ISO 27001 does not automatically mean GDPR compliance, but it can help.
Many organisations implement ISO 27001, the standard for an Information Security Management System (ISMS), to help protect their information assets.
ISO 27001 Certification is well recognised, but the standard is not exclusive to Personal Information and GDPR has many additional requirements that need to be addressed.
However, ISO 27001 can be used as the basis of a GDPR compliance regime and combining the two can have many more benefits for your organisation.
Whether you already have ISO 27001 or are implementing it for the first time, Assent Consultants can help you build a management system incorporating GDPR requirements.
Benefits of ISO 27001 + GDPR
Identify Information Assets
GDPR relates to the protection of Personal Identifiable Information (PII), but this is just one type of information that organisations handle.
Integrating GDPR requirements in to an ISO 27001 Management System expands the scope to consider all information that has a value to the company, including commercial data, intangible knowledge of the organisation and more.
Combining all information types under one management system has many benefits including the ability to risk assess and apply controls.
Privacy By Design through Integrated Processes
‘Privacy by Design’ is a core theme of GDPR, so it makes sense to include privacy considerations throughout your Management System(s), including ISO 27001, ISO 9001 and others.
This means not only considering the confidentiality, integrity and availability of information but also how an individual’s privacy might be affected through your processes.
Less Meetings
GDPR has a strong emphasis on ‘Accountability’ while ISO 27001 also requires ‘Leadership’ commitment to be demonstrated. Often this means meetings that involve stakeholders from across the business, resulting in actions.
So why not combine Data Protection issues with your overall Information Security Management Meetings to get a wider view of data within your organisation, and cut down on meetings!
Using ISO 27001 for GDPR
ISO 27001 is a well recognised standard that, if implemented and adapted correctly, can make GDPR compliance much easier.
Our Consultants have knowledge and experience of both ISO 27001 and Data Protection Legislation including GDPR.
We can help you adapt an existing ISO 27001 Management System or implement from scratch, leading to UKAS Accredited ISO 27001 Certification.
What Does ISO 27001 Certification Mean?
Achieving ISO 27001 Certification demonstrates that your Information Security Management System (ISMS) has been impartially assessed by a third party Certification Body, and they have found you to have implemented the requirements of the Standard.
ISO 27001 Certification does not provide any assurance that you are GDPR compliant, or that these requirements were audited.
However, by integrating GDPR with your ISO 27001 Management System, you will be able to easily demonstrate to customers and data subjects how you are complying with data protection legislation, and there will be an evidence trail to demonstrate your accountability.
5 Key Areas you can use ISO 27001 for GDPR
ISO Standards can be used as the basis to manage governance, risk and compliance across many disciplines, and in this case, if structured correctly, ISO 27001 can be used for GDPR.
Read our blog to discover 5 Key Areas you can use ISO 27001 for GDPR.
Is there a GDPR Standard?
There are various standards which support the management of personal information, including BS 10012, a British Standard for Personal Information Management Systems.
However, for organisations who have implemented ISO 27001, or plan to so, we recommend the Privacy Management add-on standard, ISO 27701. This provides additional security controls that can be easily integrated in to your existing management system.
For help with GDPR and Information Governance over all contact us.
