO/IEC 27701:2025 revision a PIMS can be audited standalone, though many Australian audits still run combined with the information-security audit. Most successful Lead Auditor alumni arrive with lead-auditor experience on another management system. Starting here cold is possible, but the learning curve is much steeper.
80 multiple-choice questions across seven competency domains, open book, three hours, with a 70% pass mark. The domains are: fundamental principles and concepts of a PIMS; PIMS requirements; fundamental audit concepts and principles; preparing an ISO/IEC 27701 audit; conducting the audit; closing the audit; and managing an audit programme. Scenario-based items are still multiple-choice — there is no essay paper. The course is taught against ISO 19011, ISO/IEC 17021-1 and ISO/IEC 27706. The credential awarded depends on attested audit experience: Provisional Auditor (none), Auditor (2 years, 1 in privacy management, 200 audit hours), Lead Auditor (5 years, 2 in privacy management, 300 audit hours), Senior Lead Auditor (10 years, 7 in privacy management, 1,000 audit hours).
Every authorised PECB Lead Auditor course leads to the same credential — the certificate is identical wherever you buy it. The differences are price, format, and who supports you. Aegentra delivers Lead Auditor at $849 + GST self-study, with the exam voucher and one free resit included. The Australian-context privacy-audit references are informed by current assurance practice.
The credential may support progression into risk, governance, implementation, audit and consulting roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
Yes. The course explicitly covers all three audit types — first-party (internal privacy audits), second-party (supplier and contractor audits), and third-party (certification-body audits leading to issuance of a combined ISO 27001 + ISO 27701 certificate).
The audit principles, methodology, and finding discipline transfer to other privacy regimes. The course is specifically about ISO 27701, but Annex D and Annex E cross-walks to GDPR mean a Lead Auditor is well placed to support GDPR-aligned privacy audits as well.
PECB awards 31 CPD credits on completion of the ISO 27701 Lead Auditor course. These count toward CPD requirements at IAPP, ISACA, (ISC)², IIA, AISA, and other professional bodies on submission.
Yes. Lead Auditor training covers planning and conducting internal privacy audits inside your own organisation, regardless of attested external experience. Organisational competence and independence requirements still apply. The internal audit programme is one of the most common starting points for Lead-Auditor-credentialled practitioners.
Yes. Either complete checkout yourself and forward the Stripe tax invoice for reimbursement, or write to Academy@aegentra.com.au and we will issue an invoice direct to your organisation with payment terms. For group enrolments, request a written quote confirming the current price, payment terms and inclusions before purchase.
Self-Study — Typical total learning effort: 30–40 hours. eLearning — Typical total learning effort: 30–40 hours. These are typical total-learning-effort estimates. They are separate from course-material access, exam duration, any live-class calendar span, and professional-experience requirements.
After payment, the Academy team confirms your enrolment with PECB and you receive login details by email — usually within one business day.
This course publishes 12 months of material access. Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination.
One PECB-issued resit is included under the applicable conditions. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply. Aegentra does not publish a pass-rate claim without an audited cohort dataset.
Questions about invoicing, GST, group bookings, refunds or instructor-led delivery? Read the Academy FAQ.
Privacy Information Management fundamentals — PII processors, controllers, lifecycle controls.
Build a Privacy Information Management System to ISO/IEC 27701:2025 — standalone or alongside an existing ISMS.