The short version
- The pathway is short: official PECB training, one 80-question open-book exam, then experience tiers you climb over time.
- You do not need years of privacy experience to start — passing the exam allows an application for Provisional Implementer, subject to the application, Code of Ethics and PECB approval.
- Since the October 2025 revision ISO 27701 is a STAND-ALONE standard. It no longer requires an ISO 27001 ISMS underneath it, and most guidance online has not caught up.
- Annex A is now one consolidated annex of 78 controls in three tables — controller, processor and shared security. Annex B is implementation guidance, not the processor control set it was in 2019.
- Australian demand is driven by the Privacy Act and enterprise procurement rather than by legislation naming the standard.
What an ISO 27701 Lead Implementer actually is
ISO/IEC 27701:2025 is the international management-system standard for privacy — and since the October 2025 revision it is stand-alone, no longer requiring an ISO 27001 ISMS underneath it. A Lead Implementer is the person who builds and runs that system: the records of processing, the privacy policy, the risk assessment, the Statement of Applicability, the 78 Annex A controls, and the audit readiness. If you want the detail on the standard itself and how organisations get certified, that is covered in our ISO 27701 certification guide. This page is about the individual credential and the career behind it.
Two clarifications worth making early, because they are where most of the confusion sits. First, the Lead Implementer builds the system and the Lead Auditor assesses it — separate credentials, separate career tracks, so see the ISO 27701 Lead Auditor course if assessment is where you are headed. Second, a great deal of published guidance still describes the 2019 edition, which required ISO 27001 first and split the controls across Annex A and Annex B. Neither is true of the 2025 edition, so check which version anything you read is describing.
The step-by-step pathway
- 01
Get the management-system grounding
Foundation is optional preparation. PECB requires foundational knowledge of information privacy before attending. ISO 27701 Foundation or equivalent study can help build that knowledge; it is a recommendation, not a required prior certificate. Choose preparation based on your existing knowledge and the specific course requirements.
- 02
Take the official Lead Implementer course
The official PECB ISO/IEC 27701 Lead Implementer course teaches you to establish and maintain a PIMS end to end — organisational context, PIMS scope, gap analysis, privacy policy, privacy risk assessment and treatment, the Statement of Applicability, control selection and implementation, monitoring, and preparation for the certification audit. PECB supplies over 450 pages of material.
- 03
Sit and pass the PECB exam
Open-book, multiple-choice — stand-alone and scenario-based questions. Duration: 3 hours. 80 multiple-choice questions across 7 competency domains — fundamental principles and concepts of a PIMS, initiation of the PIMS implementation, planning a PIMS implementation, implementation of a PIMS, monitoring and measurement, continual improvement, and preparing for a PIMS certification audit. Passing requirements: 70%. Check the current PECB examination record and assigned examination before booking. PECB credential ladder: Provisional Implementer (no experience) → Implementer (2 years, 1 in privacy management, 200 hours) → Lead Implementer (5 years, 2 in privacy management, 300 hours) → Senior Lead Implementer (10 years, 7 in privacy management, 1,000 hours). Above these sits PECB Certified ISO/IEC 27701 Master, which requires 20 years of professional experience with 10 in a leadership role, 5,000 hours of combined audit and project activity, and passing both the ISO/IEC 27701 and Lead Auditor exams. All tiers require signing the PECB Code of Ethics. Provisional credentials are exempt from maintenance; other tiers follow the applicable CPD and fee requirements. Passing the examination and receiving a credential are separate: PECB must approve the application. Maintenance depends on the credential awarded; Provisional credentials and Foundation certificates are exempt from CPD and maintenance fees. Check the current PECB policy for other credentials.
- 04
Log your experience and PIMS project hours
PECB counts two things separately — years of professional experience with a minimum specifically in privacy management, and hours of hands-on PIMS project activity. Keep a running log with dates, the organisation, the deliverable and the hours. Reconstructing it two years later is painful.
- 05
Sign the Code of Ethics and apply for your tier
Every tier requires signing the PECB Code of Ethics and submitting an application with references. PECB evaluates submitted experience evidence and issues a digital credential that can be checked in its public directory.
