Plenty of companies treat an ISO 27001 certificate as proof of GDPR compliance. It is not. The two frameworks overlap heavily, but they answer different questions, and the gap between them is exactly where regulators tend to look.
ISO 27001 tells you how to build a defensible security program.
GDPR tells you what the law expects when that program touches personal data.
Run one without understanding the other, and you will either over-engineer security you do not strictly need, or miss privacy obligations that carry real financial exposure.
This article maps where ISO 27001 and GDPR meet, where they part ways, and how to run them as a single coordinated effort rather than two competing projects.
What Is ISO 27001?
ISO/IEC 27001 is the international standard for an Information Security Management System, or ISMS. The current edition is ISO 27001:2022. It is not a checklist of technical fixes. It is a management framework: a structured, repeatable way to identify information security risks, decide how to treat them, document those decisions, and improve over time.
Clauses 4 to 10 of the standard define the mandatory ISMS requirements, covering leadership, risk assessment, internal audit, and management review. Annex A then lists 93 controls grouped into four themes: organisational, people, physical, and technological.
You do not implement all 93 by default. You select the controls that address your assessed risks and justify your choices in a document called the Statement of Applicability. Certification against ISO 27001 is voluntary and is granted by an accredited third-party body after an audit.
What Is GDPR?
The General Data Protection Regulation is European Union law. It has been applied since 25 May 2018, and it applies to any organisation that processes the personal data of people in the EU, wherever that organisation is based.
GDPR is fundamentally about the rights of individuals, not just the security of data. It grants people rights over their personal data, including access, correction, erasure and portability. It places obligations on the organisations that decide how data is used (controllers) and those that process it on their behalf (processors).
It requires a lawful basis for every processing activity, mandates breach notification, and demands transparency about what happens to people’s information. You do not implement GDPR and receive a certificate. You obey it, and a regulator decides whether you have.
Key Differences Between ISO 27001 and GDPR
Scope and Purpose
ISO 27001 protects all information assets an organisation holds: intellectual property, financial records, operational data, source code and, yes, personal data. Its purpose is the confidentiality, integrity and availability of information in general. GDPR is narrower in one sense and broader in another. It covers only personal data of individuals in the EU, but it protects the person behind the data, not merely the data itself. A system can be flawlessly secure and still violate GDPR.
Legal Obligation vs. Voluntary Certification
This is the difference that catches people out. GDPR is binding law. If you process EU personal data, compliance is not optional, and there is no opting out. ISO 27001 is a voluntary standard. Organisations pursue it for assurance, for competitive advantage, and because customers increasingly demand it. Crucially, there is no such thing as a GDPR certificate. Regulators assess compliance through investigation and enforcement, not through a badge you can display.
Penalties for Non-Compliance
GDPR fines run on two tiers under Article 83. Less severe infringements — such as failures around records of processing or breach notification — can reach €10 million or 2% of global annual turnover, whichever is higher. The more serious tier, covering breaches of the core processing principles and data subject rights, can reach €20 million or 4% of global annual turnover. Failing an ISO 27001 audit carries no legal fine at all. The consequence is commercial: you do not get the certificate, or you lose it, and that can cost you contracts.
How ISO 27001 and GDPR Align
Despite their different purposes, the two frameworks were built on compatible logic, which is why running them together works.
Both treat information security as central.
GDPR Article 32 requires “appropriate technical and organisational measures” to secure personal data. That phrasing is almost a direct description of what an ISO 27001 ISMS produces. The controls an organisation selects for confidentiality and access already serve the regulation’s security expectations.
Both are risk-based.
ISO 27001 starts every control decision from a risk assessment. GDPR expects the same proportionality: the measures you apply should match the sensitivity of the data and the likelihood and severity of harm. One risk methodology can serve both, provided you assess personal data processing risks alongside broader security risks.
Both demand incident response.
