ISO 27701 vs GDPR: what is the difference?
The GDPR is an EU law that every organization processing personal data of people in the EU must comply with, with fines of up to EUR 20 million or 4% of worldwide turnover. ISO/IEC 27701:2025 is a voluntary international standard for a privacy information management system that can be certified. They work together: ISO 27701 gives you the system (roles, risk assessment, controls, records, audits) to organize and evidence GDPR compliance, but certification does not by itself prove that you comply with the GDPR.
Side by side
| GDPR | ISO/IEC 27701:2025 | |
|---|---|---|
| What it is | EU regulation (law) | International management system standard |
| Mandatory? | Yes, if it applies to you | No, voluntary |
| Who checks | Data protection authorities and courts | Certification bodies (audits) |
| Outcome | Compliance or sanctions | Certificate valid for three years with surveillance audits |
| Scope | EU and anyone targeting people in the EU (UK has its own UK GDPR) | Any organization, any country, as controller and/or processor |
| Content | Principles, lawful bases, rights, duties, breach notification, transfers, fines | Clauses 4 to 10 plus 78 reference controls (A.1 controllers, A.2 processors, A.3 security) |
Where they overlap
| GDPR topic | Article | ISO 27701 area |
|---|---|---|
| Principles and accountability | 5, 24 | Clauses 4 to 10, table A.1 |
| Lawful basis and consent | 6, 7 | A.1 conditions for collection and processing |
| Transparency and rights | 12 to 22 | A.1 obligations to PII principals |
| Privacy by design and by default | 25 | A.1 and A.2 privacy by design |
| Processors and contracts | 28, 29 | A.1 and A.2 contracts and instructions |
| Records of processing | 30 | A.1 and A.2 records |
| Security and breaches | 32 to 34 | A.3 security of PII |
| DPIA | 35 | A.1 privacy impact assessment |
| Transfers | 44 to 49 | A.1 and A.2 transfers and disclosures |
Article numbers are cited for orientation only. Check the official text of both documents.
What ISO 27701 does not cover by itself
- Exact legal deadlines (72 hours for breach notification, one month for requests) and their exceptions: write them into your procedures.
- Legal decisions such as choosing the lawful basis, legitimate interests balancing or whether you need a DPO or an EU representative.
- Country-specific rules (for example UK GDPR changes in 2025, or national laws on employee data).
- Fines and the authority's interpretation: certification does not protect you from enforcement.
How to use them together
- 1. Implement ISO 27701 as your management system and add the GDPR to your legal requirements.
- 2. Map each relevant GDPR article to a control and a document (a crosswalk).
- 3. Fill the gaps with GDPR-specific templates: legitimate interests assessment, breach notification, DPO and representative, transfer risk assessment.
- 4. Audit both: internal audits against ISO 27701 and periodic legal review against the GDPR.
Frequently asked questions
Is ISO 27701 certification proof of GDPR compliance?
No. It is strong evidence of a managed privacy program, but compliance depends on meeting each legal obligation, which authorities assess.
Do I need ISO 27701 to comply with the GDPR?
No. The GDPR does not require any certification. ISO 27701 is one way to organize and evidence compliance.
Is ISO 27701 a GDPR certification mechanism under article 42?
Not by default. Article 42 certifications must be approved by authorities or the European Data Protection Board; ISO 27701 certification is a private management system certification.
Does ISO 27701 help with laws outside the EU?
Yes. Its controls are law-neutral, so the same system can organize evidence for the UK GDPR, US state laws, Brazil's LGPD or Chile's Law 21,719.
Related guides
- ISO 27001:2022 mandatory documents: list by clause
- ISO 27701:2025: what changed and what to do now
- ISO 27701:2025 mandatory documents
Updated: 2026-10-20