Does an ISO 27001 certificate help with GDPR compliance?
The GDPR is binding EU law that requires appropriate security of processing under Article 32 and lets you demonstrate accountability for it. ISO/IEC 27001 is a voluntary, certifiable standard for an information security management system, and a certificate does not itself certify GDPR compliance. Picture a controller or processor holding EU customer records when a customer's procurement team or board asks whether ISO 27001 settles the question. It helps with the security part of the GDPR, because a risk-based ISMS covers much of what Article 32 expects. It does not reach the privacy duties: the record of processing activities under Article 30, DPIAs for likely high-risk processing under Article 35, lawful basis, data subject rights, and transfers under Chapter V. The GDPR requires no certificate at all, and Article 42 certification is a separate, voluntary scheme.
Pursue ISO 27001 first when the gap is security governance: no documented risk assessment, no owned set of Annex A controls, and customers asking for independent evidence in procurement. The 93 Annex A controls in four themes give your security evidence a structure. Before you buy an audit, confirm with the certification body which accreditation covers your scope and check the certificate in the IAF CertSearch database, as described on the ISO certification page. Certification runs on a three-year cycle with an audit in every calendar year, so the recurring surveillance effort matters as much as the first audit.
Start with the GDPR privacy work when the gaps are in records and rights: no record of processing, no DPIA for high-risk processing, processor contracts missing the Article 28 terms, or breach documentation under Article 33(5) that nobody owns. An ISO audit will not find those gaps, and Article 83(2)(d) weighs your measures when fines are set, so they carry real exposure. Do both when customers require an independent certificate and you process EU personal data at scale. Scope the ISMS so that personal data processing sits inside it, and link privacy records to the risk treatment plan. Ask your certification body whether privacy processes fall within scope, and ask each processor for the security measures description that Annex III of Decision (EU) 2021/915 calls for.
How the GDPR and ISO 27001 differ on scope, proof and enforcement
This table compares the GDPR and ISO/IEC 27001 on legal status, who each binds, the security duty, documentation, proof and enforcement. Read the GDPR column as what the law requires and the ISO column as what a certificate can show, then check where the two overlap.
| Factor | GDPR (Regulation (EU) 2016/679) | ISO/IEC 27001:2022 |
|---|---|---|
| Legal status | Binding EU law, binding in its entirety and directly applicable in all Member States and in Iceland, Liechtenstein and Norway | Voluntary international standard. It becomes binding only where a contract or another law requires it |
| Who it applies to | Controllers and processors handling personal data of people in scope of the Regulation | Any organization that chooses to adopt an information security management system, with scope set by the organization |
| Security requirement | Appropriate technical and organizational measures for security of processing under Article 32, weighed against risk | Requirements for assessing and treating information security risks, with Annex A controls selected through a risk process |
| Documentation duties | Record of processing (Article 30), DPIAs for likely high-risk processing (Article 35), breach documentation (Article 33(5)) and written processor contracts (Article 28) | Documented information the organization decides is needed for the ISMS to be effective, plus evidence of risk assessment and treatment |
| Proof produced | No certificate or audit is required. Article 42 certification is voluntary, lasts at most three years and does not reduce the controller's or processor's responsibility | A certificate issued by an accredited certification body after audit, with surveillance audits across a three-year cycle. Confirm the certificate scope with the certification body |
| Role of certification in compliance | Approved certification may be used to demonstrate compliance with Article 32(1) under Article 32(3). It is not a safe harbor for other GDPR duties | Certifies that the ISMS meets the standard. It does not certify privacy-specific duties such as lawful basis or data subject rights |
| Enforcement | Independent national supervisory authorities. Fines up to EUR 10 million or 2% of worldwide turnover for Articles 25 to 39 infringements, and EUR 20 million or 4% for the higher tier | No regulator. Certification bodies audit against the standard, and contracts or customers set the consequences of a lapse |
| Current edition | Regulation (EU) 2016/679 applies since 25 May 2018 and has not been amended as of October 2026 | ISO/IEC 27001:2022 (third edition, published 25 October 2022) with Amd 1:2024 on climate action changes, published 23 February 2024 |
What Article 32 and accountability ask of a controller
Article 32 requires a controller to implement appropriate technical and organizational measures for the risk its processing creates, taking into account the state of the art, costs, the nature, scope, context and purposes of processing, and the likelihood and severity of risk to individuals. The GDPR does not name a control set. It does not say which encryption, access, logging or testing measures are mandatory, so the controller has to derive them from its own risk assessment. Accountability under Article 5(2) then requires the controller to be able to demonstrate that it complies. In practice, that proof is a set of records: the record of processing activities under Article 30, data protection impact assessments for likely high-risk processing under Article 35, documentation of every personal data breach under Article 33(5), and written processor contracts under Article 28(9).
