AVG and ISO 27701
ISO 27701 helps you demonstrate that you work on compliance with the Algemene Verordening Gegevensbescherming (General Data Protection Regulation, AVG) , but it is not an official AVG certificate. That is the most important point to take from this page. The standard gives you a solid, structured basis for privacy. It is not legal proof of full AVG compliance. You can find the standard itself at ISO , the legal text at EUR-Lex , and supervision sits with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) .
This page explains honestly how ISO 27701 and the AVG relate to each other. Where does the standard help, and where does that help stop? Want to know first what the standard requires? Read the ISO 27701 requirements.
ISO 27701 is not a certification within the meaning of Article 42 AVG. Such an approved AVG certification mechanism must be approved by the European Data Protection Board (EDPB), and in practice it does not yet exist. So an ISO 27701 certificate is not legal proof that you comply with the AVG.
Why is ISO 27701 not a GDPR certificate?
The AVG has its own certification mechanism. It is set out in Articles 42 and 43. The idea is that organisations can use an approved trust mark to show that they comply with the AVG. But such a trust mark must be approved by the supervisory authorities and the EDPB. So far, very few AVG certification mechanisms have been approved.
ISO 27701 is different. It is an international standard, made by ISO and IEC. Those standards bodies are not privacy supervisors. The Autoriteit Persoonsgegevens (AP) is not a party to the standard and does not approve the certificate as proof of AVG compliance.
A comparison: ISO 27701 is like a driving licence from a well-regarded driving school that is not officially recognised. You can drive with it, and it shows you know your craft. But it is not the same as the official document issued by the government.
Where does ISO 27701 help?
The AVG requires you to take “appropriate technical and organisational measures” and to be accountable. You must be able to show that you take privacy seriously. That is exactly where ISO 27701 is strong.
- Demonstrable compliance. A certificate from an independent auditor shows customers and partners that you manage privacy in a structured way.
- Structure. The standard requires you to have a processing register, risk analyses and procedures in order.
- AVG mapping. Annex D of the standard links the controls to AVG articles. If you meet a control, you work on the related AVG requirement.
- Trust in the chain. As a processor, you show your clients that you handle their data properly.
The Autoriteit Persoonsgegevens (AP) and the AVG treat security standards as evidence that you make an effort. An ISO 27701 or ISO 27001 certificate helps show that you take appropriate measures, even though it is not a legal AVG certificate.
How ISO 27701 maps to the AVG
The standard follows the logic of the AVG on many points. The table shows a few examples.
| AVG topic | How ISO 27701 covers it |
|---|---|
| Record of processing activities (art. 30) | A required overview of all processing activities |
| Rights of data subjects (art. 12-22) | Measures and procedures for access, correction and erasure |
| Data protection impact assessment (art. 35) | The privacy risk assessment from clause 6 |
| Processing agreement (art. 28) | Measures on instructions and agreements with processors |
| Reporting a data breach (art. 33-34) | Procedures for incidents involving personal data |
This alignment makes the standard valuable if you want to get your AVG house in order. The DPIA under the AVG and the privacy risk assessment of ISO 27701, for example, overlap. For how to fill in the parts from the table, read processing register with example, carrying out a DPIA and reporting a data breach to the AP.
What not to claim
Be careful with the message you send to customers. “We are AVG certified” is misleading and can lead to problems. The correct version is: “We are ISO 27701 certified, which shows we work in a structured way on privacy and the AVG.”
The AVG remains a law. Compliance means meeting all its articles, with or without a standard. ISO 27701 helps you work systematically towards that, but it does not take over your legal responsibility.
Privacy, security and AI together
The AVG also requires good security. That is where ISO 27001 comes in. If you process personal data with AI, ISO 42001 is relevant. The combination of the three standards covers security, privacy and responsible AI. You can read the difference between privacy and security at ISO 27701 vs. ISO 27001.
Next steps
Sources
- Text of the AVG (EUR-Lex) : the full regulation
- Autoriteit Persoonsgegevens : Dutch supervisory authority
- European Data Protection Board : European supervision and certification (art. 42-43)
- ISO/IEC 27701 at ISO : International Organization for Standardization