Crossbearing · standards comparison

ISO/IEC 27701 to GDPR

What you can reuse, what to extend and what is new when you add GDPR to ISO/IEC 27701.

Compare another pair

I already have I want to add

What carries over from ISO/IEC 27701 to GDPR

Your PIMS supports most of the GDPR, but it doesn’t comply for you. Annex D maps the standard’s controls to Articles 5 to 49, and a working PIMS gives you the records and processes the regulation expects. What it can’t do is make the legal judgements: lawful bases, whether a breach must be notified, whether a transfer is lawful. Those stay with you.

Of the 43 clauses and controls GDPR asks for: 43 to extend.

43 Extend Keep what you have and add the new standard’s content.

Clause and control numbers checked against ISO/IEC 27701 and GDPR themselves; descriptions are MajorCyber™’s own words. Links from ISO/IEC 27701:2025 Annex D, with notes and actions by MajorCyber™, last checked 24 October 2026. Going the other way? GDPR to ISO/IEC 27701

Built on your device, with the documents you tick below. Nothing is uploaded.

Do I need to rewrite my policies?

No, if your PIMS policies are current. Check that they name the GDPR’s specific duties — lawful bases, the Article 30 record, the 72-hour breach clock, DPIAs and transfers — rather than privacy in general.

Controls: GDPR articles, against ISO/IEC 27701 Annex A

Each GDPR article from 5 to 49, with the ISO/IEC 27701 clauses and controls that Annex D ties to it.