Before you buy or cite any certificate, check which of these records your team can produce on request. A supervisory authority will look for the processing inventory, the risk assessment behind the chosen measures, the DPIA outcomes and the breach register first. Confirm with your legal and privacy team whether each record is current, and whether the risk assessment links each Article 32 measure to a specific processing activity. An ISO/IEC 27001 certificate can support that work, but it does not produce these records for you.
The place where an ISO certificate can enter the file directly is the processor description. Annex III of the Commission's controller-processor clauses in Decision (EU) 2021/915 asks the processor to describe its technical and organizational security measures, including any relevant certifications. A processor holding an ISO/IEC 27001 certificate can cite it there, and you can ask for the certificate scope and the current certification status from the accredited certification body, which ISO points to through the IAF CertSearch database. Ask the processor which Annex A controls the certificate scope covers and which processing activities sit outside it. A certificate cited in Annex III is evidence of a management system, not a finding that each measure fits your processing.
Where ISO 27001 work overlaps GDPR security duties
ISO/IEC 27001 and the GDPR share a risk-based approach to information security, so much of an ISMS can produce evidence for Article 32. The overlap stops at the privacy duties an ISMS does not cover, so each card below marks where to confirm coverage against your own records.
Risk assessment and treatment
ISO/IEC 27001:2022 requires an organization to assess and treat information security risks tailored to its needs, and the standard describes the ISMS as preserving confidentiality, integrity and availability through a risk management process. Article 32 asks for security appropriate to the risk of processing. Check whether your risk register covers personal data processing activities, the risks to data subjects and the processing listed in your records of processing under Article 30, not only corporate systems.
Annex A controls mapped to Article 32
Annex A of ISO/IEC 27001:2022 is normative and lists 93 controls in four themes: organizational, people, physical and technological. Many technological and organizational controls, such as access management, cryptography, logging and backup, correspond to measures Article 32 names, including pseudonymization and encryption. Treat any mapping as your own working document. Confirm each Annex A control against the specific Article 32 measure it supports, because no official equivalence exists between the two.
Policies and management review as evidence
An ISMS produces documented policies, internal audit results and management review records. These help meet the accountability principle, because a controller must be able to demonstrate compliance. The GDPR also requires documentation of personal data breaches and processing records, which an ISMS does not create on its own. Ask whether your breach register and records of processing are maintained inside the ISMS or sit outside it.
Supplier controls for processor due diligence
Annex A includes controls for supplier relationships, which help a controller assess processors before signing written contracts under Article 28. Confirm that your supplier register records which processors handle personal data, what security terms apply and what evidence each processor can produce. The Commission's controller-processor clauses ask a processor to describe its technical and organizational measures, including any relevant certifications. A certificate describes the supplier's ISMS scope, so check that scope against the services you buy.
Cross-mapping from NIST CSF
NIST publishes informative references that map CSF 2.0 outcomes to ISO/IEC 27001:2022, and NIST says it does not check the correctness of non-NIST mappings. ENISA states that its own mapping for NIS2 is not a measure of equivalence and does not assess whether a standard fully covers a regulation. Use these mappings as a starting point for a gap review, then confirm each line against your own controls and evidence rather than accepting the mapping as proof.
