GDPR Article 32 requires technical and organisational measures appropriate to the risk, and names four kinds: pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience, timely restoration after an incident, and regular testing of the measures. An ISO 27001 ISMS evidences all four through specific Annex A controls and the management system clauses, and its risk assessment is the documented basis Article 32(2) asks for. An ISO 27001 certificate is not a GDPR certification under Article 42, and it says nothing about lawful basis, data subject rights, records of processing, impact assessments or transfers. For those, ISO/IEC 27701:2025, now a standalone privacy management standard, and the rest of the GDPR apply.
Article 32 is where the GDPR stops talking about rights and starts talking about controls. It is deliberately technology-neutral, so processors and controllers reach for a recognised standard to show what 'appropriate' means in practice, and ISO 27001 is the one most supervisory authorities and customers recognise. This article maps each element of the article to the controls that evidence it, and is clear about where the standard stops.
Article 32, element by element
| GDPR Article 32 | ISO 27001 clauses and Annex A controls | What the auditor would show |
|---|---|---|
| 32(1) measures appropriate to the risk, considering the state of the art, costs, nature, scope, context and purposes | Clauses 6.1.2 and 6.1.3; the Statement of Applicability | A risk assessment that treats personal data as an asset and a treatment plan that selected the controls because of those risks |
| 32(1)(a) pseudonymisation and encryption of personal data | A.8.24 use of cryptography, A.8.11 data masking, A.8.10 information deletion, A.8.12 data leakage prevention | The cryptography policy, encryption at rest and in transit, masking in non-production environments, deletion records |
| 32(1)(b) ongoing confidentiality, integrity, availability and resilience of systems and services | The ISMS as a whole; A.5.15 to A.5.18 and A.8.2 to A.8.5 (access), A.8.9 (configuration), A.8.15 and A.8.16 (logging and monitoring), A.8.14 (redundancy), A.5.29 (security during disruption) | Access reviews, configuration baselines, monitoring alerts handled, redundancy design, continuity arrangements |
| 32(1)(c) restore availability and access to personal data in a timely manner after an incident | A.8.13 information backup, A.5.30 ICT readiness for business continuity, A.8.14 redundancy, A.5.26 incident response | Backup configuration, restore test results, recovery objectives and the last exercise |
| 32(1)(d) a process for regularly testing, assessing and evaluating the effectiveness of the measures | Clauses 9.1, 9.2 and 9.3; A.5.35 independent review, A.5.36 compliance with policies, A.8.29 security testing, A.8.8 vulnerability management | Measurement results, internal audit reports, management review minutes, penetration test reports and vulnerability scan follow-up |
| 32(2) risks of accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access | Clause 6.1.2 risk criteria and assessment; A.5.34 privacy and protection of PII; A.5.12 and A.5.13 classification and labelling | Personal data classified, the risk register entries for each of those outcomes, and the treatments chosen |
| 32(4) persons acting under the controller's or processor's authority process data only on instructions | A.5.10 acceptable use, A.6.2 terms and conditions of employment, A.6.3 awareness, A.6.6 confidentiality agreements, A.5.15 access control | Signed agreements, policy acknowledgements, training records, access limited to the role |
Two neighbouring articles map the same way. Article 28's processor obligations are evidenced by the supplier controls A.5.19 to A.5.23 and the data processing agreement; Articles 33 and 34 on breaches rely on the incident controls A.5.24 to A.5.28 and A.6.8 for detection and assessment, with the 72-hour notification to the supervisory authority as the GDPR's own addition. The GDPR framework page covers both.
Certification and Article 32(3)
Article 32(3) says adherence to an approved code of conduct under Article 40 or an approved certification mechanism under Article 42 may be used as an element to demonstrate compliance. ISO 27001 is neither: it is not approved by a supervisory authority or the European Data Protection Board as a GDPR certification. It is still evidence, and supervisory authorities and customers treat it as such, because it shows the measures were selected by risk, documented, operated and independently audited. Do not describe an ISO 27001 certificate as GDPR certification in a security review; describe it as evidence of Article 32 measures.
Where ISO 27001 stops
- Lawful basis, purpose limitation and data minimisation (Articles 5 and 6): the ISMS protects data; it does not ask whether you may process it.
- Data subject rights (Articles 12 to 22): access, erasure, portability and objection need processes the ISMS does not contain.
- Records of processing activities (Article 30) and data protection impact assessments (Article 35): the asset inventory helps, but neither document is an ISMS output.
- International transfers (Chapter V): transfer mechanisms and transfer impact assessments are legal instruments, not controls.
- The data protection officer and the relationship with the supervisory authority.
Where ISO 27701 fits
ISO/IEC 27701 adds a privacy information management system with controller- and processor-specific requirements and controls that map onto the GDPR's obligations beyond Article 32. The 2019 edition could only be certified as an extension of an ISO 27001 certificate; the 2025 edition, published in October 2025, is a standalone management system standard with the same high-level structure, so it can be certified on its own or integrated with ISO 27001. For a company whose buyers ask about both security and privacy, the combination of ISO 27001 for Article 32 and ISO 27701 for the rest is the recognisable answer, and still not an Article 42 certification. Noru maps GDPR articles onto the same control library as ISO 27001, with the privacy records, the register of processing activities and impact assessments as their own objects; the privacy automation solution describes that side.