ISO 27701 and GDPR Alignment: A Practical Mapping
ISO 27701:2019 extends ISO 27001 to add privacy-specific requirements for a Privacy Information Management System (PIMS). When aligned with the EU General Data Protection Regulation (GDPR), ISO 27701 provides a certifiable framework that operationalises GDPR compliance. This ISO 27701 and GDPR alignment guide maps PIMS controls to specific GDPR articles, helping organisations understand how certification supports regulatory compliance, simplifies data protection audits, and demonstrates accountability to supervisory authorities.
ISO 27701 Overview and Structure
ISO 27701 adopts the same high-level structure as ISO 27001 (clauses 4–10) and extends it with privacy-specific controls organised into two categories: PII controller controls and PII processor controls. The standard provides a framework for establishing, implementing, maintaining, and continually improving a PIMS.
| ISO 27701 Component | Description | Clause / Control Count |
|---|---|---|
| ISMS extension (clauses 4–10) | PIMS-specific additions to the ISMS context, leadership, planning, support, operation, evaluation, and improvement requirements | ISO 27001 clauses + PIMS extensions |
| PII controller controls | Controls applicable when the organisation acts as a data controller, covering conditions for collection and processing, obligations to PII principals, privacy by design, and breach notification | ISO 27701 Annex A (controller-specific) |
| PII processor controls | Controls applicable when the organisation acts as a data processor, covering client instructions, sub-processor management, data retention and disposal, and return/transfer of PII | ISO 27701 Annex B (processor-specific) |
| Additional ISO 27001 guidance | Privacy-specific implementation guidance for existing ISO 27001 Annex A controls | ISO 27701 Annex C and D |
PIMS Controls Mapped to GDPR Articles
The most valuable aspect of ISO 27701 certification is the direct mapping between PIMS controls and GDPR articles. The table below provides a practical mapping of key PIMS controls to their corresponding GDPR obligations.
| ISO 27701 Control | Control Name | Mapped GDPR Article(s) | GDPR Requirement |
|---|---|---|---|
| 7.2.1 | Identification of PII controller | Art. 4(7), Art. 24, Art. 26 | Identify the data controller; joint controller arrangements must be documented |
| 7.2.2 | PII controller’s identification of lawful basis | Art. 6, Art. 9, Art. 10 | Lawful basis for processing must be documented, including consent, legitimate interest, contract, or legal obligation |
| 7.2.6 | Determination of and compliance with PII principal rights | Art. 12–22 | Data subject rights: access, rectification, erasure, restriction, portability, objection, and automated decision-making |
| 7.2.8 | Privacy by design and privacy by default | Art. 25 | Data protection by design and default must be embedded into processing operations and systems |
| 7.2.12 | PII breach notification | Art. 33, Art. 34 | Breach notification to supervisory authority within 72 hours; communication to data subjects where high risk |
| 7.2.14 | PII protection in cloud services | Art. 28, Art. 46 | Cloud processor due diligence, DPA, and adequate safeguards for international transfers |
| 7.3.1 | Contract with PII processor | Art. 28(3) | Data processing agreement (DPA) must specify subject matter, duration, nature, purpose, and data types |
| 7.3.3 | Return, transfer, or disposal of PII | Art. 17, Art. 28(3)(g) | Upon termination, processor must delete or return all PII as directed by the controller |
| 8.2.1 | Inventory of PII | Art. 30 | Records of processing activities (ROPA) must be maintained for all PII processing operations |
| 8.3.2 | Management of data protection incidents | Art. 33, Art. 34 | Incident management process aligned with breach detection, investigation, and notification timelines |
GDPR Controller and Processor Obligations
GDPR draws a clear distinction between data controllers (who determine the purposes and means of processing) and data processors (who process data on behalf of controllers). ISO 27701 mirrors this distinction with dedicated control sets for each role. Organisations that are both controllers and processors – a common scenario – must implement controls from both sets.
Controller Obligations (ISO 27701 Annex A)
Controllers must identify their lawful basis (Art. 6), fulfil data subject rights (Art. 12–22), conduct Data Protection Impact Assessments (DPIAs) (Art. 35), maintain records of processing (Art. 30), and implement privacy by design (Art. 25). ISO 27701 Annex A provides certifiable controls for each of these obligations, enabling organisations to demonstrate compliance through independent audit.
Processor Obligations (ISO 27701 Annex B)
Processors must act only on documented controller instructions (Art. 28(3)(a)), engage sub-processors only with controller authorisation (Art. 28(2)), implement appropriate technical and organisational measures (Art. 32), and assist controllers with data subject rights and breach notifications (Art. 28(3)(e)–(f)). ISO 27701 Annex B assures controllers that their processors operate within a certified PIMS.
Data Protection Officer (DPO) Requirements
GDPR Article 37 requires the designation of a Data Protection Officer (DPO) where the core activities of the controller or processor involve large-scale systematic monitoring of data subjects or large-scale processing of special categories of data. While ISO 27701 does not explicitly require a DPO role, control 7.2.4 (PII contact for data protection) requires organisations to designate a contact point for data protection matters. For GDPR compliance, this contact should be the DPO, and their contact details must be published and communicated to the supervisory authority as required under Article 37(7). ISO 27701 certification provides documented evidence that DPO responsibilities are operationalised, including independent oversight, reporting to top management, and access to resources.