Privacy duties outside the ISMS
An ISMS does not reach lawful basis, data subject rights, transparency notices, DPIAs under Article 35 or the transfer rules in Chapter V. Those duties need their own owners and records. Map each GDPR chapter to an owner before assuming the ISMS covers it, and ask your certification body which privacy processes fall outside the audited scope.
Who assesses each framework and what each one produces
This table compares who checks each framework, what document or decision comes out of that check, and how long it stays valid. Read it to see which proof a controller can show a regulator or customer, and which proof only exists if you pursue a voluntary certificate.
| Item | GDPR | ISO/IEC 27001:2022 |
|---|---|---|
| Who assesses compliance | Independent national supervisory authorities enforce the GDPR and can investigate on their own initiative or after complaints | An accredited certification body audits the ISMS against the standard; ISO itself does not certify organizations |
| Audit or certificate required | No. The GDPR requires no audit, attestation or certificate | Only if you want certification. The standard is used by many organizations without a certificate, but a certificate requires an accredited audit |
| Voluntary certification route | Article 42 certification is voluntary, issued for at most three years by accredited bodies or supervisory authorities | Certificate issued by an accredited certification body after audit, with surveillance and recertification to keep it valid |
| Validity and cycle | Article 42 certificates last at most three years; certification bodies are accredited for a maximum of five years under Article 43 | Three-year certification cycle with at least one audit in every calendar year under ISO/IEC 17021-1 |
| Effect on legal responsibility | Certification does not reduce the controller's or processor's responsibility for compliance | A certificate attests to the ISMS at audit time; it does not replace the organization's own legal duties |
| Transition deadline | Not applicable. The GDPR text has not been amended as of October 2026 | ISO/IEC 27001:2013 certificates had to expire or be withdrawn by 31 October 2025 under IAF MD 26:2023 |
| How to check a certification body | Confirm the accreditation source named in the Article 42 scheme with the relevant supervisory authority | Confirm current accreditation of the certification body in the IAF CertSearch database before relying on a certificate |
Doing both: order of work and shared evidence
This sequence starts from the personal data the organization actually processes, then builds the ISMS and control evidence around those systems so one evidence set can answer both GDPR accountability questions and ISO 27001 audit questions. Timing depends on scope and should be confirmed in writing before work starts.
Map processing activities and personal data flows
Start by listing each processing activity that involves personal data, the systems that hold it, the people and processors that touch it, and where it moves, including transfers to third countries. The controller's privacy or legal lead owns the record, with IT and business owners supplying system details. The step is done when the record of processing activities required by Article 30 is complete for in-scope activities and each system is linked to at least one activity. Ask any outside party to confirm which processing activities they handle before you rely on their description.
Run the GDPR risk assessment and DPIAs
For each processing activity, assess the risk to individuals, decide whether it is likely high risk, and carry out a data protection impact assessment under Article 35 where it is. Record the security measures chosen under Article 32, the rationale for them and the residual risk. The privacy lead and system owners sign off, and the output is a set of dated DPIAs and a risk register entry for each high-risk activity. Where a processor is involved, record the processor contract terms that bear on the same measures.
Scope the ISMS around those systems
Define the ISMS scope so it includes the systems, sites and teams identified in the processing record and DPIAs. ISO/IEC 27001:2022 requires the organization to determine the scope and the interested parties, and an ISMS that omits the systems holding personal data will not support the GDPR evidence. Leadership approves the scope statement, and the output is a documented scope that a certification body can test against the actual asset inventory. Confirm with the certification body how it will treat scope boundaries and exclusions before you finalize it.
Run the ISO risk assessment on the same assets
Perform the information security risk assessment and treatment that clause 6 of ISO/IEC 27001:2022 requires, using the same asset and system inventory as the DPIAs. Reconcile risk ratings so a risk rated high for personal data in a DPIA is not rated low in the ISMS register without a documented reason. The output is a risk treatment plan and a Statement of Applicability that lists which Annex A controls apply and why. Information security and privacy owners review the reconciliation together.
