ISO 27001, ENS and GDPR: Regulatory Compliance in the Data Centre

ISO 27001: The International Information Security Standard

ISO/IEC 27001 is the leading international standard for information security management. Published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), it defines the requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS).

The current version, ISO 27001:2022, includes an Annex A with 93 controls organised into four categories: organisational controls, people controls, physical controls and technological controls. Not all controls are mandatory: the organisation must carry out a risk assessment and select the controls applicable to its context, documenting any exclusions in the Statement of Applicability (SoA).

The certification process involves a two-stage audit by an accredited body (such as AENOR or BSI): Stage 1 reviews the ISMS documentation, and Stage 2 verifies the effective implementation of controls in day-to-day operations. The certificate is valid for three years, with annual surveillance audits.

• verified_user Voluntary but decisive: although not legally mandatory, many public tenders and corporate contracts require it as a minimum prerequisite.
• verified_user Risk-based: the ISMS starts with a formal risk assessment that determines which controls are implemented and in what order of priority.
• verified_user Continual improvement: the PDCA (Plan-Do-Check-Act) cycle requires the ISMS to be reviewed and improved on an ongoing basis, not only at audit time.

ENS: Spain's National Security Framework

The Esquema Nacional de Seguridad (ENS), governed by Royal Decree 311/2022, is the Spanish regulatory framework that establishes the basic principles and minimum security requirements for information protection within the public sector. Unlike ISO 27001, the ENS is legally mandatory for all Spanish public administrations and for the technology providers that deliver services to them.

The ENS classifies information systems into three categories based on the impact a security incident would have: Basic, Medium and High. The High category applies when a security breach could cause serious or very serious harm to citizens' rights, public service operations or public safety. Hosting providers that host public-administration systems containing sensitive data must obtain ENS certification at the corresponding category level.

The ENS defines 75 security measures grouped into three frameworks: the organisational framework (security policy, standards, procedures, authorisation), the operational framework (planning, access control, operations, external services, continuity, monitoring) and protection measures (facilities, personnel, equipment, communications, media, applications, information, services). Each measure has different requirements depending on the system's category.

GDPR: Personal Data Protection

The General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, is the European legislation governing the processing of personal data. It applies to every organisation that processes data of EU residents, regardless of where the organisation is located. In Spain it is supplemented by Organic Law 3/2018 (LOPDGDD).

The GDPR draws a fundamental distinction between the data controller (who determines the purposes and means of processing) and the data processor (who processes data on behalf of the controller). A hosting or data centre provider acts as a data processor and must sign a data processing agreement (Article 28) detailing security measures, breach notification obligations and data transfer restrictions.

The GDPR's core principles include data minimisation, purpose limitation, integrity and confidentiality, and accountability. Article 32 requires both controllers and processors to implement appropriate technical and organisational measures commensurate with the level of risk, including encryption, pseudonymisation, the ability to restore data, and regular testing processes.

• gavel Penalties: fines can reach EUR 20 million or 4% of annual global turnover, whichever is greater.
• gavel International transfers: personal data cannot be transferred outside the EEA without adequate safeguards (adequacy decisions, standard contractual clauses, BCRs).
• gavel Breach notification: personal data breaches must be reported to the supervisory authority within a maximum of 72 hours of detection.

Comparison Table: ISO 27001 vs ENS vs GDPR

The following table summarises the key differences and similarities between the three regulatory frameworks:

Framework Relationships: How They Complement Each Other

Although they have different origins and focuses, the three frameworks overlap significantly in their technical and organisational requirements. Understanding their relationship allows organisations to optimise compliance efforts and avoid duplicating work.

ISO 27001 covers approximately 80% of ENS requirements. Both frameworks demand a risk assessment, documented security policies, access controls, incident management, business continuity and periodic audits. An organisation certified to ISO 27001 has already covered much of the ground needed to achieve ENS certification. The main differences lie in ENS-specific requirements such as system categorisation, CCN compliance profiles and certain communications protection measures.

The GDPR requires "appropriate technical and organisational measures" (Article 32), but does not prescribe which ones. This is where ISO 27001 proves enormously useful: an ISO 27001 certification demonstrates to the supervisory authority (the AEPD in Spain, or the ICO in the UK) that the organisation has implemented a robust, risk-based security management system subject to external audit. It does not guarantee full GDPR compliance (which includes legal aspects such as consent, data subject rights and impact assessments), but it solidly and demonstrably covers the technical and organisational security dimension.

