GDPR vs ISO 27701, ISO 27001 and SOC 2: one law, two certificates and a report, and which you need

GDPR vs ISO 27701: the short answer

You do not choose between the GDPR and anything else. If Article 3 reaches you, because you are established in the EU or EEA, or because you offer goods or services to people there or monitor their behaviour, the Regulation applies whether or not you hold a certificate. The real choice is which, if any, of three independent assurances to add on top of a working compliance programme.

Each answers a different question. ISO/IEC 27701 answers "is privacy managed as a system?" ISO/IEC 27001 answers "is information security managed as a system?" SOC 2 answers "did the controls behind this service operate, according to an independent CPA firm?" The GDPR requires the hardest question of all: "is each use of this personal data lawful, and can you prove it?"

Only your own records answer that last one: Articles 5(2) and 24 put the burden of demonstration on the controller.

The four side by side

Prices depend on these drivers, not on the name of the framework; the GDPR compliance cost guide walks through them for the programme itself.

What each one proves, and where it stops

ISO/IEC 27701

The 2025 edition is a standalone management system written for privacy, with Annex A controls for PII controllers, for PII processors and for security shared by both, and an informative mapping to the GDPR. A certificate shows that an accredited body found the system in place and working for its scope. It does not show that a lawful basis was the right one or that a transfer safeguard holds, and it is not a certification approved under Article 42.

ISO/IEC 27001

It covers the security half of the Regulation well. Article 32 asks for measures appropriate to the risk, such as encryption, resilience, restoration and regular testing, and a risk-based ISMS with a Statement of Applicability covering the 93 Annex A controls is a strong way to evidence them. Lawful bases, notices, rights requests and transfers lie outside it.

SOC 2

A Type 2 report tells a client that named controls operated over a period, with any exceptions listed. The privacy category tests personal information against your own notice and commitments, not against the GDPR's articles, so a clean opinion on privacy is still not a legal finding.

Approved GDPR seals

Article 42 allows voluntary mechanisms approved by a supervisory authority or the European Data Protection Board, valid for up to three years; the Board's register lists only a few, Europrivacy among them. Even these, Article 42(4) says, do not reduce the controller's or processor's responsibility.

Which one, or both? A decision table

Start from who is asking, then pick the smallest set that satisfies them.

Running them as one programme

The overlap is large, so a second framework adds far less work than the first when the records are shared. Build one data inventory that feeds both the GDPR record of processing and the PIMS; one risk method that covers risk to the business and risk to the people whose data you hold; one incident procedure that meets the 72-hour notification test and produces the records a certification body or CPA firm samples; one supplier file holding processor agreements, transfer safeguards and security assessments.

A company with ISO/IEC 27001 in place adds the privacy clauses and controls; one starting from nothing can build the GDPR programme and ISO/IEC 27701 together. SOC 2 then draws most of its controls from the same set, with an evidence calendar for the examination period. The GDPR requirements guide explains each article.

Common mistakes when comparing them

• Buying a certificate to solve a legal problem. A client asking about transfers wants the decisions and records, not a logo.
• Scoping the certificate away from the personal data. An ISO/IEC 27001 scope that leaves out the support team handling client records answers the wrong question.
• Running three evidence sets. Separate registers for the GDPR, the PIMS and SOC 2 drift apart within months.
• Treating UK clients as covered automatically. The UK GDPR and the amended Data Protection Act 2018 sit alongside the EU text; the GDPR vs UK GDPR guide sets out what differs.

GDPR, ISO 27701, ISO 27001 and SOC 2: questions buyers ask