Build a Privacy Information Management System to ISO/IEC 27701:2025 — standalone or alongside an existing ISMS. Published Self-Study or eLearning enrolment starts from $849 + GST and includes the official exam access stated on this page. Instructor-led delivery for organisations can be scoped on request; no public cohort is implied unless confirmed dates, mode, venue and trainer are shown.
Available Australia-wide, in New Zealand and across Asia Pacific — and, because self-study and eLearning are delivered online through the myPECB platform, from anywhere in the world. Instructor-led organisational delivery can be scoped on request; no public cohort or classroom venue is implied unless confirmed details are shown. Base prices are published in AUD, and every course page supports available local currencies including NZD. An Australian billing address adds 10% GST; a non-Australian billing address has no Australian GST.
The PECB ISO 27701 Lead Implementer Self-Study course costs A$849 excluding GST (A$933.90 including 10% GST for an Australian billing address) through Aegentra Academy, an official PECB authorised training partner in Australia. That price includes the official PECB examination voucher, the full course materials, 12 months of myPECB access, and one free exam resit within 12 months. Typical total learning effort is 30–40 hours. The eLearning format is A$928 excluding GST (A$1,020.80 including Australian GST), with 30–40 hours of typical total learning effort. For non-Australian billing addresses, Australian GST is not charged and any applicable local taxes are determined at checkout.
Instructor-led delivery is enquiry-only. Aegentra Academy is not currently publishing scheduled live online or classroom cohorts. Contact us to arrange a class for your organisation; Self-Study and eLearning are available without waiting for a cohort.
Australian totals above include 10% GST. For non-Australian billing addresses, Australian GST is not charged; any applicable local taxes are determined at checkout.
Online classes are arranged through the Aegentra Academy team for individual learners and groups.
Contact us for online classAsk about prerequisites, delivery, employer invoicing, or which course fits your goal.
We normally reply within one Australian business day.
Learn · Implement
Official PECB training is included. The practical ISO 27701 resources are free to use after the course, with no email required.
Learn
Included with courseThis is what the A$849 + GST Self-Study price covers, or A$928 + GST with PECB eLearning.
Choose your courseImplement
Free · No email requiredGo beyond passing the exam. Practical resources built around the work itself — the documents you will actually have to produce.
Explore free ISO 27701 resources$849 + GST self-paced, or $928 + GST with guided eLearning. Both include the official PECB examination voucher and two attempts — PECB’s own course documentation states that the training fee includes a first exam attempt and one free retake within 12 months — plus 12 months of myPECB access and over 450 pages of course material. There is no separate ISO 27701 exam cost. The course carries 31 CPD credits and is equivalent to a five-day classroom course. All ISO 27701 training through Aegentra Academy is official PECB certification training, with the exam cost included in the course price rather than billed separately.
| Course | Course focus | Exam | Self-Study | eLearning |
|---|---|---|---|---|
| Foundation | Understand a PIMS — the controller/processor split, the clause structure and the Annex A tables | 40 questions, 1 hour, closed book | $399 + GST | $449 + GST |
| Lead Implementer | Build the PIMS — scope it, run the privacy risk assessment, write the Statement of Applicability, take it to certification | 80 questions, 3 hours, open book | $849 + GST | $928 + GST |
| Lead Auditor | Audit the PIMS — plan and lead privacy audits against ISO 19011 and ISO/IEC 17021-1 | 80 questions, 3 hours, open book | $849 + GST | $928 + GST |
80 multiple-choice questions across 7 competency domains, open book, 3 hours, 70% to pass. The seven domains follow the implementation lifecycle: fundamental principles and concepts of a PIMS; initiation of the PIMS implementation; planning the implementation; implementing the PIMS; monitoring and measurement; continual improvement; and preparing for a PIMS certification audit.
Scenario-based items are still multiple-choice — there is no essay paper at this level. Being open book, you may use the standard, the course materials and your own notes, which makes retrieval speed the real constraint rather than memorisation. Candidates who fail usually knew the content but could not find it quickly enough; build an index into your notes before you sit.
