Will ISO 27001 make me GDPR compliant?
Will ISO 27001 make me GDPR compliant?
ISO27001 v BS 10012
On its own No – this is a myth.
Information security is just one of Six principles of BS10012 and GDPR
“f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.”
Whilst a very important principle, if you rely on just having ISO 27001 for GDPR compliance you run the risk of not being in full alignment with all the principles (and related articles and recitals).
Who needs to be involved in BS 10012?
Do all my staff need to be involved in BS 10012
Successful implementation is a team effort.
It starts with the top – Senior Management need to be fully onboard and committed to achieving data protection best practice. If this is secured, then everything else will flow from there.
In order to effectively identify all the personal data within your organisation you need to involve all areas of the business.
All too often businesses are concerned with just the data they may process for their clients – normally because they’re being questioned about data protection by their clients!
Or on the flip side, businesses are overly concerned with staff or finance data – excluding all the other client related personal data they may be controlling in the business.
With BS10012 – all personal data is captured and recorded to ensure that all risks are considered.
Thereafter, all staff require a level of data protection training to ensure that they understand their responsibilities in relation to personal data. Unfortunately, as has been proven many times before, people will always be the weakest link when it comes to data protection breaches. Ensuring all staff are trained is fundamentally one of the most important steps to take in implementing BS10012:2017
This extends out to key suppliers or partners depending on whether personal data is shared/ transferred outside of the business.
