ISO 27001 Support

Information security and data protection are closely connected. ISO 27001 provides the framework for managing information security, while UK data protection legislation places specific obligations on organisations to protect the personal data they process. This includes UK GDPR, the Data Protection Act 2018 and the changes introduced by the Data (Use and Access) Act 2025.

PMA provides specialist support where these two requirements overlap.
We work alongside your internal information security team, ISO consultant, or certification programme to ensure the data protection element of your ISMS is properly covered, documented, and evidenced.

Connecting ISO 27001 and data protection

An ISO 27001 review will look at how your organisation protects information. Where that information includes personal data, you also need to consider UK GDPR and the Data Protection Act 2018.

Article 32 UK GDPR requires organisations to implement appropriate technical and organisational measures to protect personal data.

But good data protection goes further than security alone. You also need to show why you process personal data, who can access it, how long you retain it, who you share it with, how you manage suppliers, and what happens when something goes wrong.

This is where we support your ISO 27001 programme.

How we support your ISO 27001 framework

We focus specifically on the data protection requirements that sit within, or alongside, your Information Security Management System.

Data protection gap review

We review the personal data elements of your existing ISO 27001 framework against UK GDPR, the Data Protection Act 2018 and the changes introduced by the Data (Use and Access) Act 2025.

Identify where controls are already supported by your data protection framework, where evidence could be strengthened and where additional documentation or actions may be required.

The result is a clear, practical list of actions, not another complicated compliance report.

Policies and documentation

ISO 27001 and UK GDPR both depend heavily on appropriate policies and the ability to demonstrate compliance.

We review and produce data protection documentation that supports your ISMS, including areas such as Information Security Policy, Access Control Policy and Incident Management Policy.

We also review supporting privacy documentation, retention arrangements, Records of Processing Activities (ROPA), Data Protection Impact Assessments (DPIAs), supplier agreements and data breach procedures.

Everything is written in plain English and designed around the way your organisation actually operates.

Data protection risks

Your ISO 27001 risk register may include risks directly related to personal data. We help identify those risks and ensure you properly consider the data protection implications.

This might include unauthorised access, excessive permissions, inappropriate data sharing, loss of personal information, insecure suppliers, excessive retention or international data transfers.

Where a proposed system or activity creates a potentially high risk to individuals, we can also undertake or review a Data Protection Impact Assessment.

Suppliers and processors

Third parties are increasingly important within both information security and data protection compliance. Cloud platforms, software providers, outsourced support companies and other suppliers may process significant amounts of personal data on your behalf.

We can review a wide range of areas

Processor and sub-processor arrangements
Data Processing Agreements
Article 28 UK GDPR requirements
Supplier security questionnaires

International data transfers
Data retention and deletion requirements
Evidence of supplier due diligence

Personal data breaches and security incidents

Not every information security incident is a personal data breach. But when personal information is involved, additional regulatory obligations may apply.

We help align your information security incident process with your UK GDPR breach procedure.

That includes assessing whether personal data has been affected, evaluating the potential risk to individuals, documenting decisions and determining whether the Information Commissioner’s Office or affected individuals need to be notified.

This creates one joined-up process rather than separate security and data protection responses.

Retention, access and information handling

Some of the most common data protection risks come from keeping information for too long or allowing more people to access it than necessary. This can involve reviewing some key data protection aspects.

User access and permissions
Data minimisation
Retention periods
Secure deletion

Employee access to personal information
Remote working and information sharing
Data retention and deletion requirements
Special category and sensitive personal data

The aim is to ensure that your information security controls also support your wider UK GDPR obligations.

Supporting your ISO 27001 audit

Before a certification or surveillance audit, we can review the data protection elements of your ISMS and supporting evidence. This can include checking that policies are current, risks are documented, supplier arrangements are appropriate, breach procedures are understood, and data protection actions are complete.

Bringing two compliance frameworks together

ISO 27001 and UK GDPR should not operate as separate compliance programmes. There are significant areas of crossover.

Supplier assessments can address both information security and Article 28 requirements. Security incidents can feed into the personal data breach process. Access controls can support data minimisation. Retention schedules can support secure deletion. Risk assessments can trigger a DPIA.

Joining these activities together reduces duplication and creates stronger evidence of compliance.

That is particularly valuable for organisations operating in regulated sectors or those regularly being asked by customers to demonstrate both their data protection and information security arrangements.

Already working towards ISO 27001?

You do not need another consultant trying to run your entire ISO programme.

Do you already have an ISO consultant, Information Security Manager, Managed Service Provider or internal ISMS team? If you do, we can work alongside them and take responsibility for the data protection elements.

We provide the specialist input needed to ensure the personal data aspects of your ISMS are properly addressed.

Ongoing data protection support

ISO 27001 and data protection compliance both require ongoing review.

Your systems change. New suppliers are introduced. Staff join and leave. New technology is adopted. Different categories of information are collected.

Our ongoing DPO and compliance services can help keep the data protection elements of your ISMS current between audits. Rather than trying to address everything immediately before the auditor arrives.

Need data protection support for ISO 27001?

Whether you are preparing for certification, approaching a surveillance audit or reviewing an existing ISMS, we can help you understand whether the data protection elements are properly covered.

Tell us where you are in your ISO 27001 journey, and we’ll give you an honest view of where PMA can add value.