EN 1090 vs ISO 27701
EN 1090
European standard for execution of structural steel and aluminium
ISO 27701
International standard for privacy information management systems.
Quick Verdict
EN 1090 mandates CE marking for structural steel/aluminium in EU construction via FPC and execution classes, while ISO 27701 certifies voluntary PIMS for global PII privacy governance. Fabricators need EN 1090 for market access; data handlers adopt 27701 for compliance proof.
EN 1090
EN 1090 Execution of steel and aluminium structures
Key Features
- Risk-based Execution Classes (EXC1-EXC4) scaling controls
- Factory Production Control (FPC) certification by Notified Body
- CE marking for structural steel and aluminium components
- Welding quality management aligned with ISO 3834
- Full traceability from materials to finished structures
ISO 27701
ISO/IEC 27701:2026 Privacy Information Management
Key Features
- Establishes Privacy Information Management System (PIMS)
- PII controller and processor specific controls (Annex A/B)
- Risk-based PDCA cycle with DPIAs
- Mappings to GDPR and ISO 27001/27002
- Data subject rights and vendor management processes
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
EN 1090 Details
What It Is
EN 1090 is a harmonized European standard family (EN 1090-1, -2, -3) for the execution and conformity assessment of structural steel and aluminium components under the Construction Products Regulation (CPR). Its primary purpose is ensuring safe fabrication, assembly, and market placement via CE marking. It employs a risk-based approach through Execution Classes (EXC1-EXC4), scaling requirements by failure consequences, service conditions, and production complexity.
Key Components
- **EN 1090-1Conformity assessment, Factory Production Control (FPC), Declaration of Performance (DoP).
- **EN 1090-2/-3Technical rules for steel/aluminium (welding, tolerances, corrosion protection, inspection/NDT).
- Core principles: traceability, welding per ISO 3834, Notified Body certification, ongoing surveillance.
- Compliance model: FPC certification enabling CE marking.
Why Organizations Use It
Mandated for EU market access; reduces liability, ensures quality. Benefits include risk mitigation, rework reduction, market credibility. Builds stakeholder trust via certified performance declarations.
Implementation Overview
Phased: gap analysis, FPC development, personnel training (welding coordinators), NB audits. Applies to fabricators in construction; 6-12 months typical, with surveillance. Targets steel/aluminium producers geographically in EEA.
ISO 27701 Details
What It Is
ISO/IEC 27701:2026 is the international standard extending ISO/IEC 27001 for a Privacy Information Management System (PIMS). It provides requirements and guidance for managing personally identifiable information (PII) lifecycle, emphasizing accountability, risk management, and alignment with privacy laws like GDPR using a risk-based PDCA approach.
Key Components
- Clauses 4–10 for management system (context, leadership, planning, operation, evaluation, improvement).
- Annex A (PII controllers) and Annex B (PII processors) with privacy-specific controls.
- Mappings to GDPR, ISO 27002, and others.
- Certification via accredited bodies, often integrated with ISO 27001 audits.
Why Organizations Use It
- Mitigates regulatory fines, breach risks, and vendor exclusions.
- Builds trust, enables procurement differentiation, harmonizes multi-jurisdiction compliance.
- Reduces data footprint costs, provides audit-ready evidence.
Implementation Overview
- Phased: discover/scope, design/plan, implement/operate, validate/improve.
- Activities: PII inventory, risk assessments (DPIAs), DSR processes, training, vendor contracts.
- Suits all sizes/industries handling PII; voluntary certification over 6–12 months.
Key Differences
| Aspect | EN 1090 | ISO 27701 |
|---|---|---|
| Scope | Structural steel/aluminium execution & conformity | Privacy Information Management System (PIMS) |
| Industry | Construction, fabrication (EU/EEA focus) | All PII-processing sectors worldwide |
| Nature | Harmonized standard enabling CE marking | Voluntary PIMS certification standard |
| Testing | FPC certification, surveillance audits by Notified Bodies | Internal audits, certification body surveillance |
| Penalties | Market exclusion, no CE marking | Loss of certification, no legal penalties |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about EN 1090 and ISO 27701
EN 1090 FAQ
ISO 27701 FAQ
You Might also be Interested in These Articles...
How to Implement CIS Controls v8.1 as a ‘Control Backbone’ for NIS2 & DORA (Step-by-Step Implementation Guide)
Deploy CIS Controls v8.1 as a control backbone for NIS2 & DORA compliance. Step-by-step roadmap (IG1→IG2), deliverables, metrics & evidence model for hybrid/clo
From Hygiene to Governance: How to Scale Cyber Essentials into a Full ISO 27001 ISMS in 2026
Discover how to scale Cyber Essentials into a full ISO 27001 ISMS in 2026. Reuse evidence, map controls, meet DORA & NIS2 rules and win enterprise contracts.
The Human-AI Synergy: How Modern Compliance Tools Amplify Your Team's Strategic Impact
Unlock human-AI synergy with modern compliance tools. Automate monitoring, cut non-compliance risks 3x, and boost strategic decision-making. Elevate your team's
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Explore More Comparisons
See how EN 1090 and ISO 27701 compare against other standards