Data Privacy Frameworks: A Practical Guide
Start with what your market demands
Data privacy frameworks fall into two categories - regulations you must follow and standards you choose to adopt. Most organizations need a mix of both. The trick is knowing which ones actually apply to you rather than trying to tick every box on the list. Your answer depends on where your customers are, what data you handle, and what industry you operate in.
Regulations vs standards - a key distinction
Regulations are law. Non-compliance means fines, enforcement actions, and legal liability. You do not choose to comply with GDPR. It applies to processing in the context of an EU establishment, and to offering goods or services to people in the Union or monitoring their behaviour, whether or not you are based there.
Standards and frameworks are voluntary. ISO 27701, SOC 2, and similar frameworks provide structured approaches to demonstrating privacy compliance. They help you build a privacy program and prove to clients, regulators, and auditors that you take data protection seriously. Some clients or contracts may require specific certifications, making “voluntary” more like “practically mandatory.”
The smartest approach is to use regulations as your compliance baseline and standards as the structure for meeting those requirements systematically.
The regulations you need to know
GDPR
The General Data Protection Regulation remains the most influential privacy regulation globally. Article 3 applies it to processing in the context of an EU establishment, and to controllers or processors outside the Union who offer goods or services to people in the Union or monitor their behaviour. The core requirements include a lawful basis for processing, data subject rights (access, erasure, portability), and records of processing activities.
Article 33 requires the controller to notify the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware, where the breach is likely to result in a risk to rights and freedoms. Notice to individuals under Article 34 is a separate duty, and only where the risk is high.
Penalties reach up to EUR 20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. Beyond fines, regulators can order you to stop processing entirely - which for a data-driven business can be more damaging than any financial penalty.
CCPA/CPRA
California’s privacy laws give residents the right to know what data is collected, opt out of its sale, and request deletion. The California Privacy Rights Act (CPRA) expanded these protections in 2023 with a dedicated enforcement agency and new rights around sensitive personal information. If your business serves California residents and meets the revenue or data volume thresholds, these rules apply.
Sector-specific regulations
Some industries have additional requirements. HIPAA applies to covered entities and their business associates, not to every organization that handles health data in the US. PCI DSS is a contractual standard if you handle payment card data. Financial services in the EU also face DORA, which is an operational-resilience regime, not a privacy law. GLBA is a US financial-institution statute. These sit beside general privacy rules. You do not get to choose one and ignore the other.
The standards that demonstrate compliance
ISO 27701 - Privacy Information Management
ISO/IEC 27701:2025 is a standalone Privacy Information Management System, published on 14 October 2025. The 2019 edition extended ISO 27001 and has been withdrawn. You can certify the PIMS without an ISO 27001 certificate, and you can still integrate it with an ISO 27001 ISMS when you have one. It is a practical way to show a systematic privacy programme alongside GDPR compliance. A certificate is evidence of that system. It is not a legal finding that the GDPR is met.
We have covered the comparison between ISO 27701 and ISO 31700 in detail if you are evaluating both.
ISO 27001 - The security foundation
ISO 27001 is not a privacy standard, but it provides the security management system that privacy depends on. You cannot protect personal data without protecting information in general. The 2022 version includes 93 controls covering access management, encryption, incident response, supplier security, and more - all of which support privacy compliance.
Most organizations we work with start here. A solid ISMS gives you the foundation to layer on privacy-specific requirements from ISO 27701 or map to GDPR obligations.
SOC 2 - Trust through reporting
SOC 2’s Trust Services Criteria include a Privacy category (the P-series), which evaluates how you collect, use, retain, disclose, and dispose of personal information. For SaaS companies serving the North American market, a SOC 2 Type II report that includes Privacy is often what enterprise buyers ask for.
For organizations that need both SOC 2 and ISO 27001, we have written about how the two overlap and how to implement them together.
How these frameworks connect
| Framework | Type | Scope | Best for |
|---|---|---|---|
| GDPR | Regulation | Personal data covered by Article 3 | An EU establishment, or offering goods or services to, or monitoring, people in the Union |
| CCPA/CPRA | Regulation | California personal data | US businesses meeting thresholds |
| HIPAA | US statute | Covered entities and their business associates | Not every organization that handles health data |
| ISO 27001 | Standard | Information security broadly | Security foundation for any org |
| ISO 27701:2025 | Standard | Standalone privacy management system. ISO 27001 is optional | Systematic privacy programme. Not a GDPR verdict |
| SOC 2 (Privacy) | Framework | Service provider trust | SaaS and cloud services, North America |
The important thing to understand is that these are not competing alternatives. Regulations tell you what you must do. Standards and frameworks give you a structured way to do it and prove it.
Which frameworks do you actually need?
If Article 3 applies: that is an EU establishment, or offering goods or services to people in the Union, or monitoring their behaviour. GDPR compliance is then mandatory. ISO 27701:2025 is a certifiable way to run the privacy programme. ISO 27001 remains a strong security foundation - the overlap between ISO 27001 and GDPR is substantial - but it is no longer a ticket you must hold before ISO 27701.
If you are a SaaS company with US clients: SOC 2 with the Privacy category (the P-series) is likely your first ask from enterprise buyers. If you also serve EU clients, add ISO 27001 and ISO 27701. Cloud providers handling personal data should also consider ISO 27018 for cloud-specific PII protection.
If you are a HIPAA covered entity or a business associate: HIPAA applies. It does not apply to every organization that handles health data in the US. ISO 27001 provides a strong management system that supports HIPAA’s administrative, physical, and technical safeguard requirements.
If you are not sure where to start: Begin with the obligation you were actually asked to meet. ISO 27001 is the broad security foundation. ISO 27701:2025 can stand alone for privacy or share that foundation. SOC 2 is the usual ask from US enterprise buyers. Map sector rules onto the same core system rather than running three projects.
Common mistakes
Building separate programs for each framework. We see organizations with a GDPR project, a separate ISO 27001 implementation, and a third track for SOC 2. This triples the documentation, the audit burden, and the team workload. Build one integrated program and map it to multiple frameworks.
Treating privacy as a legal problem only. Privacy compliance requires technical controls (encryption, access management, data minimization), organizational measures (policies, training, roles), and legal work (privacy notices, DPIAs, contracts). A lawyer-only approach leaves gaps that auditors and regulators will find.
Ignoring the standards because they are voluntary. GDPR Article 32 requires appropriate technical and organizational measures. It does not define them as “whatever ISO 27001 or ISO 27701 says.” Those standards are one structured way to choose measures and show that you run them. They are not the legal definition of “appropriate” for your processing.
How 27kay can help
We help organizations build an integrated privacy and security programme that covers the overlap across several frameworks from a single implementation effort. Whether you need ISO 27001 as your security foundation, a privacy programme on ISO 27701 next to your GDPR duties, or SOC 2 for your US clients, we design a programme that covers your actual requirements without unnecessary duplication. A certificate is not a finding that the GDPR is met.
Not sure which frameworks apply to you? Let’s talk - we will map your obligations based on your markets, your data flows, and your clients’ expectations.