GDPR is not limited to IT, as it covers any processing of personal data in an organisation. ISO 27001 compliance can be a good starting point, but is not enough for GDPR compliance.

1. To protect fundamental rights
and freedoms of natural
persons and in particular their
right to the protection of
personal data
PURPOSE
Not enough
GDPR
To define, implement, maintain
and continuously improve an
Information Security
Management System
Applies to the processing of
all personal data in an
organisation
SCOPE
Information in the
organisation's Information
System
Depend on the impact that
unauthorised or unlawful
processing, loss, destruction
or damage of personal data
can have on the data subject
SECURITY MEASURES
Depend on the value of the
data to the organisation
Data are processed lawfully,
fairly and in a transparent
manner in relation to
the data subject
LAWFULNESS, FAIRNESS, TRANSPARENCY
PURPOSE LIMITATION
Data are processed as
prescribed by the
organisation's own
internal procedures
Data are collected for
specified, explicit and
legitimate purposes and not
further processed in a manner
that is incompatible
with those purposes
No prescription
Data collection is limited to
what is necessary in relation
to the purposes for which the
data are processed
DATA MINIMISATION
No prescription
©2018 W. Vannini ipse@waltervannini.it v0.1
★ 01
★ 02
★ 03
★ 04
★ 05
★ 06
ISO 27001

2. Personal data must be
accurate and, where
necessary, kept up to date
ACCURACY
Not enough
ISO 27001GDPR
No prescription
For no longer than is
necessary for the purposes
for which the personal data
are processed
STORAGE LIMITATION
No prescription
Ensures appropriate security
of personal data, including
protection against
unauthorised or unlawful
processing and against
accidental loss,
destruction or damage
INTEGRITY
Evaluates and treats
information security risks
according to the needs of the
organisation
The controller is responsible
and able to demonstrate
compliance with GDPR
RESPONSIBILITY OF CONTROLLER
No prescription
Fines up to 20M€ or up to 4%
of global revenue
No prescription
Certification body complies
with ISO/IEC 17065
(products, processes, services)
CERTIFICATION
Certification body complies
with ISO/IEC 17021
(management systems)
ACCOUNTABILITY
★ 07
★ 08
★ 09
★ 10
★ 11
★ 12
©2018 W. Vannini ipse@waltervannini.it v0.1