ISO 27701 vs GDPR: Do You Need Both?
ISO 27701 vs GDPRce GDPR is on your radar, ISO 27701 tends to show up right behind it — usually in a customer security questionnaire, or a compliance checklist a partner sent over. The two names get used almost interchangeably, which is understandable, since both are about protecting personal data. But they answer different questions, get enforced in different ways, and one of them isn’t optional no matter what you do with the other. This guide lays out what each one actually covers, where they genuinely overlap, and how to decide whether your organization needs GDPR compliance, ISO 27701 certification, or realistically, both at once.
Quick idea: – GDPR is a European Union law — if it applies to you, compliance isn’t a choice. ISO 27701 is a voluntary, certifiable management-system standard that helps you operationalize privacy work (including a lot of what GDPR expects) and prove it to a third party. As of the 2025 edition, ISO 27701 can also be certified as a standalone standard, without needing ISO 27001 first — which makes the “do we need both” question worth revisiting even if you looked at this a year or two ago.
- Different kind of thing entirely: GDPR is a legal instrument enforced by data protection authorities. ISO 27701 is a management-system standard, audited by an accredited certification body — more like SOC 2 or ISO 27001 than a regulation.
- The overlap is real, not marketing: ISO 27701’s Annex D maps its controls directly to specific GDPR articles — records of processing, breach notification, data subject rights, and more — which is exactly why the two get bundled together so often.
- A certificate isn’t a compliance guarantee: Being ISO 27701 certified positions you well for GDPR, but it doesn’t automatically mean you’re GDPR compliant. The standard is neutral to any one law by design.
Important context: – B4Q Assurance helps SaaS companies and data processors get GDPR-ready and ISO 27701 certified — whether that means building a privacy program from a blank page, layering ISO 27701 onto an existing ISMS, or pursuing it standalone under the 2025 edition.
What GDPR Actually Requires
The General Data Protection Regulation has been enforceable since May 2018, and it applies based on whose data you’re touching, not where your company is incorporated. If you process the personal data of people in the EU — as a controller deciding why data is collected, or a processor acting on someone else’s instructions — GDPR applies, full stop.
In practice, that means demonstrating a lawful basis for every kind of processing, running data protection impact assessments for higher-risk activity, honoring data subject rights like access and erasure, notifying regulators of a qualifying breach within 72 hours, and in many cases appointing a data protection officer. None of this is a one-time exercise — it’s ongoing accountability, and regulators expect to see evidence of it, not just a policy that says the right things.
The penalties are the part everyone remembers: fines up to €20 million or 4% of global annual turnover, whichever is higher. That number alone is why GDPR sits above ISO 27701 in the hierarchy — it’s the law you can’t opt out of.
What ISO 27701 Actually Does
ISO/IEC 27701 is an international standard for a Privacy Information Management System (PIMS) — a structured way to identify privacy risk, assign ownership for it, and produce evidence that personal data is actually handled the way your privacy notice claims. Where GDPR tells you what the law expects, ISO 27701 gives you the operational scaffolding to run that work day to day and get it independently audited.
The October 2025 revision reorganized the standard around ISO’s newer harmonized structure and split its controls cleanly by role: 31 controls for organizations acting as a PII controller, and 18 for those acting as a processor, on top of the security controls the PIMS still inherits. The bigger change is that ISO 27701 no longer requires ISO 27001 first — it can be scoped and certified entirely on its own, or layered onto an existing ISMS if you already have one.
GDPR vs ISO 27701, Side by Side
| Aspect | GDPR | ISO 27701 |
|---|---|---|
| What it is | EU law | Voluntary management-system standard |
| Applies because | You process EU residents' personal data | You choose to implement and certify a PIMS |
| Enforced by | National data protection authorities | Accredited certification bodies (audits) |
| Non-compliance means | Fines, investigations, legal action | No certificate — no legal penalty by itself |
| Proves what | Legal accountability under EU law | A working, audited privacy management process |
| Certification (2025) | Not applicable — it's a legal obligation | Standalone, or integrated with ISO 27001 |
Where They Actually Overlap
This is the part most comparisons skip past. ISO 27701:2025 includes an informative annex — Annex D — that maps its own controls to the specific GDPR articles they support. It’s not a marketing claim; it’s built into the standard, and it’s the reason implementing ISO 27701 well tends to move your GDPR posture forward at the same time, rather than being unrelated work.
