ISO 27701 and GDPR for product managers: which privacy work comes first when selling into each market?

Selling into different markets, which personal data collection makes the GDPR apply?

First inventory the product's personal data types, sources, purposes, retention periods and recipients, then decide:

• GDPR scope: for a Taiwanese company without an EU establishment, the GDPR applies only when it offers goods or services to people in the EU or monitors their behaviour in the EU (Article 3(2)).
• Role: whether each business line acts as controller, joint controller or processor (Articles 24, 26 and 28); the obligations differ.
• Taiwan's PDPA: it applies to public and non-public bodies collecting, processing and using personal data in Taiwan; it is the local legal duty.

Get this wrong and the documents and contracts that follow must be redone; whether the law applies in a given case is for legal counsel to judge against the product's actual functions.

Before launch, what privacy design and defaults must the product itself have?

GDPR Article 25 requires data protection by design and by default. According to EDPB Guidelines 4/2019, the core obligation is the implementation of appropriate measures and necessary safeguards so that the data protection principles are applied effectively; the "by default" obligation applies to the amount of personal data collected, the extent of processing, the storage period and accessibility. The article addresses controllers directly; processors and producers are not directly addressed, but the guidelines recommend that the three cooperate.

Common privacy deliverables before launch:

• Privacy policy and consent management
• Data subject rights response procedures
• Product settings that collect the minimum by default

Where the brand customer is the controller, the product design you deliver is used to demonstrate the customer's Article 25 compliance.

Which product features need a data protection impact assessment (DPIA) first? Will it delay the launch?

GDPR Article 35 requires a data protection impact assessment for high-risk processing; who prepares the Article 30 record of processing activities and the DPIA, and how often they are updated, should be decided at project start. A DPIA is completed before the processing begins, so schedule it alongside design review rather than adding it just before launch.

Note: whether a DPIA is mandatory is a legal judgment that ISO 27701 does not make; the 27701 risk assessment and the DPIA can share one set of working papers.

Timeline as listed on the service page: basic GDPR compliance usually takes 2–3 months; together with ISO 27701 certification 5–8 months, shortened to 3–5 months with an ISO 27001 base.

If our cloud or remote service sends user data back to Taiwan, is that a cross-border transfer?

Under EDPB Guidelines 05/2021, a "transfer" under GDPR Chapter V requires three cumulative criteria:

1. A controller or processor (exporter) is subject to the GDPR for the given processing
2. The exporter discloses by transmission or otherwise makes personal data available
3. The importer is in a third country, whether or not it is subject to the GDPR

A data subject giving data directly to a third-country controller is not a transfer; remote access from a third country (even only by displaying data on a screen) is a transfer if the three criteria are met. Taiwan currently has no EU adequacy decision, so a transfer needs Article 46 safeguards (such as standard contractual clauses) and a transfer impact assessment; CBPR cannot serve as an Article 46 transfer tool. Whether a product architecture involves a transfer is for legal counsel to judge from the data flows.

Our product uses cloud providers, or we process data for brand customers. What must the contracts say?

Processor contracts follow GDPR Article 28: when a controller has processing carried out on its behalf, the processor's duties are set by contract. The product manager should look at two situations:

If the processing itself falls under Article 3(2), the processor has its own legal duties too, such as designating an EU representative (Article 27, with exceptions), keeping a record of processing activities (Article 30(2)) and notifying the controller of a breach (Article 33(2)).

Customers ask for ISO 27701 certification or CBPR. What do they mean to customers in each market?

The four differ in nature; first see where the data flows and who wants proof:

27701 does not automatically create the GDPR DPO, EU representative, 72-hour notification or DPIA.

How does Winners Consulting help product managers with ISO 27701 and the GDPR?

Winners Consulting first draws the product's data flows and customer requirements, then recommends which to do, in what order, or how to obtain two proofs from one document set:

• Inventory personal data types, flows and purposes, including outsourced vendors, and determine GDPR scope and controller and processor roles
• Use 27701 as the backbone and attach each GDPR obligation to the matching control, mapped to Taiwan's PDPA at the same time
• Put the legal mechanisms in place: SCCs and transfer impact assessments, DPIA, DPO and EU representative designation
• Build the privacy policy, consent management and data subject rights procedures, and drill the 72-hour breach notification

VP- and director-level consultants lead the work end to end, never outsourced. Named client: Hypercore Fitness Center (ISO 27001 and ISO 27701 dual-certification consulting). Read more: ISO 27701 consulting, GDPR consulting, Choosing a GDPR consultant, ISO 27701 timeline. Request a free mechanism diagnosis