GDPR ↔ ISO/IEC 27001
19 canonical controls in Keel’s library satisfy clauses of both GDPR and ISO/IEC 27001. Implement each once, attach the evidence once, and it counts toward each standard. The overlap is the work you don’t repeat.
Controls that satisfy both
| Canonical control | GDPR clauses | ISO/IEC 27001 clauses |
|---|---|---|
|
Information security policy
A board-approved information security policy set, reviewed at least annually and communicated to the workforce.
|
Art.24 | A.5.1 |
|
Risk assessment & treatment
A documented process to identify, analyze, evaluate, and treat information security risks on a defined cadence.
|
Art.35 | A.5.7 |
|
Access control policy
Rules for granting, reviewing, and revoking access to systems and data based on business need and least privilege.
|
Art.32 | A.5.15 |
|
User provisioning & deprovisioning
Joiner/mover/leaver process to grant, change, and promptly remove access across systems.
|
Art.32 | A.8.3 |
|
Multi-factor authentication
MFA enforced for remote access, administrative access, and access to sensitive systems and data.
|
Art.32 | A.8.5 |
|
Encryption in transit & at rest
Strong cryptography protects sensitive data in transit over public networks and at rest in storage.
|
Art.32 | A.8.24 |
|
Logging & monitoring
Security-relevant events are logged, protected, retained, and reviewed for anomalies.
|
Art.32 | A.8.15, A.8.16 |
|
Vulnerability management
Regular scanning, prioritization, and remediation of vulnerabilities across systems and applications.
|
Art.32 | A.8.8 |
|
Backups
Regular, tested backups of critical data and systems with defined retention.
|
Art.32 | A.8.13 |
|
Business continuity & disaster recovery
BC/DR plans with defined RTO/RPO, tested periodically, to restore service after disruption.
|
Art.32 | A.5.30 |
|
Incident response
A documented, tested plan to detect, triage, contain, remediate, and communicate security incidents.
|
Art.33, Art.34 | A.5.24, A.5.26 |
|
Third-party / vendor risk management
Due diligence, contractual safeguards, and ongoing monitoring of vendors that handle your data.
|
Art.28 | A.5.19 |
|
Security awareness training
Ongoing security awareness training for all personnel, with completion tracking.
|
Art.32 | A.6.3 |
|
Data classification & handling
Information is classified and handled per its sensitivity, with rules for labeling and protection.
|
Art.5, Art.30 | A.5.12 |
|
Physical security
Physical access to facilities and equipment holding sensitive data is restricted and monitored.
|
Art.32 | A.7.1, A.7.2 |
|
Secure software development
Secure coding, review, and testing practices across the development lifecycle.
|
Art.25 | A.8.25 |
|
Data retention & secure disposal
Data is retained per policy and securely destroyed when no longer needed.
|
Art.5, Art.17 | A.8.10 |
|
Personnel security (HR)
Background screening, confidentiality agreements, and onboarding/offboarding security steps.
|
Art.32 | A.6.1, A.6.5 |
|
Personal data privacy
Personal data of employees and customers is protected with clear, honored privacy practices.
|
Art.12, Art.15, Art.16, Art.17, Art.21 | A.5.34 |
Clause identifiers (GDPR and ISO/IEC 27001) are referenced factually for mapping. Keel is not affiliated with or endorsed by the bodies that publish these standards. Control descriptions are Keel’s own; a framework’s full authored control count is on its framework page.
Why this is one project, not two
On a crosswalk-native model, ISO/IEC 27001 mostly lights up controls you already built for GDPR. You’re not re-uploading the same screenshot for a second audit. You apply the framework and see the genuine delta worth working. That’s the whole idea behind collect once, comply everywhere.