Security Lights the Way

Crossbearing · standards comparison

GDPR to ISO/IEC 27701

What you can reuse, what to extend and what is new when you add ISO/IEC 27701 to GDPR.

Compare another pair

What carries over from GDPR to ISO/IEC 27701

Much of your GDPR work carries over as raw material. ISO/IEC 27701’s own Annex D ties most of its controls to GDPR articles, so your records, notices, rights handling, processor contracts and breach procedures already cover a lot of Annex A. The new work is the management system around them — scope, objectives, risk treatment, internal audit, management review — and the security controls Annex A now includes.

Of the 103 clauses and controls ISO/IEC 27701 asks for: 82 to extend and 21 new.

  • 82 Extend Keep what you have and add the new standard’s content.
  • 21 New Nothing you have covers it: new work.

Clause and control numbers checked against GDPR and ISO/IEC 27701 themselves; descriptions are MajorCyber™’s own words. Links from ISO/IEC 27701:2025 Annex D, with notes and actions by MajorCyber™, last checked 24 October 2026. Going the other way? ISO/IEC 27701 to GDPR

Built on your device, with the documents you tick below. Nothing is uploaded.

Do I need to rewrite my policies?

Partly. Keep your data protection policy and procedures, and bring them under the management system: approved by top management, with objectives, owners and reviews. Add the policies the security controls in Table A.3 need if you don’t already have an ISO/IEC 27001 system.

The management system, clause by clause

ISO/IEC 27701 is a management-system standard with clauses 4 to 10; GDPR isn’t. Each row says what ISO/IEC 27701 asks for, and which parts of GDPR already support it.

Clause Your GDPR ISO/IEC 27701 asks for What to do
4.1 Context Art. 24Art. 25Art. 28Art. 32Art. 40Art. 41Art. 42 Issues that affect the PIMS, including whether climate change is relevant, and whether the organisation acts as a PII controller (alone or jointly), a PII processor or both. Extend Your work on the GDPR articles listed supports clause 4.1. Turn it into the documented, auditable process ISO/IEC 27701 requires.
4.2 Interested parties Art. 31Art. 35Art. 36 Who has a stake in the organisation’s handling of PII — the people it relates to, customers, regulators, processors — and what they require. Extend Your work on the GDPR articles listed supports clause 4.2. Turn it into the documented, auditable process ISO/IEC 27701 requires.
4.3 Scope Art. 32 The boundaries of the PIMS: which processing, systems and roles it covers. Extend Your work on the GDPR articles listed supports clause 4.3. Turn it into the documented, auditable process ISO/IEC 27701 requires.
4.4 The management system Art. 32 A PIMS that is set up, run, maintained and continually improved, with its processes and how they interact. Extend Your work on the GDPR articles listed supports clause 4.4. Turn it into the documented, auditable process ISO/IEC 27701 requires.
5.1 Leadership Nothing here Top management directs and supports the PIMS: aligned with strategy, built into the business, resourced and communicated. New Nothing in GDPR corresponds: new work for the PIMS.
5.2 Policy Art. 24 A privacy policy from top management that frames privacy objectives and commits to meeting requirements and improving. Extend Your work on the GDPR articles listed supports clause 5.2. Turn it into the documented, auditable process ISO/IEC 27701 requires.
5.3 Roles Art. 27Art. 37Art. 38Art. 39 Responsibilities and authorities for privacy assigned and communicated. Extend Your work on the GDPR articles listed supports clause 5.3. Turn it into the documented, auditable process ISO/IEC 27701 requires.
6.1.1 Risks and opportunities Nothing here Plan how the PIMS addresses its risks and opportunities. New Nothing in GDPR corresponds: new work for the PIMS.
6.1.2 Risk assessment Art. 32 A repeatable privacy risk assessment of the privacy and information security risks in scope, weighing the consequences for the people whose PII it is as well as for the organisation, with risk owners. Extend Your work on the GDPR articles listed supports clause 6.1.2. Turn it into the documented, auditable process ISO/IEC 27701 requires.
6.1.3 Risk treatment Art. 32 Choose treatments and controls, identify and document the information security programme you run (6.1.3 c), check against Annex A, and write a Statement of Applicability (6.1.3 e) and a treatment plan approved by the privacy risk owners. Extend Your work on the GDPR articles listed supports clause 6.1.3. Turn it into the documented, auditable process ISO/IEC 27701 requires.
6.2 Objectives Nothing here Privacy objectives, with plans for who achieves them, how and by when. New Nothing in GDPR corresponds: new work for the PIMS.
6.3 Planning changes Nothing here Changes to the management system are carried out in a planned way. New Nothing in GDPR corresponds: new work for the PIMS.
7.1 Resources Nothing here The resources the management system needs are provided. New Nothing in GDPR corresponds: new work for the PIMS.
7.2 Competence Nothing here People whose work affects privacy are competent, with evidence kept. New Nothing in GDPR corresponds: new work for the PIMS.
7.3 Awareness Nothing here People know the privacy policy and their part in the PIMS. New Nothing in GDPR corresponds: new work for the PIMS.
7.4 Communication Nothing here What is communicated, when, to whom and how. New Nothing in GDPR corresponds: new work for the PIMS.
7.5 Documented information Nothing here Documents and records the PIMS needs are created, updated and controlled. New Nothing in GDPR corresponds: new work for the PIMS.
8.1 Operational control Nothing here Processes planned, run and controlled, including outsourced ones, with evidence that they ran as planned. New Nothing in GDPR corresponds: new work for the PIMS.
8.2 Risk assessment in operation Nothing here Privacy risk assessments carried out at planned intervals and when significant changes happen. New Nothing in GDPR corresponds: new work for the PIMS.
8.3 Risk treatment in operation Nothing here The privacy risk treatment plan implemented. New Nothing in GDPR corresponds: new work for the PIMS.
9.1 Monitoring and measurement Nothing here What is monitored and measured, how and when, and how the results are evaluated. New Nothing in GDPR corresponds: new work for the PIMS.
9.2 Internal audit Nothing here Internal audits at planned intervals, by objective auditors, against the standard and the organisation’s own requirements. New Nothing in GDPR corresponds: new work for the PIMS.
9.3 Management review Nothing here Top management reviews the PIMS at planned intervals, with set inputs and recorded decisions. New Nothing in GDPR corresponds: new work for the PIMS.
10.1 Continual improvement Nothing here The PIMS keeps getting more suitable, adequate and effective. New Nothing in GDPR corresponds: new work for the PIMS.
10.2 Nonconformity and corrective action Nothing here Nonconformities are corrected, their causes found and removed, and the actions checked. New Nothing in GDPR corresponds: new work for the PIMS.

