{"id":2829,"date":"2026-07-06T13:26:38","date_gmt":"2026-07-06T12:26:38","guid":{"rendered":"https:\/\/icomply.pm\/resources\/article-reusing-evidence\/"},"modified":"2026-09-08T12:11:45","modified_gmt":"2026-09-08T11:11:45","slug":"reuse-evidence","status":"publish","type":"post","link":"https:\/\/icomply.pt\/en\/resources\/reuse-evidence\/","title":{"rendered":"Reuse evidence from GDPR across ISO 27701 and the AI Act"},"content":{"rendered":"<h2 data-dc-tpl=\"25\">Reuse Evidence<\/h2>\n<p data-dc-tpl=\"25\">Privacy teams produce a great deal of evidence: processing records, personal data impact assessments, retention periods, consent records and transfer assessments. The mistake is to file this evidence by framework. When this is done, the same retention policy ends up in the GDPR folder, the ISO 27701 folder and the AI Act folder \u2014 three copies, three updating issues.  <\/p>\n<h2 data-dc-tpl=\"26\">Evidence belongs to a control, not a framework<\/h2>\n<p data-dc-tpl=\"27\">Attach the evidence to the <strong data-dc-tpl=\"28\">control<\/strong> it supports and let the frameworks reference the control. Its retention period is attached once to a \u2018retention governance\u2019 control. The GDPR, ISO 27701 and any other framework that requires it inherit the same evidence \u2014 with a single version history.  <\/p>\n<h2 data-dc-tpl=\"29\">An example of privacy<\/h2>\n<ul data-dc-tpl=\"30\">\n<li data-dc-tpl=\"31\">The <strong data-dc-tpl=\"32\">processing records<\/strong> demonstrate the controls referred to in the GDPR (Article 30) and ISO 27701.<\/li>\n<li data-dc-tpl=\"33\">A <strong data-dc-tpl=\"34\">Data Protection Impact Assessment (DPIA) <\/strong>may also form part of a Fundamental Rights Impact Assessment under the AI Act when AI processes personal data.<\/li>\n<li data-dc-tpl=\"35\"><strong data-dc-tpl=\"36\">Access controls<\/strong> demonstrate compliance with both the GDPR <em data-dc-tpl=\"37\">and <\/em>ISO 27001.<\/li>\n<\/ul>\n<h2 data-dc-tpl=\"38\">Why it matters beyond just tidying up<\/h2>\n<p data-dc-tpl=\"39\">Reuse is not just about convenience \u2014 it\u2019s about rigour. A single source of truth means that when a document is updated, it is updated everywhere instantly, so an auditor never sees an out-of-date copy. It also makes expansion cost-effective: adding ISO 27701 to an existing GDPR programme becomes a mapping exercise, rather than a redrafting project.  <\/p>\n<p data-dc-tpl=\"40\">The principle is simple and applies across all areas: <strong data-dc-tpl=\"41\">capture it once, reuse it everywhere.<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Stop duplicating documents. Map the supporting evidence once and let it fulfil all the requirements that refer to it. <\/p>\n","protected":false},"author":1,"featured_media":2848,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_ice_seo_score":0,"_ice_review":"","footnotes":""},"categories":[41],"tags":[],"class_list":["post-2829","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-privacy"],"_links":{"self":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/posts\/2829","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/comments?post=2829"}],"version-history":[{"count":5,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/posts\/2829\/revisions"}],"predecessor-version":[{"id":4062,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/posts\/2829\/revisions\/4062"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/media\/2848"}],"wp:attachment":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/media?parent=2829"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/categories?post=2829"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/tags?post=2829"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}