- 06
Maintain it, and know where the ladder goes
PECB credential ladder: Provisional Implementer (no experience) → Implementer (2 years, 1 in privacy management, 200 hours) → Lead Implementer (5 years, 2 in privacy management, 300 hours) → Senior Lead Implementer (10 years, 7 in privacy management, 1,000 hours). Above these sits PECB Certified ISO/IEC 27701 Master, which requires 20 years of professional experience with 10 in a leadership role, 5,000 hours of combined audit and project activity, and passing both the ISO/IEC 27701 and Lead Auditor exams. All tiers require signing the PECB Code of Ethics. Provisional credentials are exempt from maintenance; other tiers follow the applicable CPD and fee requirements. Passing the examination and receiving a credential are separate: PECB must approve the application. Maintenance depends on the credential awarded; Provisional credentials and Foundation certificates are exempt from CPD and maintenance fees. Check the current PECB policy for other credentials.
Aegentra Academy is an official PECB authorised training partner and delivers the ISO 27701 Lead Implementer course online and self-paced, with instructor-led delivery available on request. Foundation-level grounding is available through the ISO 27701 Foundation course.
Credential tiers & the experience each one needs
“Lead Implementer” is not a single pass/fail credential — it is the third rung of a four-tier ladder. All four tiers sit the same exam. What separates them is the professional experience and the hours of hands-on PIMS work you can evidence. You pass the exam once, then climb as your career grows.
| Credential tier | Total experience | In privacy management | PIMS project hours |
|---|---|---|---|
| Provisional Implementer | None | — | 0 |
| Implementer | 2 years | 1 yr | 200 |
| Lead Implementerthe target | 5 years | 2 yrs | 300 |
| Senior Lead Implementer | 10 years | 7 yrs | 1,000 |
PIMS project hours required, by tier
These are PECB scheme requirements, not requirements of the ISO standard itself — confirm the current criteria on the official PECB ISO/IEC 27701 page. Every tier also requires signing the PECB Code of Ethics.
What counts as PIMS project hours
Two things are counted separately. Professional experience is your years of work, with a minimum specifically in privacy management — one year for Implementer, two for Lead Implementer, seven for Senior Lead Implementer. Project activity hours are hands-on hours doing the PIMS work itself.
This is the part people underestimate and then, later, cannot evidence. The activities below are the real deliverables of a Privacy Information Management System. If you are already doing any of them — in a GRC, privacy, risk, audit, or security role — record the work actually performed and ask PECB to confirm uncertain eligibility.
Determining controller vs processor role
Working out, per processing activity, whether the organisation decides the purpose (controller) or acts on instruction (processor). An organisation may have different roles in different processing activities; assess each role from the actual purpose, decisions and instructions.
Building the Records of Processing Activities
Documenting every activity with its purpose, lawful basis, PII categories, recipients, cross-border transfers, retention period and owner. Record the activity actually performed and retain suitable evidence.
Privacy risk assessment and treatment
Assessing risk to PII principals rather than only to the organisation, scoring it against defined criteria, and producing a treatment plan somebody accountable has actually signed.
Drafting the Statement of Applicability
Deciding which of the 78 Annex A controls apply across Table A.1 (controller), Table A.2 (processor) and Table A.3 (shared security), and writing a scope-based justification for every exclusion.
Implementing the privacy controls
Turning the controls into working practice — collection notices, consent and opt-out handling, PII principal access and correction, cross-border transfer safeguards, retention schedules and defensible disposal.
Mapping to the Privacy Act and GDPR
Cross-walking the PIMS to the 13 Australian Privacy Principles and, where GDPR applies, to its applicable requirements. A mapping supports coordination but does not itself establish legal compliance.
Internal audit preparation and management review
Building the audit programme, preparing evidence, supporting the auditor, and packaging performance data into a management review leadership can actually decide on.
One caution on the last item: hours spent preparing for an internal audit count, and so do hours supporting one — but an organisation generally needs an independent pair of eyes on its own PIMS before a certification audit. We run that as a service, an ISO 27701 implementation service, precisely because the person who built the system cannot credibly audit it.
