The entire Vandeputte organisation, including all support services, is ISO 27001 certified. ISO 27001 is the internationally recognised standard for information security: it confirms that an organisation systematically identifies, controls and monitors risks relating to sensitive information.
For Vandeputte, this means that safety doesn't stop at physical protection, but also extends to the way we handle your data.
What exactly is ISO 27001?
ISO 27001 is an international standard that sets requirements for an information security management system (ISMS): a set of processes, responsibilities and controls through which an organisation takes a structured approach to information security. The standard is published by the International Organization for Standardization (ISO) and awarded following an independent audit by an accredited certification body.
Important to know: ISO 27001 is not just about IT security or firewalls. The standard looks at three layers at the same time:
- Technology: how data is stored, processed and secured
- Processes: which procedures apply to accessing, storing and processing information
- People: whether employees are sufficiently trained to handle information safely and responsibly
A certification for the entire organisation
What makes Vandeputte's certification special is its scope. Many organisations limit their ISO 27001 certification to specific departments, activities or IT processes. At Vandeputte, the same information security principles are applied to every process, from advice and ordering to logistics, invoicing, customer support and internal services.
Why does information security matter for a safety partner?
At Vandeputte Safety Experts, we think first and foremost of physical protection: helmets, PPE, safety equipment. But a safety partner is also an information partner. To deliver the right protection at the right time, we collect and manage the data needed for our services.
A supplier that handles safety equipment carefully but is careless with the associated data offers, in practice, only half a guarantee.
What data do you actually share with Vandeputte?
When you work with a safety partner, you often share more information than you might first think:
- Employees' personal data: names, job titles, contact details
- Sizing data for PPE: for example shoe, clothing or helmet sizes, sometimes linked to individual employees
- Order data: what is ordered, when and for whom, often linked to departments or locations
- Location data: delivery addresses, warehouses, work sites
- Operational processes: how your organisation manages, orders and monitors safety equipment
Not every piece of data is equally sensitive, but taken together they give a fairly complete picture of your organisation. Reason enough to handle them with care.
What does this change in practice for you as a customer?
ISO 27001 certification translates into four concrete guarantees:
- Sensitive information is handled with care. All data we receive is processed according to defined procedures, with clear responsibilities for each process.
- Only necessary data is processed. We don't collect more data than needed "just in case", a principle that also aligns with the GDPR requirement for data minimisation.
- Employees are actively trained. Information security is as much about people as it is about systems. Our employees receive training on handling information safely and responsibly, regardless of the department they work in.
- Certified processes safeguard the integrity, availability and confidentiality of data. These are the three pillars of information security: data remains accurate (integrity), is available when needed (availability), and is accessible only to those authorised to view it (confidentiality).
How does Vandeputte ensure ongoing compliance?
Obtaining a certificate is one thing; continuing to comply is another. ISO 27001 is not a one-off proof, but requires organisations to follow a cycle of continual improvement: internal audits, periodic reviews and adjustments where necessary. That is what makes the difference between a standard on paper and a standard that is genuinely upheld. At Vandeputte, this is a shared responsibility across the entire organisation, so that information security remains a structural part of how we work.
Frequently asked questions about ISO 27001
Is ISO 27001 mandatory for companies?
No, ISO 27001 is a voluntary standard. Companies choose to become certified as proof that they take a structured approach to information security.
What is the difference between ISO 27001 and GDPR?
GDPR is European legislation that specifically governs the protection of personal data. ISO 27001 is a broader international standard for information security in general, which also helps organisations meet their GDPR obligations but covers other forms of information and security risks as well.
How often is the certification reviewed?
Certified organisations undergo annual surveillance audits, with a full recertification audit every three years.
Does the certification apply to the whole organisation or only to certain departments?
To the whole organisation, including all support services.
What does this mean in practice if I am a Vandeputte customer?
You can be confident that every department you deal with, from ordering to delivery, works to the same security standards.
