ISO 27701 and GDPR: how a PIMS evidences accountability under data protection law

What does accountability mean under data protection law?

Accountability is the duty to show, not merely to state, that personal data is handled lawfully. The GDPR puts it plainly: Article 5(2) makes the controller responsible for compliance with the principles and for being able to demonstrate it, and Article 24 asks for measures that prove processing follows the Regulation. India's DPDP Act makes the Data Fiduciary responsible for compliance, including for what its Data Processors do. Singapore's PDPA names an Accountability Obligation and expects policies and practices to be available on request.

The test arrives without warning, as a complaint, a breach or a regulator's letter, and only a file of decisions and records that already exists answers it. ISO/IEC 27701 does not tell you what the law means; it requires a system that keeps that evidence current, audits it, reviews it and corrects what fails.

How does ISO 27701 map to the GDPR?

The 2025 edition carries an informative mapping to the GDPR, so the link is intended, not improvised. It shows where a control supports an article, not that operating the control satisfies it.

Which Annex A parts apply to you depends on your role; the guide on scoping as a PII controller or PII processor (PII controller or PII processor) settles that, and the Annex A guide explains each control set.

One PIMS for several data protection laws

Organisations that serve clients in several countries rarely face one law. The efficient answer is one PIMS with a jurisdiction layer: shared processes, plus a short list of rules that differ by law, usually deadlines, thresholds and who must be told.

The table is a pointer, not a legal summary; your advisers decide how each duty applies to you.

How to trace the law into the PIMS

Context: the legal register

Under clause 4, list every law, regulation, contract and client requirement that governs your processing, and record your role under each: controller, processor or both.

Planning: risk to people, not only to the business

Clause 6 asks you to assess privacy risk to the individuals whose data you hold. Use the same criteria to decide when an impact assessment is due, so the GDPR's DPIA trigger, the UAE PDPL's Article 21 and your own threshold do not become three separate processes.

Operation: controls with the legal duty named

For each control in clause 8 and Annex A, name the article or section it serves in the record itself.

Evaluation and improvement

Clause 9 internal audits sample the legal register against practice, and management review decides what changes when a law does.

A worked example: one breach, three clocks

Take a customer-support provider in Manila that processes data for an EU retailer and a UAE bank, and holds its own employees' records. A misdirected e-mail exposes a spreadsheet of retail customers on a Tuesday afternoon.

As processor for the retailer, its duty is to tell the controller without undue delay; the retailer's 72-hour GDPR clock runs from its own awareness, so every hour the processor spends deciding costs the client. The PIMS answers with an incident procedure that routes client-data events to the contract owner, and one breach register entry recording containment, risk assessment, the notice sent and the root cause under clause 10.

Had the file held the bank's customers, the provider would owe the bank notice as soon as it became aware, as Article 9 of the PDPL expects of a processor. Had it held staff data, the provider would act as controller under the Philippine rules in its legal register. One procedure, three routes, each written down in advance.

What the certificate proves, and what it does not

An accredited certification body confirms that your PIMS meets ISO/IEC 27701 and operates for the scope on the certificate. That is strong evidence for due diligence and tenders, because it shows a system that finds and fixes its own failures.

It does not show that each processing activity is lawful, that a lawful-basis decision was correct or that a transfer safeguard is adequate. ISO/IEC 27701 is not an approved certification mechanism under Article 42 of the GDPR, and Article 42 itself says certification never reduces the controller's or processor's responsibility. Nor does it replace Singapore's voluntary Data Protection Trustmark or the independent data audit India requires of Significant Data Fiduciaries.

Common mistakes in evidencing accountability

• Treating the mapping annex as a compliance checklist. It links controls to articles; it does not decide your lawful bases or retention periods.
• A legal register with no owners. A list of laws nobody reviews goes stale the first time a regulation or rule is issued.
• One breach clock for every client. Processor contracts often set shorter notice periods than the law; the procedure must read the contract.
• Letting the certificate speak for the lawyers. Calling a PIMS certificate proof of GDPR compliance invites scrutiny.

The clauses themselves are explained in the ISO/IEC 27701 requirements guide.

ISO 27701 and data protection law: questions buyers ask