ISO 27001 and Data Protection: GDPR, TOMs and Evidence

ISO 27001 supports data protection, but an organisation is not automatically GDPR compliant because it has a certificate. Your ISMS helps you manage security risks and demonstrate technical and organisational measures (TOMs). Lawful processing, individual rights and the assessment of each processing activity still need attention.

At a glance: ISO 27001 and data protection

• Reuse suitable work: Permission reviews, security measures, incident procedures and evidence.
• Check privacy separately: Purpose, lawful basis, retention, processing records and risks to individuals.
• Make it actionable: Record which measure applies to each relevant processing activity, who owns it and when its effectiveness will be checked.

The eight recommendations below form a practical plan. For a starting point, read what an ISMS is. Our ISO 27001 certification guide explains the certification journey.

Updated: 13 October 2026. Based on ISO/IEC information and European Data Protection Board (EDPB) guidance. The mapping table and example are our own working aids.

Where ISO 27001 and the GDPR overlap

The main shared area of work is security of processing under Article 32 GDPR. An ISMS provides a framework of risks, measures and regular evaluation. Appropriate TOMs depend on the processing activity and risks to individuals' rights and freedoms.

ISO 27001 considers information within the ISMS scope, including trade secrets or design data. The GDPR regulates personal data within its legal scope. A secure process can therefore support both, while requiring assessment from both perspectives.

Which ISO 27001 controls support TOMs?

This selection is not an exhaustive mapping or proof of compliance. References relate to Annex A of the 2022 edition; ISO 27002 provides implementation guidance. The GDPR connection is our professional interpretation.

ISO 27001 reference	Privacy question	Example evidence
A.5.18 · Permission management	Who may see the data?	Reviewed roles and permissions
A.8.24 · Cryptographic protection	How are transmission and storage protected?	Configuration and key-management plan
A.8.13 · Backup arrangements	Can data be restored after an outage?	A recovery-test record
A.5.19 / A.5.20 · Supplier security	What security must the processor provide?	Contract, TOMs and recorded review
A.8.10 · Data deletion	Is data removed when its retention period ends?	Deletion rule and checked execution
A.5.34 · Privacy requirements	Which legal duties need attention?	Ownership and reviewed privacy requirements

Important: An asset register does not replace a record of processing activities (RoPA). It can provide information about systems. The RoPA describes processing activities, their purposes, data categories and other legally required details.

Our ISO 27001 vs. GDPR comparison (in German) covers the wider differences. This article focuses on making existing security work useful for privacy management.

Where the requirements differ

Information security and data protection are connected but not identical. Even securely encrypted data may be processed unlawfully without an appropriate legal basis.

Alongside ISMS work, check in particular:

• Purpose, lawful basis and transparency obligations for each processing activity.
• Records of processing activities under Article 30, where required.
• Individual rights, including access, rectification and erasure. Our DSAR guide covers request handling.
• Data protection impact assessment (DPIA) where processing is likely to result in high risk.
• Processing by suppliers and data transfers, including their legal conditions.

ISO 27001 considers legal requirements, and A.5.34 explicitly addresses privacy. This does not mean that an ISO certificate confirms fulfilment of every GDPR obligation in practice.

Is ISO 27001 a data protection certification under Article 42?

An ISO 27001 certificate is not automatically a certification under Article 42 GDPR. The approved criteria and certification scope matter. Such mechanisms exist: the EDPB register includes Europrivacy, for example. Check which processing operations are actually assessed.

Eight recommendations: using ISO 27001 for data protection

1. Use a shared risk process

Reuse existing ISMS information and ownership. Distinguish risk to the organisation from consequences for individuals. A data loss may be manageable for the business while having serious consequences for a person.

In practice: Document both perspectives and the resulting measures. A privacy tag alone is insufficient. Assess the need for a DPIA separately.

2. Use access controls as TOMs

Decide who needs which personal data for their work. Apply least privilege, MFA for suitable systems and removal of access that is no longer needed.

• Review access when someone joins, changes role or leaves.
• Schedule further reviews according to risk, rather than treating an annual interval as a universal requirement.
• Record who checked permissions and what changes they requested.

Evidence: A current role model with a documented review is more useful than an unexplained screenshot.

3. Encryption at rest and in transit

Assess protection during transmission, storage and in backups. Record where TLS or storage encryption is used and who manages the keys. Whether additional pseudonymisation is useful depends on purpose and risk.