GDPR articles controls, with the ISO/IEC 27701 Annex A controls that support each
GDPR control	Supported by your ISO/IEC 27701	What to do
Principles and lawful processing
Art. 5 The principles of processing, and accountability for them	A.3.5 Classification that takes PII into account Partly covers it A.3.6 Labelling that takes PII into account Partly covers it A.3.7 Rules for transferring PII Partly covers it A.3.9 Access rights to PII granted, reviewed and removed Partly covers it A.3.10 Security terms in supplier agreements Partly covers it A.3.11 Incident management planned for PII processing Partly covers it A.3.13 Legal and contractual security requirements for PII Partly covers it A.3.14 Records about PII protected Partly covers it A.3.18 Confidentiality agreements Partly covers it A.3.19 Clear desks and locked screens Partly covers it A.3.20 Storage media holding PII managed Partly covers it A.3.21 Equipment wiped before disposal or reuse Partly covers it A.3.22 User devices protected Partly covers it A.3.23 Secure authentication Partly covers it A.3.24 Backups, tested Partly covers it A.3.25 Logging, protected and analysed Partly covers it A.3.28 Security requirements for applications Partly covers it A.3.31 Test data protected Partly covers it A.1.2.2 Purposes identified and documented Partly covers it A.1.2.3 Lawful basis identified and shown Partly covers it A.1.2.7 Written contracts with PII processors Partly covers it A.1.2.9 Records that support processing obligations Partly covers it A.1.3.7 Access, correction and erasure Partly covers it A.1.4.2 Collection limited to what is needed Partly covers it A.1.4.4 PII kept accurate and up to date Partly covers it A.1.4.5 Minimisation objectives and how they are met Partly covers it A.1.4.6 De-identified or deleted when no longer needed Partly covers it A.1.4.7 Temporary files disposed of on time Partly covers it A.1.4.9 Disposal policies and procedures Partly covers it A.1.4.10 Transmitted PII reaches only its destination Partly covers it A.2.2.3 PII used only for the customer’s documented purposes Partly covers it A.2.4.2 Temporary files disposed of on time Partly covers it A.2.4.4 Transmitted PII reaches only its destination Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 5. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 6 A lawful basis for every processing	A.1.2.3 Lawful basis identified and shown Partly covers it A.1.4.6 De-identified or deleted when no longer needed Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 6. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 7 Conditions for valid consent	A.1.2.5 Consent obtained and recorded Partly covers it A.1.3.5 A way to change or withdraw consent Partly covers it A.2.2.4 No marketing use without the person’s consent Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 7. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 8 Children’s consent to online services	A.1.2.3 Lawful basis identified and shown Partly covers it A.1.2.4 A process for when and how consent is sought Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 8. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 9 Special categories of personal data	A.1.2.3 Lawful basis identified and shown Partly covers it A.1.2.5 Consent obtained and recorded Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 9. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 10 Data about criminal convictions and offences	A.1.2.3 Lawful basis identified and shown Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 10. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 11 Processing that doesn’t need identification	A.1.3.3 Deciding what people are told, and when Partly covers it A.1.3.4 Clear information given to people Partly covers it A.1.4.6 De-identified or deleted when no longer needed Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 11. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
People’s rights
Art. 12 Clear information and how rights requests are handled	A.1.3.2 Obligations to people identified and met Partly covers it A.1.3.4 Clear information given to people Partly covers it A.1.3.10 Procedures for handling requests Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 12. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 13 Information when data is collected from the person	A.1.3.3 Deciding what people are told, and when Partly covers it A.1.3.4 Clear information given to people Partly covers it A.1.3.5 A way to change or withdraw consent Partly covers it A.1.3.6 A way to object to processing Partly covers it A.1.3.7 Access, correction and erasure Partly covers it A.1.3.11 Obligations from automated decisions about people Partly covers it A.1.4.8 Kept no longer than its purposes need Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 13. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 14 Information when data comes from elsewhere	A.1.3.3 Deciding what people are told, and when Partly covers it A.1.3.5 A way to change or withdraw consent Partly covers it A.1.3.6 A way to object to processing Partly covers it A.1.3.7 Access, correction and erasure Partly covers it A.1.3.11 Obligations from automated decisions about people Partly covers it A.1.4.8 Kept no longer than its purposes need Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 14. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 15 Right of access	A.1.3.3 Deciding what people are told, and when Partly covers it A.1.3.9 A copy of their PII for people who ask Partly covers it A.1.3.10 Procedures for handling requests Partly covers it A.1.5.2 Basis for transfers between jurisdictions Partly covers it A.1.5.3 Where PII may be transferred, documented Partly covers it A.2.3.2 Customers helped to meet obligations to people Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 15. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 16 Right to rectification	A.1.3.7 Access, correction and erasure Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 16. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 17 Right to erasure	A.1.2.3 Lawful basis identified and shown Partly covers it A.1.3.7 Access, correction and erasure Partly covers it A.2.3.2 Customers helped to meet obligations to people Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 17. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 18 Right to restriction of processing	A.1.2.3 Lawful basis identified and shown Partly covers it A.1.3.3 Deciding what people are told, and when Partly covers it A.1.3.5 A way to change or withdraw consent Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 18. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 19 Telling recipients about rectification, erasure or restriction	A.1.3.8 Third parties told of changes, withdrawals and objections Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 19. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 20 Right to data portability	A.1.3.9 A copy of their PII for people who ask Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 20. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 21 Right to object	A.1.3.3 Deciding what people are told, and when Partly covers it A.1.3.4 Clear information given to people Partly covers it A.1.3.6 A way to object to processing Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 21. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 22 Automated decisions, including profiling	A.1.2.3 Lawful basis identified and shown Partly covers it A.1.3.11 Obligations from automated decisions about people Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 22. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Controllers and processors