ISO 27001’s incident management controls require organisations to detect, assess and respond to security events. GDPR Article 33 requires notifying the supervisory authority of a personal data breach within 72 hours of becoming aware of it. The ISO process is the engine that makes the GDPR deadline achievable.
How ISO 27001 Can Help You Comply With GDPR
Four areas of an ISMS do direct, practical work toward GDPR compliance.
Asset management.
ISO 27001 requires an inventory of information and associated assets, with owners assigned. You cannot protect personal data, respond to access requests, or maintain records of processing if you do not know where that data lives. The asset inventory is the foundation for both frameworks.
Access control.
Identity management, privileged access controls and the principle of least privilege limit who can see personal data. That directly supports the GDPR requirement to ensure confidentiality and to prevent unauthorised access.
Operational security.
Logging, malware protection, backup and secure configuration keep personal data accurate, available and resistant to compromise. These map cleanly onto the integrity and availability expectations in Article 32. Techniques such as data masking for GDPR and ISO 27001 also sit within this space, reducing exposure without sacrificing operational utility.
Incident management.
A defined process for detecting and handling security events gives you the evidence trail and the response capability you need to meet breach notification obligations and to demonstrate you took the breach seriously.
Does ISO 27001 Certification Mean You Are GDPR Compliant?
No. This is the single most expensive misconception in this area. ISO 27001 builds strong security, and security is one part of GDPR.
It does not address lawful basis for processing, consent management, transparency notices, the handling of data subject rights such as access and erasure, data protection impact assessments, the appointment of a Data Protection Officer where required, or the legal mechanisms for transferring data outside the EU.
A certified ISMS can sit on top of processing that is entirely unlawful. It is also one of the most common pitfalls organisations encounter with ISO 27001 — assuming the certificate does more than it actually does.
GDPR Principles and How ISO 27001 Supports Them
Article 5 of GDPR sets out seven principles for processing personal data. Looking at each one shows precisely where ISO 27001 carries weight and where it leaves you exposed.
Lawfulness, fairness and transparency requires a valid legal basis for processing and clear communication with individuals about it. ISO 27001 barely touches this. It is almost entirely privacy work.
Purpose limitation means data collected for one purpose should not be repurposed incompatibly. ISO 27001 does not govern why you collect data, so it offers little here.
Data minimisation calls for collecting only what you need. ISO 27001 will secure whatever you hold, but it does not tell you to hold less. The principle is a privacy and design decision.
Accuracy requires personal data to be correct and current. ISO 27001’s integrity controls help protect data from unauthorised alteration — partial support — though data quality processes themselves sit outside the standard.
Storage limitation means not keeping data longer than necessary. ISO 27001 provides retention and secure deletion controls that operationalise a retention schedule, but deciding the actual retention period is a legal call.
Integrity and confidentiality — the security principle — is where ISO 27001 is at its strongest. The overlap with Article 32 is near-total. An ISMS is, in effect, a delivery mechanism for this principle.
Accountability requires you to demonstrate compliance, not just achieve it. Here, ISO 27001 is genuinely powerful: its documented policies, risk registers, internal audits and management reviews produce exactly the kind of evidence the accountability principle demands.
The pattern is clear. ISO 27001 supports the last two principles strongly and the rest partially or barely. Everything that is distinctly about privacy still needs dedicated work.
Control Mapping: ISO 27001 Annex A vs. GDPR
GDPR states what you must achieve. ISO 27001 Annex A offers a practical set of controls for how to achieve the security-related parts of it. The table below maps common GDPR requirements to the ISO 27001 controls that support them.
