ISO 27701 was written with GDPR in view, and the standard includes an informative mapping to the regulation. That has produced a persistent shorthand: certify against ISO 27701 and you have covered GDPR.
You have not, and the gap is not small. The mapping shows where a control supports an obligation. It does not show that operating the control meets the obligation, and several GDPR requirements have no real counterpart in the standard at all.
This article walks through where the two line up, where they do not, what an ISO 27701 certificate can and cannot demonstrate under GDPR, and how to use the mapping to run one program instead of two. Nothing here is legal advice; confirm how GDPR applies to your processing with counsel.
Why the mapping exists
ISO 27701 is jurisdiction neutral. It is meant to support compliance with privacy law in general, not with one law. Its mappings to GDPR and other documents are informative, which in ISO terms means they help you interpret the standard but are not requirements you are audited on.
The mapping is most useful as a cross-reference. If you already have a GDPR program, it shows where your existing records and processes can become ISO 27701 evidence. If you are building from the standard, it shows which GDPR article each control is likely to support, so your privacy counsel can check the legal adequacy of what you build.
The edition matters here too. ISO revised ISO/IEC 27701 in 2025, and the presentation of its mappings may differ between editions. Use the mapping in the edition your certification body audits against.
Where the mapping is strong
Most of the operational content of GDPR has a clear home in the standard. The table below pairs common obligations with the area of ISO 27701 that supports them. For a full description of the control sets, see our guide to ISO 27701 controller and processor controls.
| GDPR obligation | Where ISO 27701 supports it |
|---|---|
| Principles and accountability, Article 5 | Management system requirements, documented purposes, minimization objectives |
| Lawful basis and consent, Articles 6 and 7 | Controller controls on identifying lawful basis and recording consent |
| Information and data subject rights, Articles 12 to 22 | Controller controls on obligations to PII principals; processor controls on assisting the customer |
| Data protection by design and by default, Article 25 | Privacy by design and by default controls in both sets |
| Joint controllers, Article 26 | Controller control on joint controller arrangements |
| Processor obligations, Article 28 | Processor controls on customer agreements, instructions, and subcontractors |
| Records of processing, Article 30 | Controller and processor controls on records related to processing PII |
| Security of processing, Article 32 | The ISO 27001 controls with privacy guidance added |
| Breach notification, Articles 33 and 34 | Incident management guidance extended to PII breaches |
| Impact assessment, Article 35 | Controller control on privacy impact assessment |
| International transfers, Articles 44 to 49 | Controls on transfer basis, destination countries, and transfer records |
Two of these rows deserve a closer look.
Article 28 is where processors gain the most. The article requires a contract with specified terms, processing only on documented instructions, prior authorization for subprocessors, and assistance to the controller. The processor controls cover the same ground. A processor that operates them, and has had them audited, can answer much of a customer's Article 28 due diligence with one report.
Article 30 is where controllers gain the most. A processing inventory built to satisfy the standard, with role, purpose, categories, recipients, transfers, and retention for each activity, is very close to an Article 30 record. Our guide to building an Article 30 record of processing lists the fields; build it once and point both programs at it.
Where GDPR asks for more than the standard
The standard tells you to identify and meet your legal obligations. It does not state them. Wherever GDPR sets a specific rule, a deadline, or a legal test, you have to supply it.
Deadlines. GDPR Article 33 requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach. Article 12 sets one month to respond to data subject requests, extendable in some cases. The standard asks for timely handling and records, not these specific clocks.
Legal tests. Whether legitimate interests outweigh an individual's rights, whether processing is "likely to result in a high risk", and whether special category data meets an Article 9 condition are legal judgments. The standard requires you to document the answer. It cannot give it to you. Our guides to choosing a lawful basis and when a DPIA is required cover two of these.
Regulator relationships. Supervisory authority cooperation, the lead authority mechanism, prior consultation under Article 36, and the representative that Article 27 requires of some organizations established outside the EU are GDPR concepts with no equivalent requirement in the standard.
Data protection officer. The standard expects someone accountable for privacy. GDPR Article 37 sets the conditions under which a DPO must be designated, and Articles 38 and 39 define the role's independence and tasks. A privacy lead who meets the standard may not meet those articles.
Transfer mechanisms. The standard asks you to identify the basis for each transfer. GDPR Chapter V defines which bases are valid, and choosing and documenting one, including any supplementary measures, is legal work.
Enforcement. Fines, orders, and individuals' right to compensation sit entirely outside the standard.
What a certificate can and cannot show
An ISO 27701 certificate shows that an accredited certification body audited your PIMS against the standard and found it conforming, within a stated scope. That is meaningful evidence of organized, operating privacy management.
It is not, by itself, a certification under GDPR Article 42. Article 42 certification mechanisms are approved through the regulation's own process, involving supervisory authorities or the European Data Protection Board.
That distinction has consequences. Article 28(5) allows a processor's adherence to an approved certification mechanism to be used as an element in demonstrating sufficient guarantees. Article 24(3) says the same for controllers. An ISO 27701 certificate is still useful evidence in a customer's assessment, but you should not describe it as an approved GDPR certification in a questionnaire, a contract, or a Trust Center.
Using the mapping to run one program
The practical value of the mapping is that it lets one set of controls serve both purposes. Here is a workable approach.
Start from your processing inventory. Record role, purpose, lawful basis, categories, recipients, transfers, and retention once, in one place.
Write controls in operational terms. "Data subject requests are logged on receipt and answered within one month, with extensions recorded" serves both GDPR and the standard. "We respect data subject rights" serves neither.
Tag each control with both references. Record the ISO 27701 control and the GDPR article it supports. When counsel reviews, they review the GDPR column; when the auditor samples, they sample the ISO column.
Keep legal decisions as records. Lawful basis assessments, impact assessments, and transfer decisions become documented evidence that the standard can audit and that a regulator could ask to see.
Fill the gaps explicitly. Add controls for the GDPR-specific items above, even though the standard does not require them in those words.
The same approach works for other privacy laws. The standard's neutrality is an advantage if you are subject to several regimes, because the operational controls are largely shared and only the legal parameters differ. Our explainer on control overlap between frameworks describes the pattern in general.
How TrustLynce helps
TrustLynce maps controls across frameworks so a single control carries both its ISO 27701 and GDPR references, and its evidence is reused for each. Processing records, impact assessments, transfer assessments, and data subject requests live in the data privacy workflows, alongside the GDPR and ISO 27701 framework views.