Reference
ENS, ISO 27001 and GDPR: what each attests to
We are asked for this evidence, and we ask it of whoever we subcontract to. Here is what each document attests to, which of the three has no generic certificate, and how you check any of them in a public register.
The three distinctions
The ENS, ISO/IEC 27001 and the GDPR are cited together and they are not the same kind of thing. The first attests to a system, the second attests to a way of managing, and for the third there is no certificate that attests to compliance as a whole: what Article 42 allows to be certified is specific processing operations. Each one answers a different question.
- ENS conformity belongs to an information system, not to a company
- The Esquema Nacional de Seguridad is governed by Royal Decree 311/2022 of , and its Article 2.3 reaches the systems of private entities that provide services to the public sector: the tender specifications are what carry that conformity into the contract and, to the extent that the risk analysis makes it necessary, into the contractor's supply chain. Annex I defines the category by the security dimensions of the system, so an ENS conformity is cited with its system and its category.
- An ISO/IEC 27001 certificate carries the scope the certified company chose
- ISO/IEC 27006-1:2024 expressly allows it to cover only identified functions or sections of the organisation: a certificate whose scope is head office says nothing about the team writing your code.
- There is no generic certificate of GDPR compliance
- Article 42.5 of the GDPR reserves certification to the bodies of Article 43 and to the supervisory authorities, and what they certify is specific processing operations, not the compliance of a company; 42.4 makes clear that it does not even limit the responsibility of whoever holds it. What does exist, and is mandatory, is the data processing agreement of Article 28.
A date that puts certificates out of time
The version in force is ISO/IEC 27001:2022, published on , and in Spain it is adopted as UNE-EN ISO/IEC 27001:2023. The transition period from the 2013 edition ended on , so a certificate citing that edition is out of time.
How you check any of the three
Ask for the certificate with its scope in writing
The full document, with its number, its date of issue, its expiry date, the issuing body and — above all — the scope, which is what says whether it covers the team and the site that are going to touch your system. In ENS, certification with an audit is for the MEDIUM and HIGH categories; a BASIC category system carries a declaration of conformity, and that is what you ask for instead.
Check that the issuer is accredited for that standard
In Spain the accreditor is ENAC, and in the United Kingdom UKAS. For the ENS, the certification is issued by a body accredited to UNE-EN ISO/IEC 17065:2012.
Cross-check it in a public register
The ENAC search, UKAS CertCheck, IAF CertSearch for the rest of the world, and the CCN register for the ENS. Article 38.2 of Royal Decree 311/2022 also requires the declaration or the certification of conformity to be published.
Frequently asked questions
- Is an ISO 27001 certificate enough on its own?
- It depends on two things written on the certificate itself: the edition and the scope. If it cites the 2013 edition, it has been out of time since . And if the scope does not cover the team and the site that are going to touch your system, the certificate is valid and says nothing about what matters to you. An ISO 27001 certification does not replace the Article 28 data processing agreement under the GDPR either. Nor does a certification approved under Article 42 replace it: Article 28.5 admits it as an element for demonstrating sufficient guarantees, not as the contract.
- My client is a Spanish public administration and holds its ENS. Does that cover me?
- No. Article 2.3 of Royal Decree 311/2022 applies the framework to the information systems of private entities that provide services to public entities for the exercise of their competences, including the obligation to have the security policy of Article 12 — which in a private entity is approved by the body with the highest executive powers. The tender specifications carry that conformity into the contract, and into the supply chain to the extent that the risk analysis makes it necessary. An ENS is not inherited downwards: it is replicated.
- Your certifications are in progress. What do you show in the meantime?
- ISO/IEC 27001 and the ENS are in the certification process with an external audit. In the meantime the evidence is the documents: the Article 28 data processing agreement, the list of sub-processors with their country and their transfer instrument, and the measures of Article 32.1 — the last of them included, the process for regularly verifying that the rest work. The status of each standard, with its date, is in the trust centre.
- If I can only ask for three things, which ones?
- The full certificate with its scope in writing. The Article 28 data processing agreement signed before the first access to any system of yours. And the list of sub-processors with their country and their transfer instrument: Article 28.2 requires your prior written authorisation for each one, and 28.4 requires the same obligations of the data processing agreement to be passed on to them. Those three are the ones you ask us for and the ones we ask of whoever we subcontract to.
Where do we start?
Two ways to begin, depending on what you have in front of you today. Answered within one working day.