Controls: ISO/IEC 27701 Annex A, against GDPR articles

Each ISO/IEC 27701 Annex A control, with the GDPR articles that Annex D ties to it.

ISO/IEC 27701 control Supported by your GDPR What to do
Controller: lawful processing
A.1.2.2 Purposes identified and documented
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 32 Security of processing Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.2.2. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.2.3 Lawful basis identified and shown
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 6 A lawful basis for every processing Partly covers it
  • Art. 8 Children’s consent to online services Partly covers it
  • Art. 9 Special categories of personal data Partly covers it
  • Art. 10 Data about criminal convictions and offences Partly covers it
  • Art. 17 Right to erasure Partly covers it
  • Art. 18 Right to restriction of processing Partly covers it
  • Art. 22 Automated decisions, including profiling Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.2.3. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.2.4 A process for when and how consent is sought
  • Art. 8 Children’s consent to online services Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.2.4. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.2.5 Consent obtained and recorded
  • Art. 7 Conditions for valid consent Partly covers it
  • Art. 9 Special categories of personal data Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.2.5. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.2.6 Privacy impact assessment for new or changed processing
  • Art. 35 Data protection impact assessment Partly covers it
  • Art. 36 Prior consultation with the authority Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.2.6. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.2.7 Written contracts with PII processors
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 28 Processors and the contract terms they need Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.2.7. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.2.8 Roles agreed with joint controllers
  • Art. 26 Joint controllers Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.2.8. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.2.9 Records that support processing obligations
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 24 The controller’s responsibility, and data protection policies Partly covers it
  • Art. 30 Records of processing activities Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.2.9. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
Controller: people’s rights
A.1.3.2 Obligations to people identified and met
  • Art. 12 Clear information and how rights requests are handled Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.3.2. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.3.3 Deciding what people are told, and when
  • Art. 11 Processing that doesn’t need identification Partly covers it
  • Art. 13 Information when data is collected from the person Partly covers it
  • Art. 14 Information when data comes from elsewhere Partly covers it
  • Art. 15 Right of access Partly covers it
  • Art. 18 Right to restriction of processing Partly covers it
  • Art. 21 Right to object Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.3.3. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.3.4 Clear information given to people
  • Art. 11 Processing that doesn’t need identification Partly covers it
  • Art. 12 Clear information and how rights requests are handled Partly covers it
  • Art. 13 Information when data is collected from the person Partly covers it
  • Art. 21 Right to object Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.3.4. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.3.5 A way to change or withdraw consent
  • Art. 7 Conditions for valid consent Partly covers it
  • Art. 13 Information when data is collected from the person Partly covers it
  • Art. 14 Information when data comes from elsewhere Partly covers it
  • Art. 18 Right to restriction of processing Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.3.5. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.3.6 A way to object to processing
  • Art. 13 Information when data is collected from the person Partly covers it
  • Art. 14 Information when data comes from elsewhere Partly covers it
  • Art. 21 Right to object Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.3.6. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.3.7 Access, correction and erasure
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 13 Information when data is collected from the person Partly covers it
  • Art. 14 Information when data comes from elsewhere Partly covers it
  • Art. 16 Right to rectification Partly covers it
  • Art. 17 Right to erasure Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.3.7. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.3.8 Third parties told of changes, withdrawals and objections
  • Art. 19 Telling recipients about rectification, erasure or restriction Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.3.8. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.3.9 A copy of their PII for people who ask
  • Art. 15 Right of access Partly covers it
  • Art. 20 Right to data portability Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.3.9. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.3.10 Procedures for handling requests
  • Art. 12 Clear information and how rights requests are handled Partly covers it
  • Art. 15 Right of access Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.3.10. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.3.11 Obligations from automated decisions about people
  • Art. 13 Information when data is collected from the person Partly covers it
  • Art. 14 Information when data comes from elsewhere Partly covers it
  • Art. 22 Automated decisions, including profiling Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.3.11. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
Controller: privacy by design
A.1.4.2 Collection limited to what is needed
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.4.2. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.4.3 Processing limited to what is needed
  • Art. 25 Data protection by design and by default Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.4.3. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.4.4 PII kept accurate and up to date
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.4.4. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.4.5 Minimisation objectives and how they are met