One exam, four credential tiers, awarded on the experience you can attest to:
Above all of them sits PECB Certified ISO/IEC 27701 Master, which requires 20 years of professional experience with 10 in a leadership role, 5,000 hours of combined audit and project activity, and passing both the ISO/IEC 27701 exam and the Lead Auditor exam. Almost no provider publishes that tier exists.
Yes, since the October 2025 revision. ISO/IEC 27701:2025 is a stand-alone management system standard — PECB states the 2025 edition introduces a stand-alone PIMS, no longer requiring ISO/IEC 27001-based security management. Guidance telling you otherwise is describing the 2019 edition.
That changes the first decision in any implementation. Standalone suits an organisation whose obligation is privacy-driven — a health service, a marketing business, a government supplier — and which has no commercial reason to certify information security separately. Integrated suits anyone already holding ISO 27001, because clauses 4 to 10 are shared and the PIMS extends the existing scope instead of duplicating it.
Either way the control work is the same shape. Annex A is now one consolidated annex of 78 controls: Table A.1 for PII controllers (31 controls), Table A.2 for PII processors (18), and Table A.3 shared security controls (29). Your Statement of Applicability declares which apply, and the answer depends on your role in each processing activity — most organisations are both. Annex B carries the matching implementation guidance.
This is the practical reason Australian organisations implement it. The Privacy Act 1988 and its 13 Australian Privacy Principles set the domestic obligation; the GDPR applies to anyone processing EU personal data. Building separate compliance programmes for each is duplicated effort.
A PIMS gives you one system that produces evidence for both. APP 11 (security of personal information) is answered by the Table A.3 shared security controls; APP 8 (cross-border disclosure) by the transfer register; APP 12 and APP 13 (access and correction) by the PII principal rights process. The same records answer GDPR accountability. Our free APP mapping below sets out all thirteen.
These are the artefacts a Lead Implementer actually produces — published in full, free, no email required.
If the organisation needs the PIMS built rather than a person trained, that is our governance and compliance practice. For what organisational certification costs, see the ISO 27701 certification guide for Australia. Auditing one is the Lead Auditor track.
The official PECB course and exam package starts at A$849 + GST — with no separate exam fee after enrolment. Optional Aegentra Labs exam preparation is clearly priced separately.
The exam voucher is included in your enrolment, and so is one free resit if you don’t pass first time. Both the exam and the credential are issued directly by PECB.
PECB credential ladder: Provisional Implementer (no experience) → Implementer (2 years, 1 in privacy management, 200 hours) → Lead Implementer (5 years, 2 in privacy management, 300 hours) → Senior Lead Implementer (10 years, 7 in privacy management, 1,000 hours). Above these sits PECB Certified ISO/IEC 27701 Master, which requires 20 years of professional experience with 10 in a leadership role, 5,000 hours of combined audit and project activity, and passing both the ISO/IEC 27701 and Lead Auditor exams. All tiers require signing the PECB Code of Ethics and are maintained through continuing professional development (CPD) credits.
An exam pass is the first step. You must submit PECB's certification application and required declarations and references. PECB decides whether the requirements for the requested credential tier are met.
/ Before you enrol
These answers use this course's current catalogue record and PECB's published exam, certification, and maintenance policies.
The published price is A$849 for Self-Study or A$928 for eLearning, before tax. It includes the official PECB course materials, 12 months of access, the first exam attempt, one free retake, and the certification application fee. PECB’s partner-course policy also includes the first year of the Annual Maintenance Fee where maintenance applies; Foundation and Provisional credentials are maintenance-exempt. There is no separate first-exam or certification-application charge after enrolment.
PECB’s current maintenance policy lists no maintenance fee for Foundation, Provisional, or Transition credentials. For all other PECB certifications, the published fee is $390 per three-year certification cycle, together with the applicable CPD requirements and continued adherence to the PECB Code of Ethics. PECB sets this fee and may change it, so check the linked policy before renewal.
Yes. Every Academy course supports AUD and multiple local currencies, including NZD, USD, SGD, GBP, EUR, INR, AED, MYR, PHP, IDR, and VND when a live quote is available. Currency and tax are separate: an Australian billing address adds 10% GST, while a non-Australian billing address has no Australian GST. For example, an Australian working in New Zealand may pay in NZD and use an Australian billing address, but 10% GST will still be added because the billing address is Australian.
