GDPR's security articles mapped: the security half of a privacy law
GDPR is mostly about lawful use of personal data, but a handful of its articles are security requirements in all but name. Here is how they line up with the frameworks security teams already use.
GDPR is a privacy law. Most of it is about whether you may process personal data at all, how you tell people about it, and what rights they have. But several articles impose security duties, and those are where security teams meet the regulation. ControlMapping maps only those articles: integrity and confidentiality (Article 5(1)(f)), accountability (24), data protection by design (25), processors (28), records of processing (30), security of processing (32), breach notification (33 and 34), impact assessments (35) and data protection officers (37 to 39).
How ISO 27001 covers them
Of the 13 GDPR security-related articles, 12 (92%) map to something in ISO 27001, 0 are only loosely related and 1 have no mapping in our data. Open the gap report →
Nearly every security-related GDPR article maps to ISO 27001. An ISMS gives you risk-based security measures (Article 32), incident management that can feed breach notification (Articles 33 and 34), supplier controls for processors (Article 28) and documented responsibilities. The one article with no ISO mapping is Article 38, the position of the data protection officer, which is about independence and reporting lines that ISO 27001 doesn't address.
Article by article
| GDPR | Requirement | Match | ISO 27001 |
|---|---|---|---|
| Art.5(1)(e) | Principles relating to processing of personal data | Editorial | A.5.14A.8.10A.8.11A.5.31 |
| Art.24(1) | Responsibility of the controller | Editorial | Clause 6.1.1Clause 6.1.3A.5.37Clause 5.2 |
| Art.25(1) | Data protection by design and by default | Editorial | A.8.25A.8.26A.8.28A.8.29 |
| Art.28(1) | Processor | Editorial | A.5.19A.5.20A.5.21A.5.22 |
| Art.29 | Processing under the authority of the controller or processor | Editorial | A.6.1A.6.4A.8.16 |
| Art.30(1) | Records of processing activities | Editorial | A.5.9A.5.11A.7.14 |
| Art.32(1)(a) | Security of processing | Editorial | A.8.24A.5.16A.5.18A.5.29 |
| Art.33(1) | Notification of a personal data breach to the supervisory authority | Editorial | A.5.5A.5.24A.5.25A.5.26 |
| Art.34(1) | Communication of a personal data breach to the data subject | Editorial | A.5.5A.5.26A.6.8Clause 7.4 |
| Art.35(1) | Data protection impact assessment | Editorial | Clause 6.1.2Clause 6.1.3 |
| Art.37(1) | Designation of the data protection officer | Editorial | A.5.2A.5.4 |
| Art.38 | Position of the data protection officer | No mapping in our data | — |
| Art.39(1) | Tasks of the data protection officer | Editorial | A.5.2A.5.4A.6.3Clause 7.3 |
What GDPR adds that ISO 27001 doesn't
Even within the security articles, GDPR is more specific in places:
- Breach notification deadlines. Notify the supervisory authority within 72 hours of becoming aware of a personal data breach (Article 33), and affected people without undue delay when the risk to them is high (Article 34). ISO requires incident management, not regulatory notification on a clock.
- Pseudonymisation and encryption are named in Article 32 as measures to consider.
- Data protection by design and by default (Article 25) reaches into how systems are built and configured, not just secured.
- Impact assessments (Article 35) for high-risk processing are a privacy assessment, broader than an ISO security risk assessment.
The other direction
Of the 123 ISO 27001 Annex A controls and ISMS clauses, 47 (38%) map to something in GDPR, 47 are only loosely related and 29 have no mapping in our data. Open the gap report →
Going from GDPR to ISO 27001, most of Annex A maps or is loosely related, but the ISMS clauses, physical security and a few technical controls have no GDPR counterpart. GDPR doesn't require a management system or prescribe technical controls; it requires measures appropriate to the risk and lets you choose.
How to use the overlap
- Treat Article 32 as a requirement of your ISMS: list it in the legal and contractual requirements (ISO A.5.31) and refer to it from the risk assessment.
- Extend the incident process for personal data breaches: a decision on whether to notify, the 72-hour clock, and records of every breach, notified or not (Article 33(5)).
- Use supplier controls for processors, with Article 28 terms in contracts.
- Look beyond security for privacy: ISO/IEC 27701 extends an ISMS to privacy management.
Every GDPR link on this site is ControlMapping's editorial judgement, because no official crosswalk exists. The ISO 27001 vs GDPR comparison and the GDPR framework page list each mapping with its reason, and the gap analysis exports them.
Questions
What does GDPR Article 32 require?
Security of processing: appropriate technical and organisational measures for a level of security appropriate to the risk, including, where appropriate, pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience, timely restoration after an incident, and regular testing of the measures.
Does ISO 27001 make you GDPR compliant?
No. It supports the security obligations, especially Article 32, but GDPR also requires a lawful basis, transparency, data-subject rights and much else that ISO 27001 doesn't cover.
Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.
Related posts
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-27Cyber Essentials vs the Essential Eight: two national baselines comparedThe UK's Cyber Essentials and Australia's Essential Eight both target common attacks, but they cover different ground. What overlaps, what doesn't, and why.
Analysis · 2026-10-27DORA vs NIS2: what a NIS2 programme already coversDORA and NIS2 share most of their security content, but DORA adds a register, contract terms and threat-led testing. Article by article, what carries over.