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.4.5. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.4.6 De-identified or deleted when no longer needed
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 6 A lawful basis for every processing Partly covers it
  • Art. 11 Processing that doesn’t need identification Partly covers it
  • Art. 32 Security of processing Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.4.6. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.4.7 Temporary files disposed of on time
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.4.7. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.4.8 Kept no longer than its purposes need
  • Art. 13 Information when data is collected from the person Partly covers it
  • Art. 14 Information when data comes from elsewhere Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.4.8. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.4.9 Disposal policies and procedures
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.4.9. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.4.10 Transmitted PII reaches only its destination
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.4.10. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
Controller: sharing and transfers
A.1.5.2 Basis for transfers between jurisdictions
  • Art. 15 Right of access Partly covers it
  • Art. 30 Records of processing activities Partly covers it
  • Art. 44 The general principle for transfers Partly covers it
  • Art. 45 Transfers on the basis of an adequacy decision Partly covers it
  • Art. 46 Transfers with appropriate safeguards Partly covers it
  • Art. 47 Binding corporate rules Partly covers it
  • Art. 48 Foreign orders not based on an international agreement Partly covers it
  • Art. 49 Derogations for specific situations Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.5.2. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.5.3 Where PII may be transferred, documented
  • Art. 15 Right of access Partly covers it
  • Art. 30 Records of processing activities Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.5.3. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.5.4 Transfers to and from third parties recorded
  • Art. 30 Records of processing activities Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.5.4. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.1.5.5 Disclosures to third parties recorded
  • Art. 30 Records of processing activities Partly covers it
Extend Your work on the GDPR articles listed supports control A.1.5.5. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
Processor: lawful processing
A.2.2.2 Customer contracts cover help with their obligations
  • Art. 28 Processors and the contract terms they need Partly covers it
  • Art. 35 Data protection impact assessment Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.2.2. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.2.2.3 PII used only for the customer’s documented purposes
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 28 Processors and the contract terms they need Partly covers it
  • Art. 29 Processing only on the controller’s instructions Partly covers it
  • Art. 32 Security of processing Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.2.3. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.2.2.4 No marketing use without the person’s consent
  • Art. 7 Conditions for valid consent Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.2.4. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.2.2.5 Customers told of instructions that seem unlawful
  • Art. 28 Processors and the contract terms they need Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.2.5. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.2.2.6 Customers given what they need to show compliance
  • Art. 28 Processors and the contract terms they need Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.2.6. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.2.2.7 Records that support the processor’s obligations
  • Art. 30 Records of processing activities Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.2.7. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
Processor: people’s rights
A.2.3.2 Customers helped to meet obligations to people
  • Art. 15 Right of access Partly covers it
  • Art. 17 Right to erasure Partly covers it
  • Art. 28 Processors and the contract terms they need Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.3.2. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
Processor: privacy by design
A.2.4.2 Temporary files disposed of on time
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.4.2. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.2.4.3 PII returned, transferred or disposed of securely
  • Art. 28 Processors and the contract terms they need Partly covers it
  • Art. 30 Records of processing activities Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.4.3. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.2.4.4 Transmitted PII reaches only its destination
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.4.4. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
Processor: sharing and subcontractors
A.2.5.2 Customers told the basis for transfers, and of changes
  • Art. 44 The general principle for transfers Partly covers it
  • Art. 46 Transfers with appropriate safeguards Partly covers it
  • Art. 48 Foreign orders not based on an international agreement Partly covers it
  • Art. 49 Derogations for specific situations Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.5.2. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.2.5.3 Where PII may be transferred, documented
  • Art. 30 Records of processing activities Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.5.3. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.2.5.4 Disclosures to third parties recorded
  • Art. 30 Records of processing activities Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.5.4. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.2.5.5 Customers told of legally binding disclosure requests
  • Art. 28 Processors and the contract terms they need Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.5.5. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.2.5.6 Only legally binding disclosures made, customer consulted
  • Art. 48 Foreign orders not based on an international agreement Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.5.6. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.2.5.7 Subcontractors disclosed before use
