“We’ll do the audit when we have time.” Then comes a regulator’s inspection, a client demanding certification, or a data breach. An audit is neither a box to tick nor a punishment: it’s the honest snapshot of your security posture — the one that turns a vague hunch (“we’re more or less protected”) into a prioritised action plan.
The trick is knowing which audit you mean — because a “GDPR audit” and an “ISO 27001 audit” don’t target the same thing — and where to start without drowning. Here’s the method.
1. GDPR, ISO 27001: two complementary logics
They’re often confused. GDPR is a legal obligation centred on protecting personal data. ISO 27001 is a voluntary standard that structures the security of all information through a management system (ISMS). One protects people, the other organises the company — and the two reinforce each other.
Key takeaway
GDPR answers “are we compliant with the law?“, ISO 27001 “is our security managed and provable?“. A solid ISO 27001 approach already covers a large share of GDPR’s technical requirements.
2. The 3 kinds of audit not to confuse
Behind the word “audit” hide three different exercises. Mixing them up is comparing apples and oranges.
Organisational audit
Review of policies, processes, roles and governance. Answers “do the right rules exist and are they applied?”.
Technical audit
Configuration analysis, architecture review and penetration testing. Answers “does the IS actually hold up?”.
Compliance audit
Gap between the existing setup and a framework (GDPR, ISO 27001, NIS2…). Produces a prioritised compliance plan.
3. The 5-step method
Whatever the framework, a reliable audit always follows the same thread: scope, collect, analyse, prioritise, follow up.
The key deliverable isn’t the findings report, but the risk-prioritised action plan: what to fix first, with what effort and what impact.
4. GDPR side: the 4 foundations
- Records of processing: the map of who processes which data, why and for how long. A non-negotiable starting point.
- Legal basis: every processing activity must rest on a valid ground (consent, contract, legal obligation, legitimate interest…).
- Data subject rights: access, rectification, erasure, portability — procedures that respond within the legal deadlines.
- Security & breaches: appropriate technical measures and a 72-hour notification procedure in case of a breach.
5. ISO 27001 side: the ISMS, not just controls
ISO 27001 doesn’t ask you to blindly apply a list of controls, but to manage security by risk: identify your assets, assess the risks, select the Annex A controls that treat them, then measure and improve continuously (PDCA logic). Certification attests that this system exists and works.
6. The misconceptions
“We’re compliant, so we’re secure”
Compliance is a documentary floor, not a technical guarantee. You can tick every box and still be vulnerable to a real attack.
“ISO 27001 is for large groups”
The scope adapts to your size. An SME can certify a critical service and gain a real commercial edge from it.
“GDPR is a legal topic”
It’s as much technical as organisational: data security, access management, logging and encryption are all part of it.
“One audit is enough”
Compliance, like security, must be maintained: the IS, the processing and the threats evolve. It’s a cycle, not a one-shot.
7. Your “before you start” checklist
Scope
- Clear objective: legal compliance, certification, or risk reduction?
- Perimeter defined (entities, sites, applications involved)
- Sponsor and points of contact designated
Gather
- Records of processing (GDPR) up to date or to be created
- Asset inventory and IS mapping
- Existing policies and procedures collected
Steer
- Formal gap analysis vs the target framework
- Risk-prioritised action plan (effort / impact)
- Periodic review scheduled (improvement cycle)
8. Frequently asked questions
Do you have to choose between GDPR and ISO 27001?
No, they’re complementary. GDPR is mandatory for any personal data; ISO 27001 is a strategic choice that structures overall security and covers a good share of GDPR’s technical requirements.
How long does an audit take?
From a few days for a targeted assessment to several weeks for a full certification audit. The key factor is the perimeter, not the size of the company.
Does an audit always lead to certification?
No. A gap analysis first tells you where you stand. ISO 27001 certification is a later step, carried out by an accredited body.
Where to start with a limited budget?
With scoping and the gap analysis: they’re inexpensive and produce the prioritised action plan. You then treat the major risks first, the rest in waves.
Where do you really stand? Let’s take stock.
ZENISEC runs your GDPR and ISO 27001 audits — from scoping to gap analysis, through to the prioritised action plan and its follow-up.
Case study: IS rebuild & compliance for a mutual-insurance group →
Comments are closed