Self-Study costs A$849 before tax and uses the official PECB slide-based materials. eLearning costs A$928 before tax — A$79 more — and adds recorded trainer-led lessons and interactive learning activities. Both routes lead to the same PECB exam and credential, and both include the same exam package. Choose eLearning if explanations and video guidance help you learn; choose Self-Study if you are comfortable working through standards-based material independently.
Yes. PECB publishes remote online exam sessions that candidates can take from home or another suitable location through the PECB Exams application. The published course record lists these exam facts: duration — 3 hours; format — Open-book, multiple-choice — stand-alone and scenario-based questions; assessment — 80 multiple-choice questions across 7 competency domains — fundamental principles and concepts of a PIMS, initiation of the PIMS implementation, planning a PIMS implementation, implementation of a PIMS, monitoring and measurement, continual improvement, and preparing for a PIMS certification audit; pass mark — 70%; language — English (other PECB languages available on request). New Zealand candidates should choose a published session that suits their local time, meet PECB’s identity and technical requirements, and complete the system check before exam day. PECB’s general exam policy does not publish a New Zealand restriction.
PECB credential ladder: Provisional Implementer (no experience) → Implementer (2 years, 1 in privacy management, 200 hours) → Lead Implementer (5 years, 2 in privacy management, 300 hours) → Senior Lead Implementer (10 years, 7 in privacy management, 1,000 hours). Above these sits PECB Certified ISO/IEC 27701 Master, which requires 20 years of professional experience with 10 in a leadership role, 5,000 hours of combined audit and project activity, and passing both the ISO/IEC 27701 and Lead Auditor exams. All tiers require signing the PECB Code of Ethics and are maintained through continuing professional development (CPD) credits. Passing the exam does not by itself award a credential or guarantee the highest experience-based tier. PECB requires an online certification application and reference contact details, and its Certification Department decides whether the education, professional experience, and implementation or consulting activity requirements are met.
PECB’s public certification-process page does not publish a closed list of documents that automatically proves project hours. It requires the online application and contact details for references who may be contacted to validate your experience. Keep a dated activity log showing the organisation or client, your role, the implementation or consulting activity, dates, responsibilities, and hours; retain employer or client confirmations, statements of work, timesheets, or similar records in case PECB asks for support. The PECB Certification Department assesses the application and makes the final decision.
Yes. You can hold both the ISO 27701 Lead Implementer and ISO 27701 Lead Auditor credentials. They are separate, complementary certifications: Lead Implementer develops implementation knowledge, while Lead Auditor develops audit knowledge. To pursue both, complete each course, pass each exam, and apply for each credential. PECB assesses implementation-project experience for the Implementer tier and audit experience for the Auditor tier separately. If you pass an exam before meeting the full experience requirements, you may apply for the applicable Provisional credential and later request an upgrade. PECB evaluates each upgrade application and may determine whether an examination is required. Neither credential automatically grants the other.
6 modules, fully on-demand. Click any module to see the topics inside.
Foundation establishes the language, Lead Implementer builds the management system, and Lead Auditor verifies it. Choose the level that matches the work you will perform.
Privacy Information Management fundamentals — PII processors, controllers, lifecycle controls.
Build a Privacy Information Management System to ISO/IEC 27701:2025 — standalone or alongside an existing ISMS.
Plan and conduct ISO/IEC 27701 privacy audits — standalone or as part of a combined management-system audit.
The credential may support progression into risk, governance, implementation, audit and consulting roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
The credential may support progression into risk, governance, implementation, audit and consulting roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
The skill trained by Lead Implementer — designing and operating a privacy management system as an extension of an ISMS — transfers directly to ISO 42001 (when AI processes personal data), ISO 27001 (the underlying ISMS), and the privacy components of SOC 2. Practitioners who pair privacy with an existing information-security credential move into integrated-programme leadership roles.
The credential may support progression into risk, governance, implementation, audit and consulting roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
For an Australian SaaS company processing personal data of EU or UK residents, an organisational ISO 27701 certificate is the most efficient evidence base to satisfy GDPR-driven procurement and regulator enquiries. Lead Implementer is the credential the privacy lead holds when running that readiness programme — typically as Head of Privacy, DPO, or vCISO with privacy scope.