Map Annex A controls to Article 32 measures
Build one evidence set that maps each Annex A control in the Statement of Applicability to the Article 32 security measures it supports, such as encryption, access control, resilience and testing of effectiveness. Note where a GDPR measure has no Annex A control, such as lawful basis or data subject rights, and where a control serves the ISMS but not personal data protection. The output is a single cross-reference that each control owner keeps current, with evidence locations recorded once and linked from both the ISMS and the GDPR files. Treat ISO and NIST mappings as aids, and confirm each mapping with your own assessor rather than assuming it is complete.
Close GDPR-only duties outside the ISMS
Build the privacy duties that an ISMS does not reach into the same operating cycle: lawful basis records, data subject request handling, retention and deletion, the breach register under Article 33(5), notification procedures under Articles 33 and 34, and documented compelling-legitimate-interest transfers under Article 49(6) where they apply. Assign an owner for each and test the breach procedure in a tabletop exercise. The output is evidence that each duty runs, dated and linked from the shared evidence set.
Decide whether to run a certification audit
Certification is only worth pursuing if buyers, contracts or internal governance require it. If you proceed, select an accredited certification body, confirm its accreditation and the audit plan in writing, and run an internal audit and management review first. A certificate attests to the ISMS, not to GDPR compliance, and it does not reduce the controller's or processor's responsibility. The output is either a certification decision record with its reasons or a documented decision to keep the evidence set for customer and regulator requests without certification.
What drives the cost and effort of each route
The cost of the GDPR route is mostly internal time. Your legal, privacy and engineering staff maintain the record of processing activities under Article 30, run DPIAs for likely high-risk processing under Article 35, document personal data breaches under Article 33(5) and review processor contracts under Article 28. Counsel may be added for contract terms or cross-border transfers. Nothing in the Regulation requires an audit or certificate, so there is no mandatory external fee. The ISO route is different: it adds a certification body fee, internal audit time, control implementation work against Annex A, and surveillance audits in each year of the three-year cycle. Ask any certification body for a written quote that separates the initial audit, stage handling, travel, and the recurring surveillance and recertification audits, since those recur while the readiness work is largely one-time.
Four drivers move both routes up or down. The first is the number of systems in scope: an ISMS scope statement that covers every application holding personal data is more work to build and evidence than one limited to a single platform. The second is the number of processing activities and processors, because each one needs a record entry, a contract check and, for processors, evidence of their security measures. The third is existing evidence. Written policies, access reviews, and incident logs can often be reused for both routes, and that reuse is where most of the saving comes from. The fourth is whether customers require certification. If they do, the ISO route is driven by the contract, not by the GDPR, and the certificate must be checked against the IAF CertSearch database.
When you request a quote from DeployOpen, expect it to follow from a written scope that names the systems, processing activities, processors and evidence sources involved. DeployOpen does not publish a price list, and most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. Ask the team to state which items are one-time (readiness, documentation, control design) and which recur (retainers, testing, upgrades), and to identify any work that a certification body or counsel would bill separately. Confirm with your certification body how it will apply ISO/IEC 27006-1:2024 to your client set before you agree a timeline.
Questions buyers ask before choosing ISO 27001 for GDPR
Does ISO 27001 make us GDPR compliant?
No. The GDPR requires no certificate, and an ISO/IEC 27001 certificate does not establish GDPR compliance. It can support the security part of the GDPR, since Article 32 asks for security measures appropriate to the risk, and an ISMS is a reasonable way to show that those measures are managed. The GDPR also imposes duties an ISMS does not reach, including the record of processing activities under Article 30, DPIAs for likely high-risk processing under Article 35, breach documentation under Article 33(5), lawful basis, and data subject rights. Ask the certification body exactly which scope and Annex A controls it audited, and map the remaining privacy duties separately.
Can we get GDPR Article 42 certification instead?
