Appearance
ISO/IEC 27701 and the GDPR
The GDPR (Regulation (EU) 2016/679) is binding EU law. It applies to the processing of personal data "in the context of the activities of an establishment of a controller or a processor in the Union" (Article 3(1)). Articles 3(2) and 3(3) also apply it, with their conditions, to some controllers and processors "not established in the Union". For more information, see GDPR Article 3.
ISO/IEC 27701:2025 is a voluntary standard for a privacy information management system (PIMS). This page compares ISO/IEC 27701 and the GDPR for an organization that uses the two together.
Conformity with ISO/IEC 27701 and compliance with the GDPR
ISO/IEC 27701 is a voluntary standard, and the GDPR is binding law. Conformity with ISO/IEC 27701 is not sufficient to show compliance with the GDPR.
ISO/IEC 27701 gives this information about conformity (Introduction 0.1):
- Conformity can give the organization evidence of how it processes PII.
- The organization can use this evidence when it agrees on the processing of PII with other organizations for which this processing is also "relevant".
- The organization can also use this evidence in its relations with other interested parties.
- The use of ISO/IEC 27701 can give independent verification of this evidence.
Annex D of ISO/IEC 27701 shows how conformity can be "relevant" to GDPR obligations (see Annex D). The NOTE of Annex D tells the organization that it has the responsibility to assess its legal obligations and select how to comply with them.
Certification in GDPR Article 42
ISO/IEC 27701 sets no certification rule, and no part of ISO/IEC 27701 makes it a certification mechanism of GDPR Article 42. Annex D maps Clause 4.1 to GDPR Articles 40 to 42. This mapping is indicative. For the certification of a PIMS by a certification body, see the certification audit cycle.
The GDPR gives these rules for certification:
- Certification "shall be voluntary and available via a process that is transparent" (Article 42(3)).
- In Article 42(5), the certification bodies of Article 43, or the competent supervisory authority, issue a certification. They use criteria that the competent supervisory authority approved (Article 58(3)) or that the Board approved (Article 63).
- Where the Board approved the criteria, "this may result in a common certification, the European Data Protection Seal" (Article 42(5)).
- An approved certification mechanism "may be used as an element" to demonstrate compliance with the obligations that Articles 24(3), 25(3), and 32(3) refer to.
- In Article 28(5), the "adherence of a processor to" an approved certification mechanism "may be used as an element by which to demonstrate sufficient guarantees".
- A certification "does not reduce the responsibility of the controller or the processor for compliance with this Regulation" (Article 42(4)).
Annex D — informative mapping
Annex D (informative) of ISO/IEC 27701 has one table, Table D.1. Table D.1 maps provisions of ISO/IEC 27701 to GDPR Articles 5 to 49, but not Article 43. Table D.1 has no entry for Article 23. This mapping is indicative. For the provisions that Table D.1 maps, see Annex D. Annex D refers to each control by its Annex B number.
The table that follows shows Table D.1 for each GDPR Article. In this table, "none" shows that Table D.1 gives no clause, or no control, for that Article.
