ISO 27001 vs GDPR: a security standard and a law

ISO/IEC 27001 sets requirements for an ISMS: how you decide which information security risks matter, how you treat them and how you keep the system working.

Clauses 4 to 10 cover the management system, including risk assessment, internal audit and management review. Annex A contains controls such as A.5.15 for access control. You decide which controls apply and record that in a Statement of Applicability.

Certification is optional. If you want a certificate, a certification body audits your ISMS against the standard.

The EU GDPR sets requirements for handling personal data. These include principles under Art. 5, lawful processing under Art. 6, data subject rights under Art. 12 to 21, processors under Art. 28, security of processing under Art. 32 and personal data breaches under Art. 33.

Other requirements apply in particular situations, such as a data protection impact assessment under Art. 35 or a data protection officer under Art. 37 to 39. You and your legal adviser decide what applies to your organisation.

The UK GDPR is the GDPR as kept in UK law after Brexit, read together with the Data Protection Act 2018. EU GDPR and UK GDPR are separate frameworks in Compliance. You adopt the one that applies to you, or both.

• ISO 27001 is a standard you can choose to certify against. The GDPR is law where it applies to you.
• ISO 27001 asks for an information security management system. The GDPR covers more than security, such as lawful processing, data subject rights and processor obligations.
• An ISO 27001 certificate follows an audit of your ISMS against that standard. It does not by itself show that your processing meets the GDPR.
• Work on access control and information security can support both. It does not replace checking the GDPR requirements that apply to you.

Start with the GDPR requirements that apply to your organisation, because they are legal obligations. Work through them with your legal adviser rather than treating an ISO 27001 certificate as the answer.

If you want a certifiable information security management system, use ISO 27001 to organise that work. If you already run an ISMS, reuse the records that can support GDPR requirements and check what is still open.

You can run ISO 27001 and GDPR work from the same records where requirements are related. An access control policy and its supporting evidence can be evidence for requirements in both. Evidence and findings can meet requirements in several frameworks.

An audit still covers one standard. Your ISO 27001 auditor decides what to accept for ISO 27001. You and your legal adviser still assess what the GDPR asks of your organisation. Shared records do not turn an ISO 27001 audit into a GDPR compliance decision.

Compliance by mvdmio has catalogs for ISO 27001:2022, EU GDPR and UK GDPR. Crosswalk mappings link related requirements across the frameworks you adopt. Each link has an app label: Equivalent, Partial or Related.

• The crosswalk marks GDPR Art. 32 as Partial to ISO 27001 A.5.34 on privacy and protection of personal data.
• It marks GDPR Art. 28 on processors as Related to ISO 27001 supplier controls A.5.19, A.5.20 and A.5.22.

One access control record can meet requirements in GDPR Art. 32, ISO 27001 A.5.15 and SOC 2 CC6.1. The crosswalk marks A.5.15 as Equivalent to CC6.1. It marks Art. 32 as Related to each of them.

Each framework shows what is satisfied and what is still open. Proposed coverage suggests coverage from the crosswalk once you cover a source requirement. You accept or dismiss each suggestion. Compliance applies none of them on its own.

For personal data breaches under Art. 33, you record when you became aware of the breach and when you reported it to the supervisory authority. The incident shows a 72 hour breach clock and warns you when the report is overdue. You make the report yourself. You can also mark suppliers that process personal data. The default supplier review checks the processor contract under Art. 28(3).

Compliance doesn't certify you or decide whether your processing meets the GDPR. Coverage is your working record of requirements and supporting evidence.

Compliance doesn't connect to your cloud, identity or HR systems to collect evidence. You attach evidence to tasks yourself, or build your own sync through the REST API, the MCP server or the CLI.

More detail on each framework: ISO 27001 in Compliance and GDPR in Compliance.

ISO 27001 is €999 per framework per year, excl. VAT.

The EU GDPR is €199 per framework per year, excl. VAT. The UK GDPR is a separate framework at the same price. Each includes $5 of AI credit per year, billed in USD, and you can buy extra credits. Users in your organisation are unlimited.

You pay for each framework you adopt separately.

Try Compliance for 30 days without a credit card. The trial gives you full access to every framework. The AI assistant is not part of the trial unless you buy AI credits.

Used at Jewel Software, where Michiel van der Meer is Tech Lead. He built Compliance after taking over an ISMS there and seeing how much hand-work it took.