ISO 27001 vs GDPR: Why an ISMS Certificate Is Not Legal Compliance

A Turkish software vendor selling a SaaS product into Germany passed its ISO 27001 audit, framed the certificate, and put it on the sales deck. Six weeks later a prospective enterprise customer sent a data processing agreement and a 40-question privacy assessment, asking where the records of processing activities were, who the data protection officer was, and how data subject access requests get handled inside 30 days. The certificate answered none of it. The vendor had proven its information security management system works. It had not shown that it meets the legal duties of the EU General Data Protection Regulation, GDPR. Those are two different things, and treating them as one is one of the most expensive misunderstandings a Turkish exporter can carry into the European market.

This is the gap worth understanding before you sign your next EU contract. An ISO 27001 certificate and GDPR compliance overlap, lean on each other, and are often demanded in the same breath by the same buyer. They are not interchangeable. One is a voluntary certification of how you manage security risk. The other is a binding law you must obey if you handle the personal data of people in the EU, certificate or not.

What each one actually is: a certification versus a law

ISO 27001 is an international standard you choose to be certified against. An accredited certification body audits your information security management system, your ISMS, and if it conforms, issues a certificate that is recognised worldwide. The scope is security: confidentiality, integrity, and availability of information, whatever that information is, whether it is source code, customer lists, or your own pricing models. The certificate is third-party proof that you run a managed, audited security system rather than an ad hoc one.

GDPR is not something you get certified to in that sense. It is Regulation (EU) 2016/679, a law with direct effect across the European Union, and it applies the moment you process the personal data of people in the EU, regardless of where your company sits. For a Turkish exporter, that territorial reach is the key point: you do not need an office in Frankfurt to be bound by GDPR. If you handle the personal data of people in the EU in connection with offering them goods or services, the law reaches you in Istanbul or Izmir just the same. No auditor hands you a GDPR certificate that closes the matter. Compliance is an ongoing legal obligation enforced by supervisory authorities, with fines that scale to a percentage of global annual turnover.

Where they overlap, and where the certificate quietly runs out

The overlap is real and useful. GDPR Article 32 requires "appropriate technical and organisational measures" to secure personal data, and a working ISO 27001 ISMS is one of the strongest ways to demonstrate exactly that. Access control, encryption, logging, supplier management, incident response, the things your Annex A controls already cover, map directly onto what a regulator expects to see when asking how you protect personal data. If you hold ISO 27001, you have done a large share of the security work GDPR demands, and you can show it with audited evidence rather than assertions.

The certificate runs out precisely where GDPR stops being about security and starts being about rights and lawfulness. ISO 27001 does not ask whether you have a lawful basis to process the data in the first place. It does not require you to honour a person's right to access, correct, or erase their data. It does not govern how long you keep records, how you obtain valid consent, when you must run a data protection impact assessment, or whether an international transfer of data out of the EU rests on a legal mechanism such as standard contractual clauses. A company can hold an immaculate ISO 27001 certificate and still breach GDPR every day by, for example, keeping customer data forever with no retention rule, or ignoring deletion requests. The security is sound. The legal duties are unmet.

The duties ISO 27001 will not cover for you

It helps to be specific about what stays your responsibility no matter how clean your audit report is. GDPR obliges you to keep records of processing activities, to define a lawful basis for every processing purpose, and to respect data subject rights within the deadlines the law sets. You must report a qualifying personal data breach to the relevant supervisory authority, in many cases within 72 hours, and that is a legal reporting duty, not merely the incident-handling procedure your ISMS documents. Where your processing is high risk you must carry out a data protection impact assessment. If you send personal data from the EU to Turkey, you need a recognised transfer safeguard in place. None of these are line items an ISO 27001 auditor is checking against the law, because that is not the standard's job.

How the two are meant to work together

The productive way to read this is not as a contest but as a layered build. ISO 27001 gives you the security backbone and the management discipline; GDPR sits on top as the legal and rights layer that the security backbone helps you satisfy. There is even a published privacy extension, ISO 27701, that builds a privacy information management system directly onto an existing ISO 27001 ISMS and maps its controls to privacy regulations including GDPR, which is the natural next step for an organisation that wants its privacy posture audited the same way its security already is.

For a Turkish firm, there is a domestic dimension that makes this even clearer. Turkey has its own data protection law, KVKK (Turkey's Personal Data Protection Law, No. 6698), which is closely modelled on GDPR. A business that gets its KVKK compliance programme right has already built much of the governance, lawful-basis documentation, and data-subject-rights machinery that GDPR also requires, so the two legal regimes reinforce each other rather than duplicating effort. The security foundation under both of them is the ISMS itself, which is why ISO 27001 certification is the sensible first move, with the legal layer built deliberately on top.

What this means before you sign an EU contract

When an EU buyer asks for ISO 27001, they are usually asking two questions at once, even if their procurement form only states one. They want assurance that your security is managed and audited, which the certificate answers cleanly. They also want assurance that working with you will not create a GDPR liability for them as the data controller, which the certificate does not answer on its own. The vendors that win these contracts on the first pass are the ones that hand over the certificate and a clear account of their GDPR position: the lawful basis, the processing records, the breach-notification process, the transfer mechanism for moving data to Turkey. The certificate opens the door. The legal answers keep you in the room.

The practical sequence for a Turkish exporter is to treat security and legality as two builds that share a foundation. Stand up an audited information security management system under ISO 27001 so your technical and organisational measures are demonstrable, then map your obligations under KVKK and GDPR onto that system so the legal layer is documented and defensible, not assumed. Where you certify multiple management systems, the same backbone supports them, which is part of the value of building security and privacy through accredited system certification rather than as separate, disconnected projects.

Where Sistem Patent Kalite fits

The certificate and the law are two instruments that play in the same band, and the cost of confusing them is paid in lost EU contracts and regulatory exposure. Sistem Patent Kalite helps Turkish exporters build the security backbone through ISO 27001 and then align it with the legal duties under KVKK and, for EU-facing business, GDPR, so a buyer's security question and privacy question are both answered with evidence. If your sales pipeline runs into Europe and you want your certificate to do its job without leaving the legal questions open, talk to us about an ISMS built with the GDPR layer in mind from the start.