Analyses & Case Studies
GDPR for Business: How ISO 27701 Proves Compliance
Eight years after the GDPR came into force, the most common question from companies is still the same: “How do we prove we are compliant?” The problem is that the GDPR says what you must achieve, but not how to organise it and – most importantly – how to prove it to a client, a partner or the data protection authority during an inspection.
This is precisely the gap that ISO 27701 fills – the international standard for a privacy information management system. In this guide we will look at how GDPR and ISO 27701 relate to each other, what changed with the new standalone 2025 edition, and why more and more contracts require a certificate rather than a self-declaration.
Key takeaways
- GDPR (Regulation (EU) 2016/679) is a mandatory law, in force since 25 May 2018. ISO 27701 is a voluntary standard that builds the compliance system.
- Since 2025, ISO/IEC 27701 is a standalone standard – no longer an extension to ISO 27001. You can build a privacy information management system (PIMS) without necessarily being certified to 27001.
- ISO 27701 is not mandatory for GDPR and is not in itself a “GDPR compliance certificate” – but it is the most structured, auditable way to demonstrate due diligence.
- GDPR sanctions reach up to EUR 20 million or 4% of annual worldwide turnover (whichever is higher).
- The supervisory authority in Bulgaria is the Commission for Personal Data Protection (CPDP).
- The standard covers both roles – controller and processor – which is key for firms that process data on behalf of clients.
What is the GDPR and whom does it bind?
The GDPR (General Data Protection Regulation), or Regulation (EU) 2016/679, is the European regulation on the protection of natural persons with regard to the processing of personal data. As a regulation it has direct effect – it applies uniformly across all member states. In Bulgaria it is supplemented by the Personal Data Protection Act (PDPA).
In practice it binds every organisation that processes the personal data of individuals in the EU – regardless of size. A small accounting firm, an online shop, a software house processing data for a foreign client, or a hospital – all fall within scope. “We are a small firm, it does not apply to us” is the costliest misconception in this area.
What is ISO 27701?
ISO/IEC 27701 is the international standard for a privacy information management system (PIMS). It defines the requirements for establishing, implementing, maintaining and continually improving the processes for handling personal data – for both controllers and processors.
Important change for 2026: the ISO/IEC 27701:2025 edition redrafted the standard into a standalone management system. The previous 2019 version worked only as an extension to ISO 27001. You can now implement a PIMS without an established information security system – although the two remain naturally connected.
GDPR vs ISO 27701: what is the difference?
The shortest explanation: GDPR is the law, ISO 27701 is the system that proves you are complying with it.
| Criterion | GDPR | ISO 27701 |
|---|---|---|
| Legal nature | Mandatory EU regulation | Voluntary international standard |
| What it defines | The rights of data subjects and the obligations | The processes through which those obligations are met |
| Outcome | Compliance (or a sanction for failure) | A certificate from an accredited body |
| Provability | Difficult – relies on internal records | Audited by an independent third party |
| Roles covered | Controller and processor | Explicit requirements for both roles |
| Sanction | Up to EUR 20 million or 4% of turnover | Withdrawal of the certificate, loss of contracts |
A common misconception: “We have ISO 27701, so we are 100% GDPR compliant.” Not automatically. The standard covers most of the organisational and technical requirements, but specific legal obligations (for example the legal basis for processing or particular notifications) must be addressed separately. ISO 27701 is evidence of due diligence, not legal immunity.
How ISO 27701 covers the GDPR requirements
The standard is structured to respond directly to the key chapters of the regulation:
- Data subject rights – procedures for access, rectification, erasure (“the right to be forgotten”) and portability.
- Legal bases and consent – management of consents and of the legal bases for processing.
- Impact assessment (DPIA) – a process for assessing the risk to the rights and freedoms of data subjects.
- Breach notification – a procedure for response and notification of the authority within the 72-hour deadline.
- Relations with processors – control over subcontractors and processing agreements.
- Data transfers – mechanisms for the international transfer of personal data.
The link to ISO 27001 and information security
Although now standalone, ISO 27701 conceptually builds on the logic of ISO 27001. The reason is simple: you cannot protect the privacy of data without first protecting the information itself. That is why in practice most organisations implement both standards together – 27001 for security, 27701 for privacy.
If information security is a new topic for you, start with our article on what ISO 27001 is and why security is mandatory. And if you fall within the scope of NIS2, see our analysis of ISO 27001 vs NIS2 – the three frameworks (GDPR, NIS2 and the ISO standards) are increasingly implemented together.
Processing personal data and want to prove it?
We help companies build a privacy information management system to ISO 27701, aligned with the GDPR – from a gap analysis to the certification audit.
The path to certification: 6 steps
- Map the data. What personal data you collect, from where, where it is stored and with whom it is shared (data mapping).
- Determine the roles. When you are a controller and when a processor – the obligations differ.
- Gap analysis. A comparison of current practices against the GDPR and ISO 27701.
- Build the PIMS. Policies, procedures for data subject rights, consent management, DPIA, breach response.
- Train the team. Data protection is primarily a human, not a technical, problem.
- Certification audit. Assessment by an accredited body – make sure it is accredited so the certificate is recognised.
Conclusion
The GDPR is not going away, and the requirements to prove compliance will only grow – especially with the rise of artificial intelligence, which processes ever more personal data (a topic we cover in our article on ISO 42001). ISO 27701 turns the abstract “we comply with the GDPR” into an auditable, recognised asset that opens doors to clients and markets.
If you want to assess your readiness, see our ISO 27001 page, the full list of ISO standards, or our consulting services.
Frequently asked questions
Is ISO 27701 mandatory for GDPR compliance?
No. The GDPR is a mandatory law, but it does not require a specific standard. ISO 27701 is voluntary and is not a “GDPR certificate” in the legal sense. It is, however, the most structured and auditable way to demonstrate that you have taken the appropriate organisational and technical measures – which carries real weight with clients, partners and the supervisory authority.
What is the difference between ISO 27001 and ISO 27701?
ISO 27001 protects information as a whole (confidentiality, integrity, availability). ISO 27701 focuses specifically on the protection of personal data and compliance with requirements such as the GDPR. Since the 2025 edition, ISO 27701 is a standalone standard, but in practice the two are implemented together, because data protection builds on information security.
What are the GDPR sanctions?
The GDPR provides for administrative fines of up to EUR 20 million or up to 4% of the annual worldwide turnover of the undertaking – whichever is higher. For less serious infringements the cap is EUR 10 million or 2% of turnover. In Bulgaria the sanctions are imposed by the Commission for Personal Data Protection.
Who is the data protection authority in Bulgaria?
The Commission for Personal Data Protection (CPDP). It reviews complaints, carries out inspections, issues guidance and imposes sanctions for breaches of the GDPR and the PDPA. The CPDP does not issue ISO certificates – ISO 27701 certification is performed by accredited certification bodies.
Do I need ISO 27001 to implement ISO 27701?
Since the 2025 edition this is no longer mandatory – ISO 27701 became a standalone management system and can be implemented separately. In practice, however, most organisations implement both standards together, since the protection of personal data is built on the information security measures defined in ISO 27001.
How long does implementing ISO 27701 take?
For an organisation that already maintains ISO 27001 – between 3 and 5 months. For a firm building both information security and data protection from scratch, a realistic timeframe is 6 to 9 months. The determining factors are the volume and sensitivity of the data processed and the number of processes involving personal data.