# GDPR duties to PIMS evidence checklist

Use this when you build a privacy information management system (PIMS) to ISO/IEC 27701 in an
organization that processes personal data under the GDPR. It lists the GDPR duties a PIMS is most often
asked to evidence, says whether an existing ISO/IEC 27001 ISMS usually covers each one, and leaves a box
for the record and the owner. It is a working aid, not legal advice, and the ISMS column is our reading,
not a ruling: check it with your data protection officer or legal team. ISO/IEC 27701 is sold rather than
published, so check requirement wording against your own copy of ISO/IEC 27701:2025.

## First, settle the role

- [ ] For each processing activity, are we a PII controller, a PII processor, or both? Record: ________
- [ ] Which business units, sites and systems are inside the PIMS scope? Record: ________
- [ ] Do we already run an ISO/IEC 27001 ISMS, and does its scope cover the same ground? yes / no

## GDPR duties and the record that answers them

- [ ] Art. 5(1) principles: lawful, fair, transparent, purpose-limited, minimized, accurate, time-limited, secure. ISMS covers it: security only. Record: privacy policy, purpose and retention register. Owner: ________
- [ ] Art. 5(2) accountability: able to demonstrate compliance. ISMS covers it: the management system structure, not the privacy content. Record: PIMS documented information. Owner: ________
- [ ] Art. 24 controller responsibility: appropriate measures, reviewed and updated. ISMS covers it: partly. Record: privacy risk treatment plan, management review minutes. Owner: ________
- [ ] Art. 25 data protection by design and by default. ISMS covers it: partly, through secure development. Record: privacy design review records. Owner: ________
- [ ] Art. 28 processors: sufficient guarantees and a contract. ISMS covers it: partly, through supplier security. Record: processor register and contract checks. Owner: ________
- [ ] Art. 30 records of processing activities. ISMS covers it: no. Record: record of processing activities. Owner: ________
- [ ] Art. 32 security of processing. ISMS covers it: largely. Record: Statement of Applicability, control evidence. Owner: ________
- [ ] Art. 33 breach notification to the supervisory authority, where feasible within 72 hours. ISMS covers it: partly, through incident management. Record: breach procedure with the 72-hour clock and the decision log. Owner: ________
- [ ] Art. 34 communication of a high-risk breach to the people affected. ISMS covers it: no. Record: data subject communication template. Owner: ________
- [ ] Art. 35 data protection impact assessment for likely high-risk processing. ISMS covers it: no, its risk method looks at risk to the organization. Record: DPIA screening and assessments. Owner: ________
- [ ] Art. 37 data protection officer, where required. ISMS covers it: no. Record: DPO designation decision. Owner: ________
- [ ] Arts. 12 to 22 data subject rights: access, rectification, erasure, restriction, portability, objection. ISMS covers it: no. Record: rights request procedure and log. Owner: ________

## The PIMS records that answer most of these

- [ ] PIMS scope, with the controller and processor roles stated
- [ ] Privacy policy and privacy objectives, approved by top management
- [ ] Privacy risk assessment and risk treatment, with the method written down
- [ ] Record of processing activities, with purposes, categories and retention
- [ ] Processor and sub-processor register
- [ ] Privacy notices, consent records where consent is the lawful basis, rights request log
- [ ] Breach procedure and breach log
- [ ] Training and awareness records
- [ ] Internal audit reports, management review minutes, corrective action log

A note on certificates: a certificate to ISO/IEC 27701 is not the same as a GDPR certification under
Article 42, which is issued on criteria approved by a supervisory authority or the European Data
Protection Board (Article 42(5)).

Sources: Regulation (EU) 2016/679 (GDPR), Articles 5, 12 to 22, 24, 25, 28, 30, 32 to 35, 37 and 42
(http://data.europa.eu/eli/reg/2016/679/oj); ISO/IEC 27701:2025 (https://www.iso.org/standard/27701).
Read 20 October 2026. From Credential Press, credentialpress.com.