Art. 24 The controller’s responsibility, and data protection policies	Clause 4.1 Context Partly covers it Clause 5.2 Policy Partly covers it A.3.14 Records about PII protected Partly covers it A.1.2.9 Records that support processing obligations Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 24. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 25 Data protection by design and by default	Clause 4.1 Context Partly covers it A.3.27 Secure development life cycle Partly covers it A.3.29 Secure architecture and engineering principles Partly covers it A.1.4.3 Processing limited to what is needed Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 25. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 26 Joint controllers	A.1.2.8 Roles agreed with joint controllers Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 26. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 27 Representatives of organisations outside the EU	Clause 5.3 Roles Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 27. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 28 Processors and the contract terms they need	Clause 4.1 Context Partly covers it A.3.10 Security terms in supplier agreements Partly covers it A.3.13 Legal and contractual security requirements for PII Partly covers it A.3.18 Confidentiality agreements Partly covers it A.1.2.7 Written contracts with PII processors Partly covers it A.2.2.2 Customer contracts cover help with their obligations Partly covers it A.2.2.3 PII used only for the customer’s documented purposes Partly covers it A.2.2.5 Customers told of instructions that seem unlawful Partly covers it A.2.2.6 Customers given what they need to show compliance Partly covers it A.2.3.2 Customers helped to meet obligations to people Partly covers it A.2.4.3 PII returned, transferred or disposed of securely Partly covers it A.2.5.5 Customers told of legally binding disclosure requests Partly covers it A.2.5.7 Subcontractors disclosed before use Partly covers it A.2.5.8 Subcontractors engaged only as the contract allows Partly covers it A.2.5.9 Customers told of subcontractor changes, with time to object Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 28. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 29 Processing only on the controller’s instructions	A.2.2.3 PII used only for the customer’s documented purposes Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 29. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 30 Records of processing activities	A.3.10 Security terms in supplier agreements Partly covers it A.3.13 Legal and contractual security requirements for PII Partly covers it A.1.2.9 Records that support processing obligations Partly covers it A.1.5.2 Basis for transfers between jurisdictions Partly covers it A.1.5.3 Where PII may be transferred, documented Partly covers it A.1.5.4 Transfers to and from third parties recorded Partly covers it A.1.5.5 Disclosures to third parties recorded Partly covers it A.2.2.7 Records that support the processor’s obligations Partly covers it A.2.4.3 PII returned, transferred or disposed of securely Partly covers it A.2.5.3 Where PII may be transferred, documented Partly covers it A.2.5.4 Disclosures to third parties recorded Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 30. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 31 Cooperating with the supervisory authority	Clause 4.2 Interested parties Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 31. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Security and breaches
Art. 32 Security of processing	Clause 4.1 Context Partly covers it Clause 4.3 Scope Partly covers it Clause 4.4 The management system Partly covers it Clause 6.1.2 Risk assessment Partly covers it Clause 6.1.3 Risk treatment Partly covers it A.3.5 Classification that takes PII into account Partly covers it A.3.10 Security terms in supplier agreements Partly covers it A.3.13 Legal and contractual security requirements for PII Partly covers it A.3.15 Independent review of PII security Partly covers it A.3.16 Compliance with security policies checked Partly covers it A.3.20 Storage media holding PII managed Partly covers it A.3.24 Backups, tested Partly covers it A.3.26 Cryptography and key management Partly covers it A.3.28 Security requirements for applications Partly covers it A.1.2.2 Purposes identified and documented Partly covers it A.1.4.6 De-identified or deleted when no longer needed Partly covers it A.2.2.3 PII used only for the customer’s documented purposes Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 32. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 33 Notifying the authority of a breach	A.3.11 Incident management planned for PII processing Partly covers it A.3.12 Incidents responded to by procedure Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 33. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 34 Telling people about a high-risk breach	A.3.11 Incident management planned for PII processing Partly covers it A.3.12 Incidents responded to by procedure Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 34. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Impact assessment and DPOs
Art. 35 Data protection impact assessment	Clause 4.2 Interested parties Partly covers it A.1.2.6 Privacy impact assessment for new or changed processing Partly covers it A.2.2.2 Customer contracts cover help with their obligations Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 35. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 36 Prior consultation with the authority	Clause 4.2 Interested parties Partly covers it A.1.2.6 Privacy impact assessment for new or changed processing Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 36. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 37 Designating a data protection officer	Clause 5.3 Roles Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 37. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 38 The DPO’s position	Clause 5.3 Roles Partly covers it A.3.18 Confidentiality agreements Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 38. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 39 The DPO’s tasks	Clause 5.3 Roles Partly covers it A.3.17 Awareness and training on PII security Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 39. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Codes of conduct and certification
Art. 40 Codes of conduct	Clause 4.1 Context Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 40. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 41 Monitoring of approved codes	Clause 4.1 Context Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 41. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 42 Certification	Clause 4.1 Context Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 42. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
International transfers
Art. 44 The general principle for transfers	A.1.5.2 Basis for transfers between jurisdictions Partly covers it A.2.5.2 Customers told the basis for transfers, and of changes Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 44. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 45 Transfers on the basis of an adequacy decision	A.1.5.2 Basis for transfers between jurisdictions Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 45. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 46 Transfers with appropriate safeguards	A.1.5.2 Basis for transfers between jurisdictions Partly covers it A.2.5.2 Customers told the basis for transfers, and of changes Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 46. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 47 Binding corporate rules	A.1.5.2 Basis for transfers between jurisdictions Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 47. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 48 Foreign orders not based on an international agreement	A.1.5.2 Basis for transfers between jurisdictions Partly covers it A.2.5.2 Customers told the basis for transfers, and of changes Partly covers it A.2.5.6 Only legally binding disclosures made, customer consulted Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 48. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.
Art. 49 Derogations for specific situations	A.1.5.2 Basis for transfers between jurisdictions Partly covers it A.2.5.2 Customers told the basis for transfers, and of changes Partly covers it	Extend The ISO/IEC 27701 clauses and controls listed support Art. 49. Check them against the article itself: Annex D is indicative, and the legal duty stays yours.