  • Art. 28 Processors and the contract terms they need Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.5.7. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.2.5.8 Subcontractors engaged only as the contract allows
  • Art. 28 Processors and the contract terms they need Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.5.8. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.2.5.9 Customers told of subcontractor changes, with time to object
  • Art. 28 Processors and the contract terms they need Partly covers it
Extend Your work on the GDPR articles listed supports control A.2.5.9. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
Security for PII
A.3.3 Security policies covering PII processing No counterpart New Nothing in GDPR articles corresponds: new work.
A.3.4 Security roles for PII processing No counterpart New Nothing in GDPR articles corresponds: new work.
A.3.5 Classification that takes PII into account
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 32 Security of processing Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.5. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.6 Labelling that takes PII into account
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.6. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.7 Rules for transferring PII
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.7. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.8 Identities managed through their life cycle No counterpart New Nothing in GDPR articles corresponds: new work.
A.3.9 Access rights to PII granted, reviewed and removed
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.9. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.10 Security terms in supplier agreements
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 28 Processors and the contract terms they need Partly covers it
  • Art. 30 Records of processing activities Partly covers it
  • Art. 32 Security of processing Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.10. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.11 Incident management planned for PII processing
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 33 Notifying the authority of a breach Partly covers it
  • Art. 34 Telling people about a high-risk breach Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.11. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.12 Incidents responded to by procedure
  • Art. 33 Notifying the authority of a breach Partly covers it
  • Art. 34 Telling people about a high-risk breach Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.12. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.13 Legal and contractual security requirements for PII
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 28 Processors and the contract terms they need Partly covers it
  • Art. 30 Records of processing activities Partly covers it
  • Art. 32 Security of processing Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.13. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.14 Records about PII protected
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 24 The controller’s responsibility, and data protection policies Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.14. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.15 Independent review of PII security
  • Art. 32 Security of processing Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.15. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.16 Compliance with security policies checked
  • Art. 32 Security of processing Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.16. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.17 Awareness and training on PII security
  • Art. 39 The DPO’s tasks Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.17. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.18 Confidentiality agreements
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 28 Processors and the contract terms they need Partly covers it
  • Art. 38 The DPO’s position Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.18. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.19 Clear desks and locked screens
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.19. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.20 Storage media holding PII managed
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 32 Security of processing Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.20. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.21 Equipment wiped before disposal or reuse
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.21. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.22 User devices protected
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.22. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.23 Secure authentication
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.23. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.24 Backups, tested
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 32 Security of processing Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.24. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.25 Logging, protected and analysed
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.25. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.26 Cryptography and key management
  • Art. 32 Security of processing Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.26. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.27 Secure development life cycle
  • Art. 25 Data protection by design and by default Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.27. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.28 Security requirements for applications
  • Art. 5 The principles of processing, and accountability for them Partly covers it
  • Art. 32 Security of processing Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.28. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.29 Secure architecture and engineering principles
  • Art. 25 Data protection by design and by default Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.29. Implement it as a control, with its evidence, and record it in your Statement of Applicability.
A.3.30 Outsourced development overseen No counterpart New Nothing in GDPR articles corresponds: new work.
A.3.31 Test data protected
  • Art. 5 The principles of processing, and accountability for them Partly covers it
Extend Your work on the GDPR articles listed supports control A.3.31. Implement it as a control, with its evidence, and record it in your Statement of Applicability.

