Quick answer. ISO 27001 is an information security management system standard. GDPR is a personal data protection regulation. They overlap on security controls (Article 32 GDPR maps to Annex A of ISO 27001) but diverge on data subject rights, lawful basis, breach notification, international transfers, and DPO obligations. ISO 27001 alone does not satisfy GDPR. The complementary standard for GDPR is ISO 27701 (privacy information management), which extends ISO 27001 to cover privacy.
ISO 27001 certification is increasingly required by enterprise customers — and increasingly cited by vendors as evidence of GDPR compliance. The two are related but not equivalent. A company that is ISO 27001 certified can fail a GDPR audit; a GDPR-compliant company may not satisfy ISO 27001 requirements.
Key takeaways
- ISO 27001 covers information security; GDPR covers personal data protection. Different scopes.
- The overlap is about 60% — primarily on Article 32 GDPR (security of processing).
- GDPR-specific obligations NOT covered by ISO 27001: lawful basis, data subject rights, DPIA, breach notification to DPA, international transfers, DPO designation, ROPA, transparency.
- ISO 27701 extends ISO 27001 to cover privacy and is the natural complement for GDPR.
- ISO 27001 certification is not a defense against GDPR enforcement — it is one factor among many.
1. What ISO 27001 actually covers
ISO 27001 is the international standard for an Information Security Management System (ISMS). Certification requires:
- A defined ISMS scope
- A documented risk assessment methodology
- A statement of applicability listing which Annex A controls apply
- Implementation of selected controls (Annex A 2022 has 93 controls in 4 categories: organizational, people, physical, technological)
- Internal audit program
- Management review
- Continuous improvement
Annex A 2022 covers:
- Organizational controls (37): policies, roles, segregation of duties, supplier relationships
- People controls (8): screening, terms of employment, awareness, disciplinary process
- Physical controls (14): perimeters, secure areas, equipment protection
- Technological controls (34): access control, cryptography, secure development, network security, monitoring
Certification is by an accredited body (BSI, DNV, TÜV, Bureau Veritas, etc.) with surveillance audits each year and recertification every 3 years.
2. What GDPR covers (that ISO 27001 doesn’t)
GDPR has 99 articles and addresses:
| Topic | GDPR Article(s) | ISO 27001 coverage |
|---|---|---|
| Lawful basis for processing | 6, 9 | None |
| Transparency / privacy notice | 13, 14 | None |
| Data subject rights | 12-23 | None |
| Right of access | 15 | None |
| Right to erasure | 17 | Partial (data deletion = A.8.10) |
| Right to data portability | 20 | None |
| Right to object | 21 | None |
| DPIA | 35 | None |
| Prior consultation | 36 | None |
| DPO designation and tasks | 37-39 | None |
| Records of processing (ROPA) | 30 | None |
| Personal data breach notification (72h) | 33 | Partial (incident management = A.5.24-26) |
| Communication to data subjects | 34 | None |
| International transfers | 44-50 | None |
| Joint controllership agreement | 26 | None |
| Sub-processor authorization | 28 | None |
| Security of processing | 32 | Strong overlap with Annex A |
| Pseudonymization, encryption | 32(1)(a) | Annex A 8.24, 8.25 |
| Confidentiality, integrity, availability | 32(1)(b) | Annex A.5.1 |
| Restoration after incident | 32(1)© | Annex A.8.13, 8.14 |
| Testing and evaluating effectiveness | 32(1)(d) | Annex A.8.29 |
ISO 27001 strongly covers security of processing (GDPR Article 32) and incident management (GDPR Articles 33-34, partially). It does not address the rest of the GDPR.
3. ISO 27701 — the privacy extension
ISO 27701 is an extension of ISO 27001 specifically for Privacy Information Management Systems (PIMS). Published 2019, it adds:
- Controls for controllers (Annex A): privacy notice, consent, data subject rights, etc.
- Controls for processors (Annex B): contract terms, sub-processor management, etc.
- Mapping to GDPR Articles
For an ISO 27001 certified organization, adding ISO 27701 covers most of the GDPR-specific operational requirements. It does not, however, replace the legal interpretation work (lawful basis selection, DPIA judgment calls, transfer mechanism choice).
ISO 27701 + ISO 27001 = approximately 80-90% of GDPR operational compliance. The remaining 10-20% is legal interpretation that requires a DPO or external counsel.
4. Where ISO 27001 alone is insufficient
A vendor that says “we’re ISO 27001 certified, so we’re GDPR compliant” is wrong. The certification covers security, not privacy. Specific gaps:
Lawful basis
ISO 27001 does not require the controller to identify and document a lawful basis under Article 6 GDPR. A vendor processing data without a valid lawful basis can be ISO 27001 certified.