| GDPR Requirement | Relevant ISO 27001 Annex A Controls | Coverage |
|---|---|---|
| Article 32 — Security of processing | A.8.1 User endpoint devices, A.8.3 Information access restriction, A.8.5 Secure authentication, A.8.24 Use of cryptography | Strong |
| Article 33 — Breach notification (72-hour rule) | A.5.24 Information security incident management planning, A.5.25 Assessment of information security events, A.5.26 Response to information security incidents | Strong |
| Article 30 — Records of processing activities | A.5.9 Inventory of information and other associated assets, A.5.10 Acceptable use of information | Partial |
| Article 25 — Data protection by design and by default | A.8.25 Secure development life cycle, A.8.27 Secure system architecture and engineering principles | Partial |
| Article 28 — Processor obligations | A.5.19 Information security in supplier relationships, A.5.20 Addressing information security within supplier agreements | Partial |
| Article 17 — Right to erasure | A.8.10 Information deletion | Partial |
| Article 6 — Lawful basis for processing | None directly applicable | Not covered |
| Articles 13–14 — Transparency and privacy notices | None directly applicable | Not covered |
| Article 35 — Data protection impact assessment | None directly applicable (risk assessment methodology can inform a DPIA) | Not covered |
A mapping like this is worth building for your own environment. It shows teams which work serves both objectives and prevents the duplication that comes from treating the two programmes as unrelated. An ISO 27001 gap analysis is the natural starting point: it tells you where your ISMS controls already satisfy GDPR expectations and where the gaps are large enough to require separate privacy work.
Why Technical Measures Alone Are Not Enough for GDPR Compliance
Article 32 deliberately requires technical “and organisational” measures. The wording is not decorative. Encryption, firewalls and access controls reduce the risk of a breach, but they say nothing about whether you had the right to process the data in the first place.
Consider a system protected to the highest technical standard that processes personal data with no lawful basis, sends no transparency notice, and ignores erasure requests. Every security control could pass an audit, while the processing remains unlawful from the first record.
GDPR compliance is a governance, legal and operational discipline as much as a technical one. ISO 27001 strengthens one pillar of it. It does not replace the others.
Why You Need Both ISO 27001 and GDPR Compliance
Time and Cost Savings by Pursuing Both Together
Organisations that treat ISO 27001 and GDPR as separate, unconnected projects end up paying twice. They run two risk assessments, write two overlapping sets of policies, deliver two training programmes and maintain two toolsets. Treated together, the shared elements are done once. A single risk assessment can cover personal data processing risks and broader security risks.
Encryption, access management and logging serve certification and compliance simultaneously. The marginal cost of addressing both at once is far lower than tackling them in isolation. If you are still scoping out where to start, gap analysis services can give you a clear picture of what already maps across and what still needs attention.
Building Trust With Customers and Partners
ISO 27001 certification is recognised globally and shortens vendor due diligence: a procurement team that sees the certificate can move faster. GDPR compliance, meanwhile, is effectively table stakes for doing business involving EU data, and customers increasingly ask for evidence of it directly.
Holding both signals a mature, deliberate approach to managing information and privacy. It tells partners you treat data protection as a discipline rather than a box to tick. According to Gartner research, only a minority of customers believe organisations will handle their personal data responsibly without being asked — demonstrable compliance changes that calculation.
How to Integrate ISO 27001 and GDPR Compliance
There are three workable approaches to organising the documentation when you run both programmes.
A fully unified system merges all policies, risk registers and evidence into a single management system. This works well for smaller organisations where the security and privacy functions are not sharply separated, but it can become unwieldy as the business grows, since GDPR-specific items such as DPIAs and records of processing activities sit awkwardly inside an ISMS structure designed around information assets.
Completely separate systems keep the ISMS and the privacy management framework entirely independent, with their own documentation, risk registers and review cycles. This avoids confusion about ownership but creates real risk of duplication and drift — the two programmes can develop inconsistencies that neither team notices until an audit or investigation surfaces them.
An integrated but distinguishable structure treats the ISMS as the foundation and builds GDPR-specific documentation alongside it, with explicit cross-references where controls serve both. The same risk assessment methodology drives both; the same incident process feeds both breach response obligations. Privacy-specific obligations live in dedicated documents owned by the privacy function, but they are linked to the security controls that support them. For most organisations this is the pragmatic middle ground. You can also use compliance tools to manage the cross-framework evidence in a single platform, which reduces the administrative overhead considerably.
