1. Certification application & application review

The organization contacts GIC Vietnam and provides information on the proposed PIMS certification scope; its role as a PII controller, PII processor or both for each activity, product or service; categories of PII principals and PII; the purposes, volume, complexity and jurisdictions of processing; locations, personnel, platforms, transfer flows, suppliers and subcontracted PII processors; the information security programme; and applicable legal, regulatory and contractual requirements. GIC Vietnam reviews the application to confirm its competence, the scope, audit method and audit time in accordance with ISO/IEC 27706:2025, after which the certification fee and contract are agreed.

2. Audit planning & preparation

GIC Vietnam establishes the certification programme and appoints an audit team with appropriate competence in PIMS, privacy risk management, applicable legislation, PII controller and processor roles, and the technologies within the scope. The audit plan defines the objectives, criteria, scope, locations, schedule, on-site or remote methods and activities to be sampled. Audit time is determined according to the number of people involved in processing or accessing PII and adjusted for the complexity, types and volume of PII, number of activities, platforms, locations, jurisdictions and transfer flows. Records, evidence and PII accessed during certification are handled in accordance with confidentiality requirements.

3. Audit process

The initial certification audit is conducted in two stages:

• Stage 1: Review the PIMS design and documented information, organizational context, scope, organizational roles, privacy policy and objectives, risk assessment and treatment methods, information security programme, Statement of Applicability, controls for PII controllers and processors, internal audits and management review; determine readiness and plan Stage 2.
• Stage 2: Evaluate the implementation and operational effectiveness of the PIMS. Audit samples may cover processing purposes and lawful bases; consent management; privacy impact assessments; fulfilment of PII principal rights; privacy by design and by default; PII minimization, quality, retention and disposal; contracts, subcontracted PII processors and cross-border transfers; incident and PII breach management; information security controls; monitoring, measurement and improvement. The main sequence is: Opening meeting → Interviews → Records review → Sampling of processes, systems and controls → Consolidation of findings → Closing meeting.

4. Audit report & nonconformity management

The audit team prepares a report with sufficient detail to support the certification decision. The report addresses privacy risk assessment, the organization's roles, the control set used, the version of the Statement of Applicability, significant audit trails and samples, conclusions, and any nonconformities. The organization takes immediate correction where necessary, analyses causes, and determines and implements corrective actions within the specified time frame. GIC Vietnam reviews the adequacy and effectiveness of corrective-action evidence and may conduct an additional audit before submitting the file for certification review.

5. Review & certification decision

The reviewer and certification decision-maker, who are independent of the audit team, review the complete file, report and corrective-action evidence. When all requirements are met, GIC Vietnam issues an ISO/IEC 27701:2025 certificate whose scope clearly identifies the Privacy Information Management System; the organization's role for each activity, product or service; the relevant categories of PII principals; and the version of the Statement of Applicability. Where all in-scope activities are performed remotely with no identifiable physical location, this information is reflected in the certification documents. The certificate remains valid for a three-year certification cycle, provided that the organization maintains conformity and completes surveillance audits.

6. Surveillance and recertification

During the certification cycle, GIC Vietnam conducts surveillance audits to confirm that the PIMS continues to be maintained and remains effective. At a minimum, surveillance reviews PIMS effectiveness in relation to its objectives, privacy risk assessment and treatment, maintenance of controls, changes to the Statement of Applicability, internal audits, management reviews, corrective actions and evaluations of compliance with applicable legal requirements. The first surveillance audit is conducted no later than 12 months from the initial certification decision date. The organization must notify GIC Vietnam of significant changes to the scope, roles, processing activities, locations, platforms, suppliers, jurisdictions, or serious incidents. Before the certificate expires, a recertification audit is conducted for the next certification cycle.