Data subject rights
ISO 27001 does not require a process for handling access requests, erasure requests, etc. A vendor with a perfect Annex A implementation can still violate GDPR by failing to honor a data subject request within the 30-day window.
Breach notification to authority
ISO 27001 covers incident management. GDPR Article 33 requires notification to the supervisory authority within 72h. ISO 27001 doesn’t specify this timeline or the authority.
5. Combining ISO 27001 + GDPR + ISO 27701
For an organization pursuing all three:
Single ISMS scope
Define the ISMS scope to cover all systems processing personal data. This makes the ISO 27001 controls automatically apply to GDPR security obligations.
Integrated risk assessment
The ISO 27001 risk assessment can include privacy risks (impact on data subjects), making it serve double duty for GDPR DPIAs. EDPB guidance supports this integration.
Combined Statement of Applicability
The Statement of Applicability for ISO 27001 + ISO 27701 covers Annex A (security), Annex A privacy controls (controllers), and Annex B privacy controls (processors). One document, comprehensive coverage.
Unified audit cycle
External certification audit can cover ISO 27001 + ISO 27701 simultaneously. Annual surveillance audits track both standards.
DPO + CISO coordination
The DPO (legal/privacy lens) and CISO (security/risk lens) collaborate on the integrated program. In smaller organizations, one person may hold both roles.
6. Practical case: SaaS vendor
A SaaS vendor selling to EU customers needs:
- ISO 27001 for enterprise customer requirements (security baseline)
- ISO 27701 for privacy compliance demonstration
- GDPR-specific activities not covered by either:
- Public privacy policy
- Lawful basis documentation per processing
- DPA template offered to customers (controller-processor contract)
- DSR handling process (specific to GDPR rights)
- DPIA for high-risk features
- Breach notification process aligned with 72h
- International transfer documentation (SCCs + TIA)
Total program cost: ISO 27001 + 27701 certification ~€30K-€80K initial + €15K-€30K/year. GDPR-specific overlay: ~€20K-€50K initial + €10K-€20K/year.
7. ISO 27001 in vendor due diligence
When auditing a vendor for GDPR compliance (Article 28 audit), ISO 27001 certification is a strong signal but not a complete answer. The audit should still verify:
- Signed DPA conforming to Article 28(3)
- Sub-processor list available and update process operating
- Cross-border transfer mechanism for any non-adequate destination
- DSR assistance process (how the vendor helps you respond to user requests)
- Breach notification SLA (typically 24-48h to controller)
- Right to audit clause exercised at least with a SOC 2 Type II or ISO 27701 report
8. Tooling
Official sources: Article 32 of Regulation (EU) 2016/679 (security of processing) on EUR-Lex, the EDPB guidelines register, and the ICO guidance on security.
Conclusion
ISO 27001 and GDPR are complementary, not equivalent. A vendor or department citing ISO 27001 as proof of GDPR compliance has misunderstood both standards. The right path: maintain ISO 27001 for security, add ISO 27701 for privacy operations, and overlay the GDPR-specific legal work that no certification can replace.
FAQ
Does ISO 27001 certification mean my vendor is GDPR compliant?
No. ISO 27001 covers information security but not the GDPR-specific obligations: lawful basis, data subject rights, DPIA, breach notification to authority, international transfers, DPO designation, ROPA. A certified vendor can still violate GDPR.
Should I get ISO 27001 or focus on GDPR?
Both, but in the right order. If you’re an SMB with limited resources, GDPR compliance is legally mandatory; ISO 27001 is commercial. Start with GDPR (mandatory legal exposure), then add ISO 27001 if customers require it. Larger organizations typically pursue both in parallel.
What’s the difference between ISO 27001 and ISO 27701?
ISO 27001 covers information security management. ISO 27701 extends ISO 27001 with privacy-specific controls aligned with GDPR (and other privacy laws). ISO 27701 is the natural complement to ISO 27001 for organizations processing personal data.
Can ISO 27001 controls satisfy GDPR Article 32?
Yes, largely. Annex A controls in ISO 27001 (especially the 8.x technological controls) map well to GDPR Article 32 requirements (encryption, integrity, availability, restoration, testing). This is the primary overlap between the two standards.
How long does ISO 27001 certification take?
For a 50-200 employee company: 6-12 months from project kickoff to initial certification. Includes risk assessment, control implementation, internal audit, and Stage 1 + Stage 2 external audits. Annual surveillance audits and recertification every 3 years.