Healthcare, telehealth, and digital-health vendors operating under the My Health Records Act, the Healthcare Identifiers Act, HRIPA NSW, or the Victorian HPPs face stricter privacy requirements than the Commonwealth APP floor. Lead Implementer is the standard credential for the staff designing the integrated PIMS that overlays the underlying ISMS in those environments.
CDR-accredited data recipients (banks, non-bank lenders, energy retailers) must operate a privacy management programme covering CDR consumer-data handling, consent flows, dashboards, and deletion. APRA-regulated entities under CPS 234 face equivalent privacy-overlay expectations. Lead Implementer is the credential for the practitioner designing and operating that integrated privacy capability.
Commonwealth and state agencies bound by the Privacy Act increasingly cite ISO 27701 in supplier requirements. Defence-industry suppliers under DISP handling personal data inherit the same expectation. Lead Implementer is the credential most commonly held by the privacy lead designing the supplier-side PIMS.
The exam is open-book, but the questions reward fluency, not lookup. Plan your study around these checkpoints.
Free learning resources
Use Aegentra’s existing templates, checklists, registers and mappings alongside your course. No account or email is required.
Free companion reading for anyone studying or implementing ISO/IEC 27701:2025, the privacy information management standard:
Compare the family
The ISO 27701 family page compares current levels, prices, delivery, audiences and exam facts before you choose a pathway.
Compare ISO 27701 pathwaysSource and review status
Price, delivery and course content are generated from Aegentra’s authoritative catalogue record. The official PECB course page and exam policy are linked directly below. Source-link checks and substantive human review are tracked separately so one is never presented as the other.
Official PECB sources
Editorial accountability
Harry Sidhu owns publication of this record. A separate course-specific substantive reviewer has not yet been recorded.
Substantive review status
Official source links are checked separately. A course-specific substantive review date will be published when completed.
Official PECB training through an authorised partner. PECB is accredited by IAS and UKAS as a personnel certification body under ISO/IEC 17024 and by ANAB as a certificate issuer under ANSI/ASTM E2659-24. Accreditation is program- and scope-specific—verify the applicable credential before enrolment.
Official PECB training and credential pathway. Check PECB’s current accreditation information and the applicable program scope before enrolment.
This official PECB course is sold and supported by Aegentra Academy. PECB supplies the course material, examination and professional credential scheme. Aegentra's wider practice also runs privacy and GRC engagements and Microsoft 365 hardening for Australian organisations. Named eLearning trainers are credited separately on this page when the course record supplies them.
Published courses run online and self-paced through the myPECB platform, so professionals across Melbourne, Sydney, Brisbane, Perth, Adelaide, Canberra and New Zealand enrol online. Instructor-led delivery for organisations can be scoped on request. No public cohort or classroom venue is implied unless confirmed dates, mode, venue and trainer are shown on the course page. Multi-seat team pricing is available for five or more seats — email Academy@aegentra.com.au for an enterprise quote. Tax invoices with GST and ABN are issued automatically at checkout.
Not any more. The ISO/IEC 27701:2025 revision made the standard standalone, so you can implement and certify a Privacy Information Management System without an ISO 27001 ISMS underneath it. Prior ISO 27001 experience still helps, because both standards share the Annex SL management-system structure — context, leadership, planning, support, operation, evaluation, improvement — and most Australian enterprise and government buyers still ask for ISO 27001 first. Running them together remains the efficient path if you need both.
The PECB ISO 27701 Lead Implementer course costs $849 + GST through Aegentra Academy, and that price includes the official PECB examination voucher, the full course materials, 12 months of myPECB access, and one free resit within 12 months. There is no separate exam fee, and the exam is remotely proctored so you can sit it from anywhere in Australia.
Six modules covering the entire PIMS lifecycle — from Controller / Processor classification, through lawful basis, consent management, the Statement of Applicability for Annex A and B, data subject rights, breach handling, supplier processing agreements, and the combined stage 1 / stage 2 certification audit. Total effort is 30-40 hours of self-paced study.