ISO 27701: The Privacy Extension That Bridges ISO 27001 and GDPR
If ISO 27001 covers security and GDPR covers privacy, ISO/IEC 27701 is the standard built to close the distance. It defines a Privacy Information Management System, or PIMS, and adds privacy-specific controls for organisations acting as data controllers and processors. Its annexes include a direct mapping to GDPR requirements, which makes it the closest thing to a certifiable demonstration of privacy governance.
One important development is worth knowing. ISO 27701 was first published in 2019 as an extension to ISO 27001, meaning you had to hold an ISMS before you could implement or certify it.
In October 2025, ISO published a revised edition, ISO/IEC 27701:2025, which turns it into a stand-alone standard.
Organisations can now implement and certify a privacy management system independently, without ISO 27001 as a prerequisite, with a transition deadline of October 2028 for those already certified to the 2019 version.
In practice, ISO 27701 still works best alongside ISO 27001, since privacy depends on security. It gives a structured, auditable way to address the privacy obligations that ISO 27001 leaves untouched. One caveat carries over from GDPR itself: certification to ISO 27701 supports and evidences compliance, but no certificate is a substitute for the legal assessment a regulator would make.
Frequently Asked Questions
Is ISO 27001 compliant with GDPR?
ISO 27001 is compatible with GDPR and supports many of its requirements, particularly around security of processing, access control and incident management. It is not, by itself, a complete route to GDPR compliance, because it does not address privacy-specific obligations such as lawful basis and data subject rights.
Does achieving ISO 27001 mean I am GDPR compliant?
No. Certification proves you have a working information security management system. GDPR compliance additionally requires lawful basis, transparency, consent where relevant, handling of data subject rights, data protection impact assessments and lawful international transfers. A certified ISMS covers the security pillar of GDPR, not the whole regulation.
Is GDPR an ISO standard?
No. GDPR is European Union law, enforced by national supervisory authorities. ISO standards are voluntary frameworks published by the International Organization for Standardization. They can support legal compliance, but they are not laws and cannot replace one.
Do I need both ISO 27001 and GDPR compliance for my business?
If you process personal data of individuals in the EU, GDPR compliance is legally required. ISO 27001 remains optional, but it provides the security backbone that GDPR expects and is often demanded by customers and partners. Most organisations handling EU personal data benefit from running both.
Which should be implemented first, GDPR or ISO 27001?
GDPR is the legal obligation, so its requirements cannot wait. In practice, building the ISMS first is efficient, because it produces much of the risk assessment and many of the “appropriate technical and organisational measures” GDPR requires. The pragmatic answer is to plan them together rather than strictly sequencing one before the other.
What are the penalties for non-compliance with GDPR vs. ISO 27001?
GDPR carries administrative fines of up to €10 million or 2% of global turnover for less severe breaches, and up to €20 million or 4% for serious ones, whichever is higher. ISO 27001 has no legal penalty. Failing an audit means losing or not obtaining the certificate, which is a commercial consequence rather than a fine.
What types of organisations benefit most from pursuing both ISO 27001 and GDPR compliance?
Organisations that handle significant volumes of EU personal data and that sell to security-conscious customers gain the most. Technology and SaaS providers, healthcare and financial services firms, and any processor handling data on behalf of EU clients benefit from pairing a recognised security certification with demonstrable privacy compliance.
How does ISO 27701 relate to both ISO 27001 and GDPR?
ISO 27701 defines a Privacy Information Management System and adds privacy controls that ISO 27001 does not cover, with a built-in mapping to GDPR requirements. It began as an extension to ISO 27001 and, since the 2025 revision, can be implemented and certified as a stand-alone standard. It is the most direct bridge between an ISO security programme and GDPR’s privacy obligations, though it still does not amount to legal certification of compliance.