Why the role is emerging in Australia
No Australian law currently requires ISO 27701 by name. The demand arrives through a different door — contracts, procurement, and offshore regulation. Four pressures account for most of it.
Requirements depend on the engagement
Privacy management knowledge may support relevant organisational roles. Check the actual legislation, contract, tender and certification scope; this guide is not a vacancy or salary survey.
Audit and implementation are distinct
The organisation must assign competent people and protect audit objectivity and impartiality. A course or individual credential does not itself appoint a certification-body auditor, confer statutory authority or establish organisational compliance.
Confirm the applicable edition
Use the edition and transition arrangements relevant to the organisation and confirm the delivered course-material and examination edition before enrolment. A standard publication does not create an automatic training upgrade.
None of that guarantees a hiring boom, and it is worth being honest about that: privacy as a standalone discipline is still maturing in Australia and titles are still settling. What is observable today is that the questions are being asked — in questionnaires, in contracts, in board packs — and very few people can answer them with a defensible framework behind the answer. That gap is the opportunity.
Roles and career pathways in Australia
The credential maps onto a cluster of roles that barely existed three years ago and now appear regularly in Australian job ads. Most sit inside risk, GRC, or security functions rather than engineering ones, and most are filled by people who converted from an adjacent compliance discipline rather than by AI specialists.
The credential may support progression into risk, governance, implementation, audit and consulting roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
ISO 27001 implementer vs ISO 27701 implementer
The two standards share the Annex SL high-level structure that ISO uses across all its management-system standards. Clauses 4 to 10 are the same skeleton in both: context, leadership, planning, support, operation, performance evaluation, improvement. That is why experienced ISO 27001 practitioners convert quickly — the machinery is familiar, and what changes is whose risk you are assessing. ISO 27001 asks what could harm the organisation; ISO 27701 asks what could harm the person the data is about.
| ISO 27001 Lead Implementer | ISO 27701 Lead Implementer | |
|---|---|---|
| System built | Information Security Management System (ISMS) | Privacy Information Management System (PIMS) |
| Clause structure | Annex SL clauses 4–10 | The same Annex SL clauses 4–10 |
| Risk lens | Confidentiality, integrity, availability of information | Risk to the PII principal — the person the data is about |
| Key artefact | Risk assessment and treatment plan | Records of Processing Activities, plus the controller/processor determination |
| Control set | Annex A controls of ISO/IEC 27001:2022 | 78 Annex A controls of ISO/IEC 27701:2025 across three tables |
| Standalone? | Yes | Yes, since the October 2025 revision — it was not before |
| Typical background | Security, IT, GRC | Privacy, legal, GRC, security, audit — often the same people |
A great many practitioners hold both and integrate the two systems rather than running them in parallel — one risk register, one internal audit programme, one management review, with privacy as an additional scope. That integration is now optional rather than required, which is the single biggest practical change in the 2025 edition. If you want the information-security credential first, the companion guide is how to become a certified ISO 27001 Lead Implementer. If your organisation needs the PIMS built rather than a person trained, that is our ISO 27701 implementation service.
FAQs
Is the ISO 27701 Lead Implementer credential worth it?
The credential may support progression into risk, governance, implementation, audit and consulting roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
Do I need ISO 27001 before ISO 27701?
No — and since the October 2025 revision that is true of the standard itself, not just the credential. ISO/IEC 27701:2025 is a stand-alone management system standard; PECB states the 2025 edition introduces a stand-alone PIMS, no longer requiring ISO/IEC 27001-based security management. Guidance telling you otherwise is describing the superseded 2019 edition. There is also no prerequisite credential — you can enrol without any ISO 27001 background, though practitioners who already run an ISMS learn the material faster because clauses 4 to 10 share the same structure.
How long does the ISO 27701 Lead Implementer course take?