| GDPR Article | ISO/IEC 27701 clauses | Table A.1 controls | Table A.2 controls | Table A.3 controls |
|---|---|---|---|---|
| 5, "Principles relating to processing of personal data" | none | A.1.2.2, A.1.2.3, A.1.2.7, A.1.2.9, A.1.3.7, A.1.4.2, A.1.4.4 to A.1.4.7, A.1.4.9, A.1.4.10 | A.2.2.3, A.2.4.2, A.2.4.4 | A.3.5 to A.3.7, A.3.9 to A.3.11, A.3.13, A.3.14, A.3.18 to A.3.25, A.3.28, A.3.31 |
| 6, "Lawfulness of processing" | none | A.1.2.3, A.1.4.6 | none | none |
| 7 to 11 (consent and other conditions) | none | A.1.2.3 to A.1.2.5, A.1.3.3 to A.1.3.5, A.1.4.6 | A.2.2.4 (Article 7(4)) | none |
| 12 to 22, Chapter III "Rights of the data subject" | none | A.1.2.3, A.1.3.2 to A.1.3.11, A.1.4.8, A.1.5.2, A.1.5.3 | A.2.3.2 (Articles 15(3), 17(2)) | none |
| 24, "Responsibility of the controller" | 4.1 (Article 24(3)), 5.2 (Article 24(2)) | A.1.2.9 | none | A.3.14 |
| 25, "Data protection by design and by default" | 4.1 (Article 25(3)) | A.1.4.3 | none | A.3.27, A.3.29 |
| 26, "Joint controllers" | none | A.1.2.8 | none | none |
| 27, "Representatives of controllers or processors not established in the Union" | 5.3 | none | none | none |
| 28, "Processor" | 4.1 (Articles 28(5), 28(6), 28(10)) | A.1.2.7 | A.2.2.2, A.2.2.3, A.2.2.5, A.2.2.6, A.2.3.2, A.2.4.3, A.2.5.5, A.2.5.7 to A.2.5.9 | A.3.10, A.3.13, A.3.18 |
| 29, "Processing under the authority of the controller or processor" | none | none | A.2.2.3 | none |
| 30, "Records of processing activities" | none | A.1.2.9, A.1.5.2 to A.1.5.5 | A.2.2.7, A.2.4.3, A.2.5.3, A.2.5.4 | A.3.10, A.3.13 |
| 31, "Cooperation with the supervisory authority" | 4.2 | none | none | none |
| 32, "Security of processing" | 4.1 (Article 32(3)), 4.3, 4.4, 6.1.2, 6.1.3 | A.1.2.2, A.1.4.6 | A.2.2.3 | A.3.5, A.3.10, A.3.13, A.3.15, A.3.16, A.3.20, A.3.24, A.3.26, A.3.28 |
| 33 and 34 (personal data breach) | none | none | none | A.3.11, A.3.12 |
| 35, "Data protection impact assessment" | 4.2 (Article 35(9)) | A.1.2.6 | A.2.2.2 (Article 35(1)) | none |
| 36, "Prior consultation" | 4.2 | A.1.2.6 | none | none |
| 37 to 39, Section 4 "Data protection officer" | 5.3 | none | none | A.3.17 (Article 39(1)(b)), A.3.18 (Article 38(5)) |
| 40 to 42, Section 5 "Codes of conduct and certification" | 4.1 | none | none | none |
| 44 to 49, Chapter V "Transfers of personal data to third countries or international organisations" | none | A.1.5.2 (Articles 44 to 49) | A.2.5.2 (Articles 44, 46, 48, 49), A.2.5.6 (Article 48) | none |
The range of Table D.1 starts at Article 5, thus Table D.1 maps none of the definitions in Article 4.
Controller and processor in the GDPR and ISO/IEC 27701
The GDPR and ISO/IEC 27701 use different names for the roles. The GDPR gives the definitions of controller and processor in Article 4(7) and 4(8). ISO/IEC 27701 uses the definitions of PII controller and PII processor in ISO/IEC 29100 (Clause 3). ISO/IEC 27701 also gives the definitions of joint PII controller (3.21) and customer (3.22).
| GDPR (Article) | ISO/IEC 27701 (provision) |
|---|---|
| controller (4(7)) | PII controller (Clause 3, 4.1) |
| joint controllers (26) | joint PII controller (3.21) |
| processor (4(8)) | PII processor (Clause 3, 4.1) |
| "another processor" (28(2), 28(4)) | subcontractor of a PII processor (A.2.5.7 to A.2.5.9) |
| data subject (4(1)) | PII principal (Clause 3, 4.2 NOTE 4) |
| personal data (4(1)) | PII (Clause 3) |
| personal data breach (4(12)) | PII breach (B.3.11) |
Each row shows the names that the GDPR and ISO/IEC 27701 use for a related role or item. The GDPR and ISO/IEC 27701 do not make these names equivalent. GDPR Article 4(7) and ISO/IEC 27701 (3.21, 4.1 NOTE 2) connect the controller role to the person or organization that determines the purposes and means.
Clause 4.1 of ISO/IEC 27701 requires the organization to determine if it is a PII controller (a joint PII controller included) or a PII processor. In ISO/IEC 27701, the customer is different for each role (Clause 4.2). For the role determination and for the customer of each role, see PII controller and PII processor roles.
