The 2019 edition extended ISO 27001 with privacy requirements and could only be certified alongside an ISO 27001 certificate. The 2025 edition is a standalone management system standard with the same clause structure, so an organization can certify its privacy management without first certifying its security management, although most still combine the two in an integrated management system.
It separates the requirements for controllers from those for processors, the same roles GDPR uses, and is a common way to evidence a privacy programme to European buyers. The GDPR framework page covers the regulation itself.
Read more
Related terms
- GDPR
- The GDPR is the EU General Data Protection Regulation, which governs how personal data of people in the EU is processed and protected.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.
- Information security management system
- An information security management system is the set of policies, processes and responsibilities an organization uses to manage information security risk.
- Integrated management system
- An integrated management system is one set of policies, processes, audits and reviews that satisfies several ISO management system standards at the same time.
- Record of processing activities
- A record of processing activities is the GDPR Article 30 record of what personal data is processed, why, about whom, where it goes and for how long.