GDPR vs Cyber Essentials
GDPR · UK Cyber Essentials (NCSC) · data 2026-10-27
Requirement-level comparison of GDPR and UK Cyber Essentials (NCSC), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 5 UK Cyber Essentials (NCSC) requirements, 2 map to something in GDPR, 2 are only loosely related, and 1 have no mapping in our data.
Cyber Essentials certifies five technical controls only; governance, risk assessment, incident response and backup are deliberately outside its scope. All links are editorial.
Likely new work: Cyber Essentials requirements with no mapping to GDPR (1)
| Cyber Essentials | Requirement | Match | GDPR | Evidence |
|---|---|---|---|---|
| Technical controls · 1 | ||||
| CE 5 | Malware protection | No mapping in our data | — | No mapping to GDPR in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (2)
| Cyber Essentials | Requirement | Match | GDPR | Evidence |
|---|---|---|---|---|
| Technical controls · 2 | ||||
| CE 1 | Firewalls | Art.28(1) | Only shares CSF PR.IR-01: related, not a mapping | |
| CE 2 | Secure Configuration | Art.25(2)Art.28(1)Art.32(1)(b) | Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping | |
Mapped (2)
| Cyber Essentials | Requirement | Match | GDPR | Evidence |
|---|---|---|---|---|
| Technical controls · 2 | ||||
| CE 3 | Security Update Management | Editorial | Art.30(1)Art.32(1)(d) | Same topic: Asset Management, Vulnerability Mgmt (editorial pick) |
| CE 4 | User Access Control | Editorial | Art.25(2)Art.28(1)Art.32(1)(b) | Same topic: Access Control, Cloud Security (editorial pick) |
Of 13 GDPR requirements, 4 map to something in Cyber Essentials, 0 are only loosely related, and 9 have no mapping in our data.
GDPR is a privacy law: only its security-related articles are mapped here, and all mappings are editorial.
Likely new work: GDPR requirements with no mapping to Cyber Essentials (9)
| GDPR | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| Requirements · 9 | ||||
| Art.5 | Principles relating to processing of personal data | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.24 | Responsibility of the controller | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.29 | Processing under the authority of the controller or processor | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.33 | Notification of a personal data breach to the supervisory authority | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.34 | Communication of a personal data breach to the data subject | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.35 | Data protection impact assessment | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.37 | Designation of the data protection officer | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.38 | Position of the data protection officer | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.39 | Tasks of the data protection officer | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
Mapped (4)
| GDPR | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| Requirements · 4 | ||||
| Art.25 | Data protection by design and by default | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| Art.28 | Processor | Editorial | CE 4 | Same topic: Cloud Security (editorial pick) |
| Art.30 | Records of processing activities | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| Art.32 | Security of processing | Editorial | CE 4CE 3 | Same topic: Access Control, Vulnerability Mgmt (editorial pick) |
By topic
Both cover (4):
Only GDPR (19):
Only Cyber Essentials (7):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.