GDPR and ISO 27001: how to combine your efforts

In many companies, the GDPR is run by legal or the DPO, and ISO 27001 by IT or the CISO. Two teams, two spreadsheets, two risk assessments… although much of the work is shared. Here is how to bring the two approaches together without confusing their goals.

Two different logics, a common foundation

• ISO 27001 protects the organisation’s information — all information, personal or not — against breaches of confidentiality, integrity and availability.
• The GDPR protects people: it governs the lawfulness, fairness and transparency of processing, and gives rights to data subjects.

Security of processing (Article 32), breach handling (Articles 33 and 34) and the management of processors (Article 28) are the common ground. Lawful bases, information to individuals and their rights belong to the GDPR alone.

What an ISMS already brings

According to the OK-GRC catalogue mappings, ISO 27001 controls touch 33 to 55 of the 82 GDPR requirements tracked, i.e. a starting score of about 19 to 41% depending on whether a strict or broad hypothesis is used. That is significant, but it also shows that an ISO 27001 certificate is not GDPR compliance.

What the GDPR requires on top

• a documented lawful basis for each processing and, for legitimate interest, a balancing test;
• information to individuals (Articles 13 and 14);
• handling data subject requests within one month;
• the records of processing activities (Article 30);
• defined and applied retention periods;
• data protection impact assessments (DPIA) for high-risk processing;
• safeguards for transfers outside the European Union;
• where applicable, the designation of a DPO.

Seven workstreams to run only once

1. One risk method, two angles. Use the same scale and register; add risks to individuals to the risks to the organisation, which feed your DPIAs.
2. A single inventory. The ISO 27001 asset inventory and the records of processing feed each other: which applications support which processing, where data is stored, who accesses it.
3. One supplier process. The same questionnaire assesses a provider’s security and its quality as a GDPR processor; the same file keeps the contract, the data processing agreement and the data location.
4. An incident procedure with two outputs. Every security incident is qualified: is it also a personal data breach? If so, the 72-hour countdown towards the supervisory authority starts.
5. One awareness programme. An annual path can cover phishing, passwords, GDPR good practice and the use of AI.
6. One document control process. The security policy and the data protection policy follow the same drafting, approval, distribution and review workflow.
7. A shared internal audit and management review. The audit programme covers both frameworks; the management review looks at security and GDPR compliance indicators.

What about ISO 27701?

ISO/IEC 27701 is the bridge between the two worlds: it structures privacy protection as a certifiable management system. Since the 2025 edition, it can be certified on its own, but integrating it into an existing ISO 27001 ISMS is often the shortest path, because many security controls are shared.

Pitfalls to avoid

• Confusing security with lawfulness: perfectly secured processing can be unlawful if it has no lawful basis or keeps data too long.
• Excluding the Annex A “privacy” control (A.5.34) too quickly in the Statement of Applicability: it is almost always relevant.
• Leaving data subject rights out of the ISMS scope: a badly handled access request is a compliance incident.
• Presenting the ISO 27001 certificate as proof of GDPR compliance: it is evidence of security measures, nothing more.

How OK-GRC helps

In OK-GRC, the GDPR and ISO 27001 share the same common controls: one implemented control moves both scores forward. The GDPR module adds what is specific to the regulation — records, DPIA, data subject requests, breaches — and the incident register qualifies every event against both the GDPR and NIS2.