EU GDPR & ISO/IEC 27001:2022 Integrated Management System
EU GDPR & ISO/IEC 27001:2022 Integrated Management System
An editable integrated system that runs GDPR compliance and an ISO/IEC 27001:2022 information security management system as one set of documents, with two separate evidence trails.
Couldn't load pickup availability
Written and reviewed by practising specialists. Who writes this
Built and reviewed with our methodology. Read it
By document type
| Category | Files |
|---|---|
| Manuals | 3 |
| Policies | 12 |
| Procedures & SOPs | 17 |
| Plans & Programmes | 5 |
| Forms & Records | 13 |
| Registers, Logs & Matrices | 1 |
| Training & Awareness | 3 |
| Guides & Work Instructions | 4 |
| Tools & Workbooks | 14 |
Key documents
| Reference | Document | Format |
|---|---|---|
| AGS-IPS-MAN-002 | Integrated ISMS-PIMS Manual | Word |
| AGS-IPS-PRO-005 | Integrated Risk Management Procedure | Word |
| AGS-IPS-PRO-011 | Integrated Incident and Personal Data Breach Procedure | Word |
| AGS-IPS-PRO-010 | Data Subject Rights Procedure | Word |
| AGS-IPS-FRM-016 | DPIA Template | Word |
| AGS-IPS-WBK-000 | Master Traceability Matrices | Excel |
- Need the complete document list? Request it — same day
- Want to check the quality first? Preview free samples
Overview
An ISO/IEC 27001 management system does not on its own show that an organisation meets the GDPR. Running two programmes doubles the work. This system builds one management system that serves both, while keeping the GDPR legal records apart from the ISMS documents so each can be shown on its own.
An integrated risk method scores security risk and risk to individuals separately and feeds one Statement of Applicability. The Annex A controls are written up in control volumes, each with control record registers. Master traceability matrices trace GDPR articles, ISO clauses and every Annex A control to documents and evidence.
The privacy-specific parts use ISO/IEC 27701:2025, and the risk method draws on ISO/IEC 27005:2022. ISO/IEC 27001:2022 is referenced with Amendment 1:2024, and ISO/IEC 27002:2022 is referenced as guidance, so you will need your own copy of it. Standard contractual clauses under Commission Implementing Decision (EU) 2021/914 are referenced, not reproduced. AGS is independent and is not affiliated with the European Commission or any supervisory authority. Standards are referenced by number and title only, and no standard text is included. Regulations are referenced by citation.
What this system covers
- System governance: an integrated ISMS and PIMS manual, an integrated information security and privacy policy, a privacy governance policy, a DPO appointment and independence assessment, steering committee terms, legal compliance, document control and escalation.
- Scope and inventories: scope, asset and personal data inventories, controller and processor records of processing, retention, the integrated risk method and the Statement of Applicability.
- GDPR operations: data protection policy, privacy by design, consent, data subject rights, privacy notice templates, rights response templates and a DPIA template.
- Annex A controls: control volumes covering the ISO/IEC 27001 Annex A control domains, with control record registers.
- Suppliers and transfers: an Article 28 data processing agreement template, a supplier security schedule and a transfer impact assessment.
- Incidents and continuity: one incident procedure with a parallel privacy track, a 72-hour decision path for Article 33 and Article 34, and continuity and disaster recovery.
- Assurance: competence, internal audit with an audit interview preparation guide, management review, corrective action, and worked examples for a fictional SaaS processor, professional services firm and e-commerce business.
Who it's for
Small and mid-sized organisations in the EU and EEA without a full-time compliance function that want one system for information security and data protection. It also suits organisations adding the GDPR to an existing ISO/IEC 27001 ISMS, and processors selling to controllers.
If you need the GDPR alone, the EU GDPR Core Management System covers the whole programme without the ISMS. For one process in depth, see the EU GDPR Personal Data Breach Response Management System or the EU GDPR Data Protection Impact Assessment (DPIA) Management System.
Everything you get
Every toolkit gives you a full set of working documents for your standard, ready to edit and use.
Native Microsoft files. Add your logo and adapt every document to how you work.
Your full toolkit arrives as a ZIP the moment payment clears.
One purchase covers everyone in your organisation. No per-seat fees.
Built by people who run real audits, so the content matches what assessors check.
One payment, perpetual licence for your organisation. No subscriptions, no renewals.
Full refund if your files are faulty, incomplete or not as described and we can't put it right
Frequently asked questions
What exactly do I receive?
A downloadable ZIP containing the full set of ready-to-use documents for this toolkit — manuals, procedures, forms, records, checklists, guidance and training material, all in editable Word and Excel format. The exact document count is shown at the top of this page.
Are the documents really editable?
Yes. Every file is native Microsoft Word or Excel — no locked PDFs. Add your logo, change wording, and tailor the content to your organisation. The toolkit is yours to keep and reuse.
Does this certify my organisation?
No. These are documentation toolkits aligned to the relevant standard to help you prepare. Certification itself is issued by an accredited certification body after their audit. Our toolkits give you a strong, audit-ready starting point.
How is it delivered?
Instantly and digitally. There's no physical shipment — you download the files right after payment and receive a backup link by email.
Do I get updates?
Yes. If we revise this toolkit, you're entitled to the updated version at no extra cost — just contact us with your order details.
What is your refund policy?
These are digital products, so once a toolkit has been downloaded we cannot take it back. If you have not downloaded yet, contact us and we will cancel the order and refund you in full. We also refund in full if the files are damaged, incomplete, or not what the product page described.
Cannot find your standard?
Tell us which scheme you work to. We will point you to the right toolkit.
More in EU Compliance
See all 15
EU GDPR Privacy & Data Protection Awareness Training Package
EU Compliance337 documents $850USD
EU GDPR Data Protection Impact Assessment (DPIA) Management System
EU Compliance271 documents $850USD
EU GDPR Core Management System
EU Compliance26 documents $950USD