Is ISO 27001 a legal requirement in the UK?

No. UK GDPR requires appropriate technical and organisational measures, but it doesn’t require a certificate. ISO 27001 is a widely used way to show that those measures are in place.

How do I check an ISO 27001 certificate?

Check who issued it, whether that body is accredited (in the UK by UKAS) and what the scope covers. The scope matters most. If a certificate only covers a company’s own office IT, it says little about how your equipment is handled.

What’s the difference between ISO 27001 and Cyber Essentials?

Cyber Essentials is a UK government-backed scheme built around five basic technical controls, such as firewalls and security updates. ISO 27001 goes further and covers the whole management system, including people, processes and suppliers.

What’s the difference between ISO 27001 and ISO 9001?

ISO 9001 covers quality management, ISO 27001 covers information security. Both share the same structure, so many organisations combine them in one management system.

ISO 27001 certified ITAD partner

HomeAbout usCertifications and licensesISO 27001

What is ISO 27001 and how does certification work?

ISO/IEC 27001 is the international standard for an information security management system, or ISMS (ISO). Its purpose is to protect the confidentiality, integrity and availability of information. The ISO 27001 requirements call for a risk assessment and controls that fit those risks.

The 2022 version lists 93 controls in Annex A, grouped as organisational, people, physical and technological.

An accredited certification body audits the ISMS, then returns every year for a surveillance audit. Recertification follows after three years.

Where does Circular IT group stand on ISO 27001?

We are certified to ISO/IEC 27001:2022, the latest version of the standard. That includes the controls added in 2022, such as those for threat intelligence, cloud services and the secure deletion of information.

What does our ISO 27001 certification mean for you?

Less risk and less legwork when you hand over IT equipment that holds data.

Confidence under UK GDPR: when we process equipment containing personal data, we act as your processor. UK GDPR requires processors to give sufficient guarantees on security, and our certification is independent evidence of that.
Supplier controls in your own ISMS: are you ISO 27001 certified yourself? Then your auditor will look at how you manage suppliers. An ISO 27001 certified ITAD partner makes that part of your audit simpler.
Fewer questions in your security assessment: in a supplier security questionnaire, you can point to our certificate for much of the answer.

Request an ITAD proposal

How do we protect your data from collection to erasure?

ISO 27001 provides the framework, and you can see it in every step.

Secure collection and transport: all our vehicles, including any third-party transport we use, are GPS tracked. We document the full chain of custody from collection to processing.
Certified erasure: Devices that get a second life are wiped with Blancco software. The data is provably gone, so a laptop or server can be reused instead of destroyed.
Destruction, including on-site: when reuse isn’t an option, we physically destroy storage media. We can also do this at your premises, so the data never leaves your site.

Our other certifications

We are certified to ISO 9001 for quality and ISO 14001 for environmental management.

In the UK we also hold Cyber Essentials and ADISA certification. On sustainability, we hold EcoVadis Platinum, B Corp and WEEELABEX. View all our certifications

View all our certifications

Circular IT group technicians inspecting a server rack, surrounded by certification logos

Frequently Asked Questions

Is ISO 27001 a legal requirement in the UK?

No. UK GDPR requires appropriate technical and organisational measures, but it doesn’t require a certificate. ISO 27001 is a widely used way to show that those measures are in place.
How do I check an ISO 27001 certificate?

Check who issued it, whether that body is accredited (in the UK by UKAS) and what the scope covers. The scope matters most. If a certificate only covers a company’s own office IT, it says little about how your equipment is handled.
What’s the difference between ISO 27001 and Cyber Essentials?

Cyber Essentials is a UK government-backed scheme built around five basic technical controls, such as firewalls and security updates. ISO 27001 goes further and covers the whole management system, including people, processes and suppliers.
What’s the difference between ISO 27001 and ISO 9001?

ISO 9001 covers quality management, ISO 27001 covers information security. Both share the same structure, so many organisations combine them in one management system.