Helpful, but no longer required. The ISO/IEC 27701:2025 revision (14 October 2025) restructured the standard as standalone, so an organisation can certify to ISO 27701 without holding ISO 27001. Prior ISO 27001 knowledge still shortens the learning curve, because both share the same Annex SL management-system structure. Most successful Lead Implementer alumni have completed ISO 27001 Lead Implementer first or have equivalent ISMS implementation experience. Doing 27701 cold is possible but the learning curve is much steeper.
80 multiple-choice questions across seven competency domains, open book, three hours, with a 70% pass mark. The domains are: fundamental principles and concepts of a PIMS; initiation of the PIMS implementation; planning a PIMS implementation; implementation of a PIMS; monitoring and measurement; continual improvement; and preparing for a PIMS certification audit. Scenario-based items are still multiple-choice — there is no essay paper. Being open book, you may use the standard, the course materials and your own notes, so retrieval speed matters more than memorisation. The credential awarded depends on attested experience: Provisional Implementer (none), Implementer (2 years, 1 in privacy management, 200 hours), Lead Implementer (5 years, 2 in privacy management, 300 hours), Senior Lead Implementer (10 years, 7 in privacy management, 1,000 hours).
Yes — that is the standard pattern in Australia. Most Australian SaaS companies pursuing ISO 27701 add it to an existing or in-progress ISO 27001 ISMS rather than running them independently. The Lead Implementer course covers the integrated programme explicitly, including how to manage a combined stage-2 audit.
Every authorised PECB Lead Implementer course leads to the same credential — the certificate is identical wherever you buy it. The differences are price, format, and who supports you. Aegentra delivers Lead Implementer at $849 + GST self-study, including the exam voucher and one free resit. Aegentra is also an active Australian privacy and information-security consultancy.
No — Lead Implementer credentials the individual. The organisational certificate is awarded after a successful stage 1 + stage 2 audit by an accredited certification body. What Lead Implementer does is qualify you to run that readiness programme from the inside, or as the lead consultant.
The 78 Annex A controls — controller, processor and shared security — map directly onto APP 1-13. ISO 27701 is the standard documentary answer the OAIC sees in supplier-assurance reviews and APP-compliance enquiries for entities that have invested in a formal programme.
ISO 27701 was written with GDPR in mind. Annex D and Annex E provide explicit cross-walks to GDPR articles. ISO 27701 certification is not formal GDPR compliance, but EU procurement teams and most EU data protection authorities accept it as the most efficient third-party evidence base for privacy-management capability.
Yes. Lead Implementer is the standard credential for independent privacy-management consultants in Australia. To use the Lead Implementer title you need to attest to 5 years of professional experience including at least 300 hours on PIMS or ISMS implementation projects — the credential is awarded at the appropriate level based on attested experience.
PECB awards 31 CPD credits on completion of the ISO 27701 Lead Implementer course. These count toward CPD requirements at IAPP, ISACA, (ISC)², AISA, and other professional bodies on submission, and toward maintenance of other PECB credentials.
Yes. Either complete checkout yourself and forward the Stripe tax invoice for reimbursement, or write to Academy@aegentra.com.au and we will issue an invoice direct to your organisation with payment terms. For group enrolments, request a written quote confirming the current price, payment terms and inclusions before purchase.
Self-Study — Typical total learning effort: 30–40 hours. eLearning — Typical total learning effort: 30–40 hours. These are typical total-learning-effort estimates. They are separate from the 12-month access period, exam duration, any live-class calendar span, and professional-experience requirements.
After payment, the Academy team confirms your enrolment with PECB and you receive login details by email — usually within one business day.
You have 12 months of access from enrolment. That window covers the course material, the official PECB exam, and one free resit if you need it.
One PECB-issued resit is included in your enrolment at no extra cost. Aegentra does not publish a pass-rate claim without an audited cohort dataset.
Questions about invoicing, GST, group bookings, refunds or instructor-led delivery? Read the Academy FAQ.
Privacy Information Management fundamentals — PII processors, controllers, lifecycle controls.
Plan and conduct ISO/IEC 27701 privacy audits — standalone or as part of a combined management-system audit.