CFO view of GDPR and ISO 27701: fine provisions, cross-border transfers and budgeting

For GDPR fine risk, should the financial statements recognise a provision or disclose a contingent liability?

Under IAS 37, a provision requires three conditions at the same time:

1. a present obligation (legal or constructive) as a result of a past event
2. it is probable that an outflow of resources will be required to settle it
3. a reliable estimate can be made of the amount

If these are not met, no provision is recognised. A contingent liability is not recognised in the statement of financial position, but is disclosed in the notes unless the possibility of an outflow is remote.

Applied to GDPR, check in order: whether a breach has occurred or a regulatory investigation exists (the past event), how far the proceedings have progressed, and whether the amount can be estimated. Recognition, disclosure and the amount are for the auditor to judge case by case; the legal assessment comes from legal counsel.

What is the maximum fine, and how should this exposure go into board and audit committee reporting?

• GDPR Article 83: up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher; after a breach there are also notifications to authorities and individuals, claims and reputational loss
• Taiwan's Personal Data Protection Act: since the 2023 amendment, the fine ceiling for non-government bodies breaching security obligations is NT$15 million
• ESG indicator S-13: disclosure of the personal data protection policy and its implementation

ESG indicator G-18 allows the audit committee to oversee risk management; put personal data exposure on the same risk map and report it with the annual risk report. Whether fines can be insured depends on policy terms and the applicable law, to be judged case by case by legal counsel. The ESG evaluation covers listed companies; companies that are not public companies are not covered and can use it voluntarily.

Is sending an EU subsidiary's basic employee records to the Taiwanese parent a cross-border transfer?

Under EDPB Guidelines 05/2021, a "transfer to a third country" needs three cumulative criteria: (1) the exporter is subject to the GDPR for the processing; (2) the exporter makes the personal data available to another controller, joint controller or processor; (3) the importer is in a third country.

• Entities in the same group may each be separate controllers or processors; the guidelines' example of an EU subsidiary providing data to its parent in a third country is a transfer under Chapter V
• An employee of the same controller accessing data remotely from abroad is not a transfer

Taiwan currently has no EU adequacy decision. On the Taiwanese side, Article 21 of the Personal Data Protection Act lets the central competent authority restrict international transfers. Whether a given flow is a transfer is for legal counsel to decide.

What group costs and contract work do transfer mechanisms bring?

Where there is a transfer, one safeguard must be chosen, each with a different cost structure:

• Standard contractual clauses (an Article 46 safeguard): contracts between group entities, a transfer impact assessment and records of cross-border transfers
• Binding corporate rules (BCRs): policies a group uses for transfers to members outside the EU, legally binding on group members and their staff; they must be approved by the competent data protection authority after an EDPB opinion

The commissionable work packages exclude system changes and formal legal opinions, which must be budgeted separately. The CFO should plan legal opinions, contract management and approval time together in the budget.

Budgeting: how do standalone ISO 27701 and integration with ISO 27001 differ in cost structure?

Cost also depends on role (controller or processor), scope and the number of laws to map; the certification fee is quoted by the certification body by scope and is an external cost. Quotes are not based on document page counts. This page lists no fees.

Does an ISO 27701 certificate mean GDPR compliance, and how long does it take?

No. An ISO 27701 certificate is a management system certification, not a certification mechanism under GDPR Article 42; an Article 27 EU representative, the choice of SCC module and whether a DPIA is mandatory are legal judgments ISO 27701 does not make.

As listed on the service page:

• Baseline GDPR compliance: usually 2–3 months
• With ISO 27701 certification: 5–8 months, or 3–5 months with an ISO 27001 base

For holders of 2019 certificates, the transition period is expected to run to October 2028 (per certification body announcements), and the transition can be folded into the next recertification cycle.

How does Winners Consulting help a CFO with GDPR and ISO 27701?

• VP- and director-level consultants lead the work end to end, never outsourced
• The ISO 27701 PIMS framework integrates GDPR and Taiwan's Personal Data Protection Act, so one system meets both without duplication
• We help review SCC terms, assess transfer impact and build complete cross-border transfer records, and set up 72-hour breach notification drills and an annual review
• Accounting recognition and legal opinions remain with the auditor and lawyers respectively

Personal data protection clients published with authorisation include the Joint Credit Information Center (JCIC), Lativ, 卓元科健 (Cho Yuan) and Hypercore Fitness Center. Read more: GDPR compliance, ISO 27701, Choosing a GDPR consultant, ISO 27701 budget, CFO role page. Request a free mechanism diagnosis