A route from ISO/IEC 27701 to GDPR

01
Legal map
- List the GDPR duties that apply to you, using Annex D as a checklist only
- Confirm the lawful basis for every processing activity
02
Records
- Check the Article 30 record against your PIMS inventory
- Keep DPIAs under Article 35 for high-risk processing
03
People’s rights
- Test that every right can be exercised within one month
- Check notices against Articles 13 and 14
04
Breaches and transfers
- Make sure the breach procedure meets the 72-hour clock in Article 33
- Check each transfer outside the EEA against Chapter V
05
Accountability
- Decide whether you need a DPO or an EU representative
- Keep the evidence an authority would ask for

Certification and audits

There is no certificate of “GDPR compliance”. Article 42 certifications exist, but only under schemes approved by a supervisory authority or the EDPB.
Your ISO/IEC 27701 certificate is good evidence of accountability under Articles 5(2) and 24, but an authority judges compliance case by case.

Common pitfalls

Assuming certification means compliance. The standard itself calls Annex D indicative and leaves the legal assessment to you.
Missing the duties with no control behind them in Annex D, such as restrictions under Article 23 or dealing with an authority’s own inquiry.
Applying the PIMS to the wrong role: many organisations are controllers for some processing and processors for other processing.

ISO/IEC 27701 and GDPR at a glance

ISO/IEC 27701 and GDPR side by side
Fact	ISO/IEC 27701	GDPR
What it is	Certifiable standard	Law / regulation
How it applies	Voluntary, often required by customers	Legally binding where it applies
How you show it	Certification by an accredited certification body	No certificate: it is a legal duty, enforced by regulators
Where	International	European Union
Covers	Privacy, Information security, Audit & assurance	Privacy, Information security, Incident response, Third-party risk
Issued or enforced by	ISO and IEC (ISO/IEC JTC 1/SC 27)	European Union; enforced by national supervisory authorities, coordinated through the European Data Protection Board (EDPB)
Current edition or status	ISO/IEC 27701:2025 (published October 2025) replaces the 2019 edition and is now a standalone management-system standard.	In application since 25 May 2018. The European Commission proposed targeted amendments in its November 2025 Digital Omnibus; these are not law unless and until adopted.

Next steps on MajorCyber™

Sources

Open questions

Annex D maps to paragraphs of each article; this comparison rolls the mapping up to whole articles. Read the article itself for the exact duty.

The whole comparison in one PDF, with the documents you ticked.

An educational comparison, researched and drafted with AI assistance. A mapping shows where work you have already done supports a requirement; it never means the requirement is met. Your certification body decides what conforms. No standard’s text is reproduced: buy the standards from ISO or your national standards body.