Cyber Essentials and GDPR: What Certification Does and Doesn't Prove

Cyber Essentials and GDPR are related, but one does not deliver the other. UK GDPR requires every organisation that handles personal data to protect it with appropriate technical and organisational measures (Article 32). Cyber Essentials certifies that five baseline technical controls are in place across your IT. That is solid evidence for part of Article 32, but on its own it does not make you GDPR compliant, and it says nothing about the organisational half of the duty.

If a customer, insurer or tender has asked you to evidence “appropriate technical measures”, a Cyber Essentials certificate is a strong first document to send. This guide explains what it proves, what it leaves out and what to add. It is written by an IASME-licensed Cyber Essentials certification body and is not legal advice.

What does UK GDPR Article 32 (security of processing) require?

Article 32 of the GDPR, headed “Security of processing”, requires controllers and processors to secure personal data at a level appropriate to the risk, taking account of the state of the art, the cost of implementation and the nature and purpose of the processing. It lists example measures to use “as appropriate”, so there is no fixed checklist that guarantees compliance.

The full text is on legislation.gov.uk. Two points matter for Cyber Essentials. The duty is risk-based, so a fixed baseline can only ever be part of the answer. And 32(3) refers to schemes approved under UK GDPR, which Cyber Essentials is not (more on that below).

Does Cyber Essentials make you GDPR compliant?

No. Cyber Essentials certification checks five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. These controls defend against common internet-based attacks that can lead to a personal data breach, such as account takeover through stolen passwords and the exploitation of unpatched software. But UK GDPR covers far more than device security, and even within Article 32 several measures sit outside Cyber Essentials.

Where do Cyber Essentials and GDPR overlap, and where don’t they?

They overlap on baseline technical security: a certificate evidences five controls on the devices, accounts and cloud services in its scope. They do not overlap on encryption, backups, risk assessment or most of the testing Article 32 expects.

Watch the scope. A Cyber Essentials certificate can cover the whole organisation or a separately managed part of it. If personal data sits in a system outside that scope, the certificate says nothing about it, so send the scope statement with the certificate whenever you use it as evidence.

What does UK GDPR require that Cyber Essentials doesn’t touch?

Most of it. Article 32 is one article among many, and Cyber Essentials does not address:

• Knowing your data: what personal data you hold, where, why and for how long, and your records of processing (Article 30).
• Lawful basis, transparency and individuals’ rights, including privacy notices and subject access requests.
• Data protection by design and by default (Article 25), and data protection impact assessments for high-risk processing (Article 35).
• Processor contracts (Article 28): the written terms you need with suppliers who process personal data for you.
• Breach handling: reporting a notifiable personal data breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33), and telling the people affected when the risk to them is high (Article 34).
• Accountability (Articles 5(2) and 24): policies and records that show you comply.

Our guide to GDPR compliance audits explains how to check these areas. If you also take card payments, see how PCI DSS and GDPR overlap.

Does the ICO recognise Cyber Essentials?

Yes, as a starting point rather than as proof of compliance. The ICO’s guide to data security says a good starting point is to meet the Cyber Essentials requirements, and its security checklist refers to basic technical controls from frameworks such as Cyber Essentials. The same guidance says Cyber Essentials is “only intended to provide a ‘base’ set of controls” and will not address every organisation’s circumstances or every processing risk. It also names vulnerability scanning and penetration testing as ways to meet the testing requirement.

Cyber Essentials is not a UK GDPR certification scheme. Article 32(3) and Article 42 refer to certification mechanisms approved under UK GDPR, and the ICO keeps a register of approved certification schemes. Cyber Essentials does not appear on it (checked October 2026). A certificate is good evidence of baseline technical security, but it does not carry the specific weight Article 32(3) gives to an approved scheme.

Why do buyers ask for Cyber Essentials when they mean GDPR?

Because it is a quick, independently assessed signal. Under Article 28, a controller may only use processors that give sufficient guarantees of appropriate measures, so customers ask suppliers for evidence. In the public sector, the Cabinet Office procurement policy note on the scheme (PPN 014) requires central government departments, their agencies and NHS bodies to ask for Cyber Essentials or Cyber Essentials Plus, or equivalent controls, on contracts where a supplier handles citizens’ or government staff’s personal information.

A certificate answers part of the question quickly. It rarely answers all of it, which is why supplier questionnaires usually go on to ask about encryption, backups, breach handling and staff training.

Is Cyber Essentials Plus or ISO 27001 better evidence for GDPR?

They go further in different directions, and neither is a GDPR certificate.

A sensible order for most small and mid-sized organisations is Cyber Essentials first, then Cyber Essentials Plus when customers want independent testing, then ISO 27001 when you need to show security is governed across the business. Our comparison of Cyber Essentials vs ISO 27001 covers that decision in detail. If customers want evidence of how you manage personal data itself, not only how you secure it, ISO 27701 is the privacy management standard built for that.

What should you send when asked for “appropriate technical measures”?

Send a short evidence pack rather than a certificate alone:

1. Your Cyber Essentials certificate and its scope, showing which parts of the organisation and which systems are covered.
2. A one-page summary of organisational measures: who is responsible for data protection, how staff are trained, your breach process and how you manage processor contracts.
3. Encryption and backup statements: which devices and services are encrypted, how often you back up and when you last tested a restore.
4. Testing evidence: your Cyber Essentials Plus result, or a summary of recent penetration testing or vulnerability scanning with remediation dates.
5. Your ISO 27001 certificate and scope, if you hold one.

Keep claims exact. “We are Cyber Essentials certified” is accurate. “Cyber Essentials makes us GDPR compliant” is not, and an informed buyer will notice.

Why Sovereign Secure?

• We are an IASME-licensed Cyber Essentials certification body, so we assess and issue Cyber Essentials and Cyber Essentials Plus certificates ourselves.
• We are ISO 27001 certified, and provide ISO 27001 consultancy with certification audits by our partner certification body, MQA International.
• We are registered with the ICO, and we provide penetration testing and vulnerability scanning for the regular testing Article 32 expects.
• Cyber Essentials packages start at £320 + VAT, with fixed Bronze, Silver and Gold options by organisation size.

We do not give legal advice or act as a data protection officer. For legal questions about your processing, speak to a data protection specialist.

What is the next step?

Start with scope, because that decides what the certificate can prove. Our free Cyber Essentials scoping questionnaire helps you include the systems that hold personal data, and once it is done we can give you a fixed Cyber Essentials price.