What to do with each document

The documented information ISO/IEC 27701 requires, and what to do with yours. Tick each one off as you go: the ticks are kept in this browser only.

A route from GDPR to ISO/IEC 27701

  1. Scope and roles

    • Set the PIMS scope and record, per activity, whether you act as controller, processor or both
    • Name top management’s responsibilities

  2. Gap assessment

    • Use Annex D to find the GDPR work behind each control
    • Mark which clauses and controls have no GDPR counterpart

  3. Management system

    • Privacy objectives, risk assessment and treatment, the Statement of Applicability
    • Bring existing policies under document control

  4. Controls

    • Implement the security controls in Table A.3 if there is no ISO/IEC 27001 system
    • Evidence the controller and processor controls from your GDPR records

  5. Run and check

    • Internal audit and management review
    • Measure how rights requests, breaches and DPIAs actually run

  6. Certification

    • Choose an accredited certification body for ISO/IEC 27701:2025
    • Plan the stage 1 and stage 2 audits

Certification and audits

  • ISO/IEC 27701:2025 can now be certified on its own, without ISO/IEC 27001, by an accredited certification body.
  • A certificate shows a managed privacy system. It is not, by itself, a GDPR certification under Articles 42 and 43, which needs a scheme approved by a supervisory authority or the EDPB.

Common pitfalls

  • Treating Annex D as proof that a control is in place. It shows where the topics meet; you still need the control and its evidence.
  • Forgetting the management-system clauses, which have no GDPR counterpart and are most of what the audit tests.
  • Writing one privacy policy that doesn’t separate controller and processor duties.

GDPR and ISO/IEC 27701 at a glance

GDPR ISO/IEC 27701
What it is Law / regulation Certifiable standard
How it applies Legally binding where it applies Voluntary, often required by customers
How you show it No certificate: it is a legal duty, enforced by regulators Certification by an accredited certification body
Where European Union International
Covers Privacy, Information security, Incident response, Third-party risk Privacy, Information security, Audit & assurance
Issued or enforced by European Union; enforced by national supervisory authorities, coordinated through the European Data Protection Board (EDPB) ISO and IEC (ISO/IEC JTC 1/SC 27)
Current edition or status In application since 25 May 2018. The European Commission proposed targeted amendments in its November 2025 Digital Omnibus; these are not law unless and until adopted. ISO/IEC 27701:2025 (published October 2025) replaces the 2019 edition and is now a standalone management-system standard.

Next steps on MajorCyber™

Sources

Open questions

  • Annex D maps to paragraphs of each article; this comparison rolls the mapping up to whole articles. Read the article itself for the exact duty.
The whole comparison in one PDF, with the documents you ticked.

An educational comparison, researched and drafted with AI assistance. A mapping shows where work you have already done supports a requirement; it never means the requirement is met. Your certification body decides what conforms. No standard’s text is reproduced: buy the standards from ISO or your national standards body.