Evidence: Keep configuration, ownership and verification together. Encryption or pseudonymisation does not by itself make data anonymous; personal data must still be treated accordingly.

4. Build a reliable incident response process

A security incident may also be a personal data breach. Establish a shared reporting channel and clear ownership, then distinguish the required decisions:

• Supervisory authority: Under Article 33, notify without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in risk to rights and freedoms.
• Affected individuals: Generally communicate without undue delay where high risk is likely; Article 34 provides exceptions. There is no universal 72-hour deadline for this communication.
• Processor: Inform the controller without undue delay.

Evidence: Record awareness, risk assessment and decisions even where no authority notification is made. The EDPB breach guide explains these distinctions. Rehearse the process and keep contacts current.

5. Manage suppliers consistently

A provider's ISO certificate is one piece of evidence, rather than a replacement for your review. Establish its role, services and the data involved. Check whether the certification scope covers the service you use.

For a processor, examine the contract, TOMs, subprocessors and notification channels. Plan reviews based on risk and relevant changes.

Evidence: Connect supplier reviews with outstanding measures. A question about deletion arrangements should not disappear in an email thread. Explore our third-party risk management page.

6. Invest in employee awareness

People need understandable guidance and an accessible reporting channel. Combine privacy and security training where appropriate, while using role-specific examples: applications in HR, customer data in sales or test data in engineering.

Evidence: Record content, participation and follow-up questions. Set repetition and exercises according to need. Article 32 does not establish a universal annual training requirement for every topic.

7. Document what matters

Keep using suitable policies, TOM descriptions, training records and incident files. Make their scope and currency visible. The Statement of Applicability and RoPA are different records with distinct purposes.

Practical check: Is evidence associated with the processing activity, measure and owner? Is it current? Does it show intent or actual implementation? A document list alone guarantees neither audit success nor GDPR compliance.

8. Clarify roles, especially for privacy

Identify who owns processing activities, security measures and privacy decisions. Involve the data protection officer where one must be appointed. Their advice and monitoring do not replace the organisation's responsibility.

In practice: Define how IT, ISMS owners and privacy specialists work together. For new suppliers or incidents, it should be clear who decides, who implements and who reviews.

Practical example: one HR provider, two assessments

Fictional example: A company uses an external recruitment service. The ISMS team checks access and availability. The privacy team checks purpose, lawful basis, retention and the processing arrangement, among other matters.

The shared working basis could look like this:

Work item	Shared foundation	Additional privacy assessment
Processing / asset	Service, data flow and ownership	Purpose, lawful basis and RoPA information
Supplier	Service scope and security evidence	Processing contract, subprocessors and transfers
Risk	Unauthorised access or outage	Consequences for applicants; DPIA assessment
Measure	Permission review and deletion task with owners	Appropriate retention and legal exceptions
Evidence	Record, outcome and next review date	Reasoning from the privacy perspective

The team maintains a shared result without treating the two assessments as identical. A new requirement becomes a specific task with ownership and evidence. This is the value of connected GRC work.

When ISO 27701:2025 is worth considering

ISO/IEC 27701:2025 describes a privacy information management system (PIMS). The current edition is independent and can be integrated with an ISMS. It supports organised privacy management and evidence; legal requirements still need assessment.

Consider it when you need to manage privacy across many processing activities or demonstrate your handling of personal data to customers. ISO 27701 certification is not automatically a certification under Article 42 GDPR.

Source: ISO on ISO/IEC 27701:2025. Our ISO 27001 vs. ISO 27701 comparison (in German) explains the differences.

Putting it into practice with Kopexa

Kopexa is a GRC platform. You can organise ISO 27001 and privacy work alongside processing activities, suppliers, risks, policies and tasks in one system. Evidence stays with the work that needs it.

For example, a missing supplier document gets an owner and deadline, or a review leads to a new measure. Mapping work to several requirements helps maintain visibility. Whether a measure is sufficient requires professional assessment.

Explore the ISO 27001 hub, certification guide or our ISMS software. For privacy work, see processing activities and data subject requests.

Your next step

Three starting points are useful:

1. Privacy is organised, but an ISMS is missing: Use existing TOMs and supplier reviews as a starting point. Add the ISMS scope and other information risks.
2. An ISMS exists, but privacy gaps remain: Check lawful bases, RoPA, individual rights and DPIA needs first.
3. Both operate in parallel: Select one processing activity and connect risks, measures, ownership and evidence. Apply the tested approach to further processes.

For a guided tour of this shared work: request a demo. Find other contact options on our contact page.