Around 30 to 40 hours of self-paced study, which most people spread across a few weeks alongside their job, and it is equivalent to a five-day classroom course. The exam is three hours, open book, remotely proctored, with a 70% pass mark. The course carries 31 CPD credits and includes over 450 pages of material.
How much does the course cost in Australia?
Self-Study: A$ 578.00 excluding GST. eLearning: A$ 578.00 excluding GST. Published inclusions (subject to the credential and retake clarification immediately below): PECB ISO/IEC 27701 Lead Implementer slide deck (digital); 12 months access via myPECB; Module quizzes, practice scenarios, and exam-style cases; Editable PIMS templates — privacy policy, ROPA, DSR procedure; Official PECB Lead Implementer exam voucher; Three-hour open-book exam, remotely proctored; Two exam attempts (initial + one free resit); PECB Implementer / Lead Implementer credential on pass; GDPR Annex D / E cross-walk worked example; Sample Statement of Applicability for a SaaS Processor; APP and CDR reference sheets (Australian context); Pathway discount toward Lead Auditor. Clarification: references to a credential or certificate on pass do not mean automatic award. The eligible PECB credential requires an application and PECB approval, including applicable experience and ethics requirements. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply. A retained inclusion referring to the initial examination date does not extend or restart this policy cycle. Australian GST follows the billing address. Check the course page for the full inclusions and current booking options. This course publishes 12 months of material access. Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply.
What is on the exam?
Open-book, multiple-choice — stand-alone and scenario-based questions. Duration: 3 hours. 80 multiple-choice questions across 7 competency domains — fundamental principles and concepts of a PIMS, initiation of the PIMS implementation, planning a PIMS implementation, implementation of a PIMS, monitoring and measurement, continual improvement, and preparing for a PIMS certification audit. Passing requirements: 70%. Check the current PECB examination record and assigned examination before booking.
Lead Implementer or Lead Auditor — which should I take?
PECB credential ladder: Provisional Implementer (no experience) → Implementer (2 years, 1 in privacy management, 200 hours) → Lead Implementer (5 years, 2 in privacy management, 300 hours) → Senior Lead Implementer (10 years, 7 in privacy management, 1,000 hours). Above these sits PECB Certified ISO/IEC 27701 Master, which requires 20 years of professional experience with 10 in a leadership role, 5,000 hours of combined audit and project activity, and passing both the ISO/IEC 27701 and Lead Auditor exams. All tiers require signing the PECB Code of Ethics. Provisional credentials are exempt from maintenance; other tiers follow the applicable CPD and fee requirements. Passing the examination and receiving a credential are separate: PECB must approve the application. Maintenance depends on the credential awarded; Provisional credentials and Foundation certificates are exempt from CPD and maintenance fees. Check the current PECB policy for other credentials.
Can my company get certified to ISO 27701, or only individuals?
PECB credential ladder: Provisional Implementer (no experience) → Implementer (2 years, 1 in privacy management, 200 hours) → Lead Implementer (5 years, 2 in privacy management, 300 hours) → Senior Lead Implementer (10 years, 7 in privacy management, 1,000 hours). Above these sits PECB Certified ISO/IEC 27701 Master, which requires 20 years of professional experience with 10 in a leadership role, 5,000 hours of combined audit and project activity, and passing both the ISO/IEC 27701 and Lead Auditor exams. All tiers require signing the PECB Code of Ethics. Provisional credentials are exempt from maintenance; other tiers follow the applicable CPD and fee requirements. Passing the examination and receiving a credential are separate: PECB must approve the application. Maintenance depends on the credential awarded; Provisional credentials and Foundation certificates are exempt from CPD and maintenance fees. Check the current PECB policy for other credentials.
Are we a PII controller or a PII processor?
Assess the role per processing activity; do not assume every organisation is both. You are a controller for your own employee records, recruitment and marketing — you decide why that information is processed. Where you process data on another party’s documented instructions, evaluate whether the processor role applies to that activity. The determination selects which Annex A table applies: Table A.1 for controllers (31 controls), Table A.2 for processors (18), and Table A.3 shared security controls (29) which apply either way.
More practitioner guides in the Aegentra Insights library.