| GDPR Article | What it requires | Supported by |
|---|---|---|
| Art. 5 – Principles | Lawfulness, purpose limitation, data minimization | Core PIMS risk and processing controls |
| Art. 6 / 7 – Lawful basis & consent | Documented legal basis, valid consent capture | Conditions-for-processing controls (controller annex) |
| Art. 25 – Privacy by design | Data protection built into systems from the start | Risk-based control implementation across the PIMS |
| Art. 28 – Processor obligations | Contracts, sub-processor management, audit rights | Dedicated processor-role control set |
| Art. 30 – Records of processing | A maintained register of processing activities | Processing-activity documentation controls |
| Art. 32–34 – Security & breach notice | Appropriate security; 72-hour breach reporting | Incident and breach management controls |
Worth knowing: – The 2025 edition being standalone changes how you get to ISO 27701 — not what GDPR expects of you. Even a company certifying ISO 27701 on its own, with no ISO 27001 in place, still has to meet GDPR in full if EU residents’ data is in scope. The two decisions — how to build the PIMS, and whether GDPR applies — are separate and shouldn’t get merged in planning.
So, Do You Need Both?
For most organizations that already have EU exposure, this isn’t really an either/or decision — GDPR compliance is the non-negotiable floor, and ISO 27701 is the layer on top that turns that compliance work into something you can show, formally, to a customer or auditor who won’t just take your word for it.
| Your situation | Recommendation |
|---|---|
| EU-facing SaaS, no enterprise security asks yet | GDPR compliance is mandatory. ISO 27701 optional — useful once deals start requiring proof. |
| Global SaaS selling to security-conscious enterprise buyers | Both. GDPR keeps you legal; ISO 27701 gives procurement teams evidence they can check. |
| Processor handling data on a client's instructions | Both, with priority on the processor-role controls and clear contract-level obligations. |
| No EU personal data in scope at all | GDPR isn't mandatory. ISO 27701 can still work as a standalone global privacy signal. |
Common Mistakes We See
- Treating an ISO 27701 certificate as proof of GDPR compliance, when it only supports it
- Running GDPR readiness and ISO 27701 evidence collection as two separate projects that end up duplicating the same work
- Never formally deciding whether you’re a controller or processor for a given dataset, which leaves Article 30 records incomplete
- Assuming the 2025 standalone edition means ISO 27001 and even GDPR obligations became optional — neither changed
- Chasing the certificate before the gap analysis is finished, so the paperwork doesn’t match what’s actually happening
What Each One Actually Gives You
| You get | GDPR compliance | ISO 27701 certification |
|---|---|---|
| Legal protection | Yes — this is the point | No, not directly |
| Regulator standing | Directly relevant | Supporting evidence only |
| Customer/RFP-ready proof | Self-attested | Independently audited certificate |
| Cross-border transfer support | Defines the requirement | Can serve as a safeguard mechanism |
| Ongoing accountability structure | Expected, loosely defined | Ongoing accountability structure |
How B4Q Assurance Helps
B4Q Assurance works with SaaS companies and data processors to close the gap between GDPR obligations and ISO 27701 certification — running the initial privacy gap analysis, clarifying controller and processor responsibilities, and preparing teams for certification under the 2025 edition, whether that’s standalone or integrated with an existing ISMS.
Resources
- General Data Protection Regulation (EU) — official legal text
- ISO/IEC 27701:2025 — official standard listing
FAQs
Does ISO 27701 certification prove we're GDPR compliant?
No. It’s strong supporting evidence — auditors and customers read it as a serious signal — but GDPR compliance depends on your specific processing activities and lawful basis, which the certificate doesn’t verify on its own.
Can we get ISO 27701 certified if GDPR doesn't apply to us at all?
Yes. Since the 2025 edition, ISO 27701 is standalone and regulation-neutral, so it works as a general privacy assurance certificate even without EU data in scope.
Do we need ISO 27001 before we can pursue ISO 27701 now?
Not anymore. The 2025 edition removed that prerequisite, though integrating ISO 27701 with an existing ISMS is still a common and efficient approach if you already have one.
We're a processor, not a controller — does this comparison still apply?
Yes, with a different emphasis. GDPR’s Article 28 processor obligations and ISO 27701’s processor-specific control set are the parts to prioritize — controller-only controls apply less to you.
How long does it take to get both in place?
There’s no fixed number — it depends heavily on how mature your current data-handling documentation already is, and whether GDPR and ISO 27701 work is planned together or bolted on separately.