01
Separate implementation, remediation, and audit cost
Budget for management-system design, risk and applicability work, technical or supplier remediation, internal resources, and the independent certification assessment.
02
Map the European operating boundary
Identify legal entities, locations, remote teams, cloud regions, processors, critical suppliers, regulated information, customer commitments, and shared services.
03
Use existing privacy and security evidence carefully
DPIAs, processor reviews, incident processes, access controls, security testing, contractual controls, and customer questionnaires can support implementation when their ownership and evidence remain current.
Frequently asked questions
Does ISO 27001 certification prove GDPR compliance?
No. It can support security governance and evidence, but GDPR contains broader legal obligations that must be assessed separately.
Can one ISO 27001 certificate cover several European entities?
Potentially. Governance, activities, legal entities, sites, information-security boundaries, and certification-body rules determine the scope.
What information is needed for an accurate proposal?
Provide entities, sites, headcount, services, systems, data, suppliers, existing controls, regulatory context, customer deadlines, and intended certification scope.
Primary sources