Data protection impact assessment and privacy risk assessment
The GDPR sets obligations for the data protection impact assessment. ISO/IEC 27701 sets requirements for privacy risk assessment (Clauses 6.1.2 and 8.2) and a control for privacy impact assessment (A.1.2.6).
The GDPR sets these obligations:
- Where a type of processing "is likely to result in a high risk to the rights and freedoms of natural persons", the controller must do a data protection impact assessment (DPIA) "prior to the processing" (Article 35(1)).
- The controller must "consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk" (Article 36(1)).
- The "contract or other legal act" with a processor must require the processor to help the controller with Articles 32 to 36, "taking into account the nature of processing and the information available to the processor" (Article 28(3)(f)).
GDPR Article 35 also gives the types of processing for which a DPIA "shall in particular be required" (Article 35(3)). It also gives the "lists" of the supervisory authority (Article 35(4) and 35(5)) and the minimum contents of a DPIA (Article 35(7)). Article 35(10) gives an exception, on conditions, for some processing in point (c) or (e) of Article 6(1). For more about Article 35, see GDPR Article 35.
ISO/IEC 27701 sets these requirements and controls:
- In Table A.1, for PII controllers, control A.1.2.6 requires the organization to assess if a privacy impact assessment is necessary. The organization does this when it plans new processing of PII, or a change to processing of PII. The organization does the privacy impact assessment "where appropriate".
- A.1.2.6 applies when the organization includes it in its necessary controls during privacy risk treatment (Clause 6.1.3). If the organization does not include A.1.2.6, Clause 6.1.3 e) requires the organization to include the justification for this decision in the statement of applicability. The B.1.2.6 guidance refers to ISO/IEC 29134 for more guidance.
- Clause 6.1.2 requires a privacy risk assessment process. The process identifies privacy risks and their possible effects on the organization and on PII principals.
- Clause 8.2 requires the privacy risk assessment at planned intervals, and also when "significant changes are proposed" or occur.
Annex D maps GDPR Articles 35 and 36 to A.1.2.6. Annex D also maps Article 35(1) to A.2.2.2, and Articles 35(9) and 36 to Clause 4.2. Annex D maps Clauses 6.1.2 and 6.1.3 only to Article 32. For these clauses, see Clause 6.
Breach notification and requests from PII principals
ISO/IEC 27701 sets no time limit to notify a PII breach and no "response times" for requests from PII principals. The GDPR sets time limits for the two.
Breaches
In ISO/IEC 27701, the incident controls are A.3.11 and A.3.12 in Table A.3 (see Table A.3). The B.3.11 guidance recommends procedures to notify PII breaches to the "relevant parties" and to determine when to notify them. The guidance also recommends that the organization think about the applicable legal requirements.
The GDPR sets these obligations:
- The controller must notify the competent supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware of it", "unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons" (Article 33(1)).
- "Where the notification to the supervisory authority is not made within 72 hours", the notification must be "accompanied by reasons for the delay" (Article 33(1)).
- The processor must notify the controller "without undue delay after becoming aware of a personal data breach" (Article 33(2)).
- Where the breach is "likely to result in a high risk to the rights and freedoms of natural persons", the controller must tell the data subject "without undue delay" (Article 34(1)). This communication is not necessary if a condition of Article 34(3) applies.
For more information, see GDPR Article 33.
Requests
In ISO/IEC 27701, the obligations to PII principals are controls A.1.3.2 to A.1.3.11 in Table A.1. For a PII processor, the control is A.2.3.2. For requests, the B.1.3.10 guidance of ISO/IEC 27701 recommends "appropriate response times" in the privacy policy, and it adds that some jurisdictions set "response times" (see Table A.1).
In GDPR Article 12(3), the controller must "provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request". This period "may be extended by two further months where necessary, taking into account the complexity and number of the requests". The controller must tell the data subject about the extension, "together with the reasons for the delay", "within one month of receipt of the request". Annex D maps Article 12(3) to A.1.3.10. For the rights, see GDPR Articles 15 to 21.
Records and transfers
In ISO/IEC 27701, documented information is part of the PIMS when a clause or an included Annex A control requires it. Documented information is also part of the PIMS when the organization determines that it is necessary for the effectiveness of the PIMS (Clause 7.5.1). For example, Clause 4.3 requires the scope of the PIMS as documented information. If the organization includes them, controls A.1.2.9 (PII controllers) and A.2.2.7 (PII processors) require records related to the processing of PII.
