CISO on ISO 27701 and GDPR: cross-border data, employee data and the 72-hour notice

For multinational customer data and employee data, which applies: GDPR, APEC/Global CBPR or ISO 27701, and how do they divide the work?

The EU is not a CBPR participant: CBPR certification cannot serve as a GDPR Article 46 transfer tool.

If our EU subsidiary sends employee data to the HR or security systems at our Taiwan headquarters, is that a cross-border transfer?

EDPB Guidelines 05/2021 (version 2, adopted 14 February 2023) set three cumulative criteria: the exporter is subject to the GDPR for the processing; the exporter discloses the data by transmission or otherwise makes it available; the importer is in a third country, whether or not the importer is itself subject to the GDPR.

• Companies in the same group can be separate controllers or processors; in the guidelines' example, a subsidiary providing employee data to its parent in a third country is a transfer.
• An employee on a business trip remotely accessing the company's own data is, in the guidelines' example, not a transfer, because the person accessing is an employee, not another controller.
• Where it is a transfer, Taiwan currently has no EU adequacy decision, so appropriate safeguards under Article 46 are needed, such as standard contractual clauses or binding corporate rules (BCR, Article 47).

The case-by-case call is made by legal counsel based on the data flows.

Our subsidiaries in different countries each have their own privacy laws. How can one system satisfy all of them?

Use a common base plus a register of country differences. Build the common base once and share it: records of processing and data-flow maps, privacy risk assessment and DPIA, processor contracts, breach response. List the differences country by country with an owner for each:

Keep the register current with legal changes: some amendments to Taiwan's PDPA promulgated on 11 November 2025 take effect on a date set by the Executive Yuan.

When a personal data breach happens, how does the CISO meet the GDPR 72-hour deadline and the others?

GDPR Article 33(1): without undue delay and, where feasible, within 72 hours of becoming aware, notify the supervisory authority (unless the breach is unlikely to result in a risk). The CISO prepares three things in advance:

• Role: where the company is a processor, Article 33(2) requires it to notify the controller without undue delay after becoming aware of the breach.
• Authorities: without an establishment in the EU there is no single point of contact, so list the member-state supervisory authorities that may be involved.
• Several deadlines: one incident can also trigger NIS2, DORA or the EU CRA, each with its own starting point and authority; decide which apply in one incident classification step.

Listed companies can add this path to the response procedure under Article 34 of the Cybersecurity Control Guidelines; companies that are not public companies are not covered by the guidelines and can use them voluntarily.

Does an ISO 27701 certificate mean GDPR compliance? How do the CISO, legal and the DPO divide the work?

No. 27701 shows that a privacy management system exists; it does not create GDPR's statutory procedures. A suggested split:

• CISO: technical controls such as encryption, access control and breach detection; a 72-hour notification that actually works, with drill records.
• Legal or outside counsel: the Article 27 EU representative, the choice of SCC module, and whether a DPIA is mandatory; these are legal judgments 27701 does not make.
• Data protection officer (DPO): under Article 37(1), a DPO is mandatory for processing by a public authority, for core activities requiring large-scale, regular and systematic monitoring, or for large-scale processing of special-category or criminal data; otherwise it is the company's choice.

We already have ISO 27001. How long does extending to 27701 take, and what evidence serves ESG indicator S-13?

Listed on the service page: basic GDPR compliance usually takes 2–3 months; integrated ISO 27701 certification 5–8 months, shortened to 3–5 months with 27001. ISO/IEC 27701:2025 was published on 14 October 2025 and can be certified without 27001; holders of 2019 certificates have a transition period expected to run to October 2028. With 27001 in place, internal audit and management review can be combined.

Indicator S-13 of the TWSE ESG evaluation asks whether the company has a personal data protection policy and discloses its content and implementation; policies and records from a running 27701 system can support the explanation, though each indicator must be checked against that year's wording. Companies that are not public companies are not covered by the evaluation and can use it voluntarily.

How does Winners Consulting help a CISO with ISO 27701 and GDPR?

• Map the data flows first: confirm where GDPR applies, the mechanisms required and the 27701 scope.
• One backbone: with 27701 as the backbone, attach every GDPR obligation to the matching control, close the gaps in the project, and go through certification together.
• Four entry points: 27701 implementation and certification, GDPR cross-border transfer mechanisms, DPIA for clinical trials and health data, and external DPO and EU representative; each can be a project on its own or combined.
• Drills: set up 72-hour breach notification drills and an annual review.
• Division of roles: Winners Consulting is a consultant and does not certify; VP- and director-level consultants lead the work end to end, never outsourced.
• Named clients: Hypercore Fitness Center, Cho Yuan, the Joint Credit Information Center (JCIC) and Lativ.

Read more: ISO 27701, GDPR, choosing an ISO 27701 consultant, choosing a GDPR consultant. Apply for a free mechanism diagnosis