Data Subject Rights and Breach Notification
Data subject rights and breach notification are two of the most scrutinised areas in GDPR enforcement. ISO 27701 provides structured controls that operationalise these requirements into auditable processes.
| Data Subject Right | GDPR Article | ISO 27701 Control(s) | Evidence of Compliance |
|---|---|---|---|
| Right of access | Art. 15 | 7.2.6, 7.2.7 | Access request procedure, response timeline logs, SAR register |
| Right to rectification | Art. 16 | 7.2.6 | Correction request workflow, PII update records, data accuracy metrics |
| Right to erasure (right to be forgotten) | Art. 17 | 7.2.6, 7.3.3, 8.2.3 | Erasure procedure, retention schedules, disposal certificates |
| Right to restriction of processing | Art. 18 | 7.2.6 | Restriction flagging process, system access controls, processing halt records |
| Right to data portability | Art. 20 | 7.2.6 | Data export procedure, machine-readable format templates, API documentation |
| Right to object | Art. 21 | 7.2.6 | Objection handling procedure, legitimate interest assessment records |
| Breach notification (SA) | Art. 33 | 7.2.12, 8.3.2 | Incident response plan, breach register, notification timeline records |
| Breach communication (data subjects) | Art. 34 | 7.2.12 | Communication templates, high-risk assessment, notification delivery evidence |
Cross-Border Transfers and Adequacy
Cross-border personal data transfers are governed by GDPR Articles 44–49 and remain a high-risk area for organisations transferring data from the EEA to GCC states. The GCC does not currently hold an EU adequacy decision under Article 45, meaning transfers must rely on appropriate safeguards such as Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or an approved certification mechanism. ISO 27701 controls 7.2.14 (cloud services) and 7.3.4 (sub-processor management) directly address cross-border transfer requirements by requiring documented transfer impact assessments, SCC incorporation into data processing agreements, and contractual controls over onward transfers. While ISO 27701 certification does not itself create a legal basis for transfer under Article 46, it provides robust auditable evidence that the organisation maintains the technical and organisational measures required for lawful transfers. Organisations should monitor the European Commission’s ongoing engagement with GCC data protection authorities, particularly the UAE’s Federal Decree-Law No. 45 of 2021 on Personal Data Protection, which brings UAE law closer to GDPR standards.
Benefits of ISO 27701 Certification for GDPR Compliance
Achieving ISO 27701 certification delivers tangible benefits for organisations subject to GDPR, beyond the intrinsic value of an accredited PIMS.
Frequently Asked Questions
What is ISO 27701 and how does it relate to GDPR?
ISO 27701 is a privacy extension to ISO 27001 that specifies requirements for a Privacy Information Management System (PIMS). It provides a certifiable framework that maps directly to GDPR obligations, enabling organisations to demonstrate compliance with Articles 5 (accountability), 24 (responsibility of the controller), 25 (privacy by design), 28 (processors), 30 (records of processing), 32 (security of processing), 33/34 (breach notification), and 35 (DPIAs).
Does ISO 27701 certification mean I am GDPR-compliant?
Not automatically. ISO 27701 certification demonstrates that your PIMS meets the requirements of the standard, which aligns with many GDPR obligations. However, GDPR also includes legal and procedural requirements that ISO 27701 does not cover (e.g. registration with supervisory authorities, specific consent mechanisms under ePrivacy Directive). ISO 27701 should be viewed as a powerful component of a broader GDPR compliance programme, not a complete substitute.
Can I achieve ISO 27701 certification without ISO 27001?
No. ISO 27701 is designed as an extension to ISO 27001. Organisations must first implement and certify an ISMS against ISO 27001 before they can achieve ISO 27701 certification. The PIMS builds on the ISMS foundation, adding privacy-specific controls and implementation guidance. Some certification bodies offer combined ISO 27001 and ISO 27701 audits to reduce duplicative effort.
What is the difference between a PII controller and a PII processor under ISO 27701?
A PII controller determines the purposes and means of processing personal data, analogous to a GDPR data controller. A PII processor processes data on behalf of the controller, analogous to a GDPR data processor. ISO 27701 provides separate control sets for each role (Annex A for controllers, Annex B for processors). Organisations that fulfil both roles must implement both control sets.
How does ISO 27701 handle international data transfers?
ISO 27701 controls 7.2.14 (PII protection in cloud services) and 7.3.4 (sub-processor management) require documented safeguards for cross-border data transfers, including transfer impact assessments, contractual protections (SCCs or equivalent), and verification of equivalent protection in the destination jurisdiction. While certification does not replace the legal requirement for a valid transfer mechanism under Article 46, the documented controls serve as strong evidence for supervisory authorities.
What are the costs and timeline for ISO 27701 certification?
Costs depend on the size and complexity of your organisation, the scope of PII processing, and whether you are already ISO 27001 certified. Typical implementation timelines range from 4 to 9 months for organisations with an existing ISMS. Costs include gap analysis, implementation support, internal audit, certification audit fees, and ongoing surveillance. Combined ISO 27001/ISO 27701 certification may reduce total cost compared to separate certifications.
Ready to align your privacy programme with ISO 27701 and GDPR? Bitrixme’s data protection consultants guide you through PIMS implementation, gap analysis, and certification. Book a consultation to map your current privacy controls to ISO 27701 and achieve certifiable GDPR compliance.