The GDPR sets a different record obligation. In Article 30(1) and 30(2), each controller and each processor must keep a record of processing activities. Where applicable, the representative of the controller or of the processor must also keep this record. In Article 30(5), these obligations do not apply to "an enterprise or an organisation employing fewer than 250 persons", unless one of the conditions of Article 30(5) applies. For these conditions, see GDPR Article 30.
Annex D maps A.1.2.9 and A.2.2.7, with other controls, to Article 30.
In ISO/IEC 27701, the "basis" for a transfer of PII is also part of the PIMS. In Table A.1, control A.1.5.2 requires a PII controller to identify and record the "basis" for transfers of PII between jurisdictions. In Table A.2, control A.2.5.2 requires a PII processor to tell the customer in time about this "basis" and about planned changes to it. Annex D maps A.1.5.2 to GDPR Articles 44 to 49, and A.2.5.2 to Articles 44, 46, 48, and 49. For these controls, see Table A.1 and Table A.2.
The GDPR names two types of standard clauses. In Article 46(2)(c) and (d), "standard data protection clauses" are safeguards for transfers. Article 28(6) to (8) refer to "standard contractual clauses" for the "contract or other legal act" in Article 28(3) and 28(4). Article 28(3) applies to a controller and a processor. Article 28(4) applies to a processor and "another processor".
The GDPR and the EU AI Act
In Article 2(7) of the EU AI Act (Regulation (EU) 2024/1689, consolidated version of 27 July 2026), "Union law on the protection of personal data, privacy and the confidentiality of communications applies to personal data processed in connection with the rights and obligations laid down in this Regulation". Article 2(7) also gives this rule: "Without prejudice to Articles 4a and 59 of this Regulation, this Regulation shall not affect Regulation (EU) 2016/679". The same rule applies to the other Union regulations and directives that Article 2(7) names. For the AI management system of ISO/IEC 42001, see ISO/IEC 42001. For the AI Act, see EU AI Act.
The GDPR in Modulos
Modulos has two GDPR Frameworks: OFF-11 at the Organization level and MFF-12 at the AI System level (see GDPR in Modulos). The ISO 27701 Frameworks, OFF-12 and MFF-13, hold the requirements of ISO/IEC 27701, not the obligations of the GDPR. The privacy impact assessment control A.1.2.6 is in Table A.1, which MRF-394 holds. For the full Requirement table, see the Requirements. For Controls that two or more Frameworks use, see Control overlap.
Where to go next
ISO/IEC 27701 overview
The standard, its edition, its structure, and its certification
Annexes
Annex A with Table A.1 to Table A.3, the Annex B guidance, and Annex D
ISO/IEC 27701 in Modulos
The two Frameworks, the set-up steps, and the Requirement table
GDPR overview
The GDPR, its structure, and its Frameworks in Modulos
GDPR controller obligations
GDPR Articles 24 to 39, with breach notification and the DPIA
Sources of this page
- ISO/IEC 27701:2025, "Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance", Edition 2, October 2025 (ISO):
- The Introduction (0.1), Clause 3 (3.21, 3.22), and Clauses 4.1, 4.2, 4.3, 6.1.2, 6.1.3, 7.5.1, and 8.2.
- Annex A: A.1.2.6, A.1.2.9, A.1.3.2 to A.1.3.11, A.1.5.2, A.2.2.7, A.2.3.2, A.2.5.2, A.2.5.7 to A.2.5.9, A.3.11, and A.3.12.
- Annex B: B.1.2.6, B.1.3.10, B.3.11, and B.3.12.
- Annex D, Table D.1.
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex):
- Articles 3, 4(1), 4(7), 4(8), 4(12), and 12(3).
- Articles 24(3), 25(3), 26, 28, 30, and 32(3).
- Articles 33 to 36, 42, and 46(2).
- Regulation (EU) 2024/1689 (EU AI Act), consolidated version of 27 July 2026: Article 2(7) (EUR-Lex).
Disclaimer
This page gives general information and is not legal advice. It does not replace the help of a certification body.