Yes, in principle, but Article 42 certification is a different instrument. It is voluntary, issued for at most three years by accredited certification bodies or the competent supervisory authority against approved criteria, and it does not reduce the controller's or processor's responsibility. Accreditation for these bodies follows EN-ISO/IEC 17065/2012 plus the authority's additional requirements, and certifications can be valid for a maximum of five years under Article 43. ISO 27001 certification, by contrast, is issued by accredited ISMS certification bodies against a management system standard. Check which Article 42 schemes are available in your Member State before planning around one, because availability depends on approved criteria.
What does a processor need to show a controller?
A processor typically needs to show the controller a written description of its technical and organisational security measures. Annex III of the Commission's controller-processor clauses (Decision (EU) 2021/915) asks for that description and for any relevant certifications. Under Article 28, the processor contract must also set out the processing terms, and the processor must support the controller's obligations. An ISO 27001 certificate can be one item in that evidence pack, along with a statement of applicability, the scope, and the processor's own breach and sub-processor procedures. Ask the controller which evidence it will accept, since the contract, not the certificate, defines what is due.
How much effort does ISO 27001 take and what does it need from our team?
The effort depends on the size of the scope, how mature your risk process already is, and how many Annex A controls you must evidence. The standard sets requirements for assessing and treating information security risks tailored to the organization, so a credible risk assessment and treatment plan is the core work. The 2022 edition has 93 Annex A controls in four themes: organizational (37), people (8), physical (14) and technological (34). Your team will need a named owner for the ISMS, control owners across IT, HR and facilities, and time for internal audit and management review. Ask any consultant or certification body for a written scope and effort estimate tied to these controls.
Can we do ISO 27001 ourselves, or do we need outside help?
Yes, many organizations run an ISMS in-house, but certification requires an accredited certification body to audit it, and that body must be independent of your implementation work. ISO does not certify organizations itself. Outside help is most useful for scoping, gap analysis, writing the risk methodology, and testing that controls operate in practice. DeployOpen plans, implements, documents and supports self-hosted platforms and prepares evidence for compliance assessments, but it does not issue audit reports or certifications. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and a quote follows from that written scope.
How long does the ISO 27001 certification cycle run?
Under ISO/IEC 17021-1, a management system certification cycle lasts three years, and the certification body must carry out at least one audit, either surveillance or recertification, in every calendar year. This means you should budget for ongoing audits, not a single event. Accredited certification bodies must also apply ISO/IEC 27006-1:2024 to all clients by 31 March 2026, under IAF MD 29:2024. The initial timeline before the first certificate depends on your readiness and the certification body's schedule, so ask for a written plan. Confirm the body's accreditation through the IAF CertSearch database, which ISO still points to for checking accredited certificates.
How DeployOpen prepares GDPR and ISO 27001 readiness
DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside the client's own infrastructure, and prepares systems, controls and evidence for compliance assessments. We do not issue audit reports, attestations or certifications, so the work covers the controls, records and evidence that a controller, a processor or an ISO certification body would need to review.
How we scope
- Engagements are fixed-scope, with the systems, data flows and deliverables agreed in writing before work starts.
- The written scope states which processing activities, personal data stores and ISMS boundaries are included.
- Scope names who owns each control and record, so privacy duties and ISMS controls are not assumed to overlap.
How we build
- We configure and document technical and organizational security measures on the client's own cloud, data center or air-gapped network.
- We map existing platform controls to Article 32 security needs and to the Annex A controls of ISO/IEC 27001:2022 where the client asks.
- We test the implemented controls, including security testing where it is in the agreed scope, and record the results as evidence.
How we hand over
- Handover includes the records the GDPR requires, such as the record of processing activities and processor contract documentation.
- Handover includes ISMS documentation, risk treatment records and control evidence in a form the client's certification body can review.
- We state clearly what remains for the client, the auditor or the supervisory authority to confirm, decide or sign off.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement ends.
- Retainers can keep control evidence, documentation and platform upgrades current between certification or supervisory reviews.
- Ask for the support scope, response arrangements and documentation updates in writing before committing to a retainer.
