GDPR and ISO 27001: overlap, support and limits
ISO 27001 and the General Data Protection Regulation (GDPR, Algemene Verordening Gegevensbescherming) are often mentioned together. Both are about protecting information, but they are not the same. ISO 27001 certification does not give you automatic GDPR compliance, but it helps, and you can demonstrate that substantially. You can get the standard from NEN , and it works closely with the NIS2 Directive.
This article explains where the overlap is, what ISO 27001 really contributes to your GDPR file, and where the limits of the standard lie.
The GDPR accountability principle
Article 5(2) of the GDPR requires organisations to be able to demonstrate that they comply with the GDPR principles. This is called accountability. The Autoriteit Persoonsgegevens (Dutch Data Protection Authority) sees this as one of the core obligations.
ISO 27001 is one of the strongest ways to meet that accountability. It shows that you:
- Systematically identify and address information security risks
- Have taken technical and organisational measures
- Do this demonstrably through a certified system
- Ensure continuous improvement
The Autoriteit Persoonsgegevens regards ISO 27001 certification as a serious way to meet the “appropriate technical and organisational measures” in Article 32 of the GDPR.
Where ISO 27001 and the GDPR overlap
Both focus on protecting information. The table below shows which GDPR obligations ISO 27001 covers.
| GDPR obligation | Matching ISO 27001 measure |
|---|---|
| Appropriate technical and organisational measures (Art. 32) | Risk assessment + Annex A controls |
| Access security (Art. 32) | A.5.15-5.18: identity and access management |
| Encryption and pseudonymisation (Art. 32) | A.8.24: cryptography |
| Confidentiality and integrity (Art. 5) | CIA triad as the core of the ISMS |
| Reporting security incidents (Art. 33-34) | A.5.24-5.28: incident management |
| Awareness and training (Art. 39) | A.6.3: security awareness and training |
| Supplier management (processor agreements, Art. 28) | A.5.19-5.23: supplier management |
| Regular assessment (Art. 32) | Annual internal audit and management review |
An ISO 27001 certificate is not a GDPR certificate. It shows that you have set up your information security in a systematic way. When investigating, the Autoriteit Persoonsgegevens also checks whether you have met the GDPR-specific obligations.
What ISO 27001 does NOT cover
ISO 27001 focuses on information security in the broad sense, covering all information the organisation processes. The GDPR has a narrower focus: personal data. That difference means a number of GDPR obligations fall outside ISO 27001.
| GDPR obligation | Covered by ISO 27001? |
|---|---|
| Record of processing activities (Art. 30) | No, it requires specific GDPR documentation |
| Privacy notice (Art. 13-14) | No, it is communication to data subjects |
| Legal basis for processing (Art. 6) | No, it requires a legal assessment for each processing activity |
| Rights of data subjects (Art. 15-22) | No, it requires processes for access, correction and erasure |
| Data protection officer (Art. 37-39) | No, it is a role, not a system |
| Data Protection Impact Assessment, DPIA (Art. 35) | Partly, the risk analysis helps, but a DPIA is broader |
So full GDPR compliance requires more than ISO 27001. A privacy officer or lawyer can help you fill in the GDPR-specific obligations.
When is ISO 27701 a useful addition?
ISO 27701 is the privacy extension to ISO 27001. It adds a Privacy Information Management System (PIMS) to the ISMS and offers a structured approach to meeting privacy legislation such as the GDPR. You can only implement ISO 27701 if you already have ISO 27001. It is an extension, not a replacement.
If you want certification for both information security and privacy management, the combination of ISO 27001 and ISO 27701 is the logical choice. ISO 27701 is still in preparation on this site.
ISO 27701 is for organisations that want to structure and demonstrate their privacy management, alongside their ISO 27001 certification. For most organisations, ISO 27001 is a solid basis for GDPR accountability without ISO 27701 being necessary.
In practice: how do you use ISO 27001 in your GDPR file?
During an investigation or audit by the Autoriteit Persoonsgegevens, you can present your ISO 27001 certificate as evidence of appropriate measures. Record the link explicitly:
- Link your risk assessment to personal data. In your risk register, list the risks to the confidentiality and integrity of personal data separately.
- Refer to ISMS measures in your processing register. For example: “Customer data is protected in accordance with an ISO 27001 certified ISMS.”
- Use your incident procedure for the GDPR reporting duty too. Your incident response process (A.5.24-5.28) is the starting point for the 72-hour duty to report data breaches to the AP.
- Record the link in your SoA. For relevant measures, state the GDPR legal basis.
More information
- The ISMS: The management system that forms the basis
- Annex A: The controls, including privacy-relevant controls
- NIS2 and ISO 27001: The other European compliance requirement
- ISO 42001 vs ISO 27701: If your AI systems also process personal data, AI governance and privacy overlap strongly
- Autoriteit Persoonsgegevens : The GDPR supervisory authority
- GDPR text (EUR-Lex) : The full regulation