Required Technical Controls

The three frameworks converge in requiring a set of technical controls that any data centre and hosting infrastructure must implement. These are the principal ones:

• lock Encryption at rest and in transit: data must be encrypted both on disk (AES-256) and in communications (TLS 1.2/1.3). ENS High requires specific algorithms and key lengths approved by the CCN.
• passkey Access control: multi-factor authentication (MFA) for administrative access, least-privilege principle, segregation of duties and periodic permission reviews. ENS High requires two-factor authentication for all access to High-category systems.
• monitoring Logging and monitoring: access logs, security events and system activity must be stored, protected against tampering and continuously reviewed. A SIEM or equivalent system is required for event correlation.
• emergency_home Incident response: documented procedures for the detection, containment, eradication and recovery from security incidents. The GDPR requires notification within 72 hours; the ENS requires notification to CCN-CERT.
• backup Backup and disaster recovery: encrypted backups, periodically verified, with defined and tested recovery times (RTO/RPO) through simulation exercises.
• bug_report Vulnerability management: periodic scanning, systematic patching, penetration testing and a formal process for vulnerability assessment and mitigation.

Organisational Controls

Beyond technology, all three frameworks demand an organisational structure that sustains information security on an ongoing basis. The most relevant organisational controls include:

• assessment Risk assessment: systematic identification, evaluation and treatment of information security risks. ISO 27001 and ENS both require this as the cornerstone of the management system.
• description Security policies: formal documentation of security policies, standards and procedures, approved by management and communicated to all personnel.
• school Training and awareness: periodic security training programmes for all staff, with content tailored to each role and responsibility.
• handshake Supplier management: third-party security assessments, contractual clauses, supplier audits and supply-chain control.
• sync Business continuity: documented, tested and updated continuity plans that guarantee the availability of critical services in the face of any incident.

Audits and the Certification Process

The path to certification involves a cycle of internal and external audits that validate the management system's conformity with each framework's requirements.

Internal audits are a prerequisite under both ISO 27001 and ENS. They must be performed periodically by qualified personnel who are independent of the area being audited. Their purpose is to detect non-conformities before the external audit and to feed the continual improvement cycle.

External audits are carried out by accredited bodies. For ISO 27001, these include entities such as AENOR, BSI or TUV. For the ENS, entities accredited by ENAC under the CCN scheme. The audit assesses both documentation and operational evidence: records, logs, review minutes, continuity test results, vulnerability reports and any other evidence that controls are not merely documented but effectively implemented and functioning.

The ISO 27001 certification cycle spans three years: a full certification audit in year 1, surveillance audits in years 2 and 3, and a full recertification audit at the end of the three-year period. The ENS requires renewal every two years. Both processes demand that the organisation demonstrates continual improvement between audits, not merely maintenance of the status quo.

Impact on Hosting and Infrastructure

Choosing a hosting or colocation provider is not merely a technical decision: it is a compliance decision. The provider's certifications directly affect the client organisation's ability to meet its own regulatory obligations.

Data location is critical. The GDPR restricts transfers of personal data outside the EEA. The ENS requires that Spanish public-sector data be hosted on national territory or, at a minimum, within the EU with reinforced contractual guarantees. Choosing a provider with a data centre in Spain greatly simplifies compliance with both regulations and eliminates the legal risk of international transfers.

The right to audit is another key factor. Both the GDPR (Article 28) and the ENS recognise the client's right to audit their provider. A certified provider facilitates this process: independent third-party audits validate the security controls, reducing the need for each client to conduct its own audit and offering an objective, verifiable guarantee.

Organisations that need to comply with the ENS must verify that their hosting provider is certified at the corresponding category level. Those handling sensitive personal data should ensure that the provider offers managed security services that complement their own internal controls.

Regulatory Compliance at EasyDataHost

EasyDataHost has designed its infrastructure and processes to comply simultaneously with all three regulatory frameworks. Our data centre in Spain guarantees data sovereignty on national territory, eliminating the legal complexities of international transfers.

You can review the details of our certifications, policies and security commitments on our compliance page and in our security policy.

• check_circle ISO 27001 certified: externally audited information security management system subject to continual improvement.
• check_circle ENS High: infrastructure certified to host Spanish public-sector systems at the most demanding category level.
• check_circle GDPR: data processing agreements, demonstrable technical measures and breach notification processes within 72 hours.
• check_circle Data in Spain: data centre on national territory with guaranteed data sovereignty, no international transfers.

Conclusion

Regulatory compliance in IT infrastructure is not a destination but a continuous process. ISO 27001, ENS High and the GDPR address security and data protection from complementary perspectives, and organisations operating in Spain with sensitive data or with the public sector need to align with all three frameworks simultaneously.

• arrow_right ISO 27001 provides the international reference framework for information security management.
• arrow_right ENS High is mandatory for Spanish public-sector providers and overlaps approximately 80% with ISO 27001.
• arrow_right The GDPR requires appropriate technical measures that ISO 27001 helps demonstrate to the supervisory authority.
• arrow_right Key technical controls include encryption, access control, monitoring, incident response, backup and vulnerability management.
• arrow_right Choosing a certified provider with a data centre in Spain simplifies compliance and eliminates international transfer risks.

If you need an infrastructure provider that complies with ISO 27001, ENS High and the GDPR, contact our team to design the solution that best fits your regulatory compliance requirements.