GDPR · Regulation (EU) 2016/679
GDPR compliance on your ISO 27001 base.
The GDPR asks you to process personal data lawfully, keep records, secure the data and report breaches. Much of the security side runs through your ISO 27001 ISMS. With Basenorm you manage both on one control library.
Hosted in the Netherlands. Your data stays in the EU.In brief
- Type
- EU regulationApplies since 25 May 2018
- Security
- Article 32Appropriate technical and organisational measures
- Breaches
- 72 hoursTo notify the supervisory authority
- Supervisor
- Autoriteit PersoonsgegevensIn the Netherlands
01 / What the GDPR asks
What the GDPR
asks of you.
The GDPR combines legal requirements for processing personal data with requirements for securing it.
- 1Principles and lawful basis
Articles 5 and 6: process personal data lawfully, for a specified purpose and no longer than necessary.
- 2Records of processing
Article 30: keep a record of your processing activities.
- 3Security of processing
Article 32: technical and organisational measures appropriate to the risk.
- 4Data protection impact assessment
Article 35: assess processing that is likely to result in a high risk.
- 5Personal data breaches
Articles 33 and 34: notify the authority within 72 hours and inform data subjects when required.
- 6Processors
Article 28: a processing agreement with every processor.
Data subject rights, such as access and erasure, also require clear processes.
02 / With your ISMS
the GDPR on what you already have.
| Topic | Your ISO 27001 ISMS | What the GDPR adds |
|---|---|---|
| Security | Annex A controls | Measures in proportion to the risk for data subjects |
| Breaches | Incident management | Notification within 72 hours and informing data subjects when required |
| Suppliers | Supplier relationship controls | Processing agreements under Article 28 |
| Risk | Information security risk assessment | A DPIA for high-risk processing |
| Records | Inventory of information and assets | Records of processing activities |
ISO 27001 covers much of Article 32. The lawful basis, records and data subject rights are additional GDPR work.
03 / In practice
REGULATION (EU) 2016/679The GDPR in
practice.
The GDPR applies directly in every member state. National supervisory authorities enforce it.
Read about ISO 27001Applies. The GDPR applies in all member states.
Breach notification. Notify the supervisory authority of a personal data breach, unless it is unlikely to result in a risk.
Maximum fine. Up to €20 million or 4% of worldwide annual turnover, whichever is higher.
Source: Regulation (EU) 2016/679.
04 / In Basenorm
How Basenorm supports you.
Unified Control Library
See which of your ISO 27001 controls also support the GDPR.
02Governance Graph
Connect processing activities, systems, suppliers, risks and owners.
03AskNorman
Ask what is still open for the GDPR, in Basenorm or via MCP from ChatGPT, Claude or Perplexity. You review the evidence yourself.
05 / Questions
Questions about
the GDPR.
Is ISO 27001 enough for the GDPR?
Not on its own. ISO 27001 covers a large part of the security requirements, but the GDPR also asks for a lawful basis, records of processing and processes for data subject rights.
When do we need a DPIA?
When processing is likely to result in a high risk for people, for example large-scale processing of sensitive data or systematic monitoring. Your supervisory authority publishes lists of such processing.
How does the GDPR relate to the AI Act?
Both can apply to the same AI system. The GDPR covers the personal data, the AI Act covers the AI system itself.
How does Basenorm handle our personal data?
Basenorm processes the data you put into the platform as a processor, under a data processing agreement. It is hosted in the Netherlands and stays in the EU.
Book a demo
Bring the GDPR into your ISMS.
In a demo we look at your processing, your security measures and what you can reuse.
- Which ISO 27001 controls support the GDPR.
- How you link processing, suppliers and risks.
- How you handle breaches and evidence.
Hosted in the Netherlands. Your data stays in the EU.