Our own servers in Europe · GDPR · Support in your language
English
Let's talk

Module 9 of 9 · ISO 27701 · Anexos C a F

Mapping to the GDPR and ISO 27001

The informative annexes relate the standard to ISO/IEC 29100, the GDPR (Annex D), ISO/IEC 27018 and 29151, and the 2019 edition (Annex F).

Content reviewed on

GDPR (Annex D)

The table shows which controls help meet each article of the Regulation: the record of processing activities in Article 30, the impact assessment in Article 35, the processor contract in Article 28, breach notification in Article 33. It helps organise the evidence, but certification neither equals nor replaces GDPR compliance.

ISO/IEC 27001

Because it is now standalone, the standard no longer requires a certified ISMS. It shares its structure with ISO/IEC 27001, so context, audits, management review and nonconformities can be common to both systems, with the privacy-specific elements kept separate.

Moving from the 2019 edition (Annex F)

Annex F maps the old numbering to the new one. Organisations certified against 2019 can use it to revise their statement of applicability; transition deadlines are set by the certification body.

What an auditor usually asks for

  • A matrix linking each control to the GDPR article it supports
  • Processes shared with ISO 27001 identified
  • A statement of applicability revised to the 2025 numbering
  • A transition plan agreed with the certification body

How to cover the mappings in Kimobox

  1. 1Tag each control with the related GDPR article and ISO 27001 control.
  2. 2Share audits, nonconformities and management review between both systems.
  3. 3Version the statement of applicability to keep both the 2019 and the 2025 versions.

A single integrated system serves ISO 27001 and ISO 27701 without duplicating audits.

See how ISO 27001 works in Kimobox

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

  1. ISO/IEC 27701:2025 — Privacy information management systems. Requirements and guidance ISO/IEC · Second edition, October 2025
  2. ISO/IEC 27701:2019 — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management ISO/IEC · First edition, August 2019; withdrawn in October 2025
  3. Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) EUR-Lex · 27 April 2016; applicable since 25 May 2018
  4. ISO/IEC 27001:2022 — Information security management systems ISO/IEC · 25 October 2022
  5. ISO/IEC 29100:2024 — Privacy framework ISO/IEC · Second edition, February 2024
← Previous Controls for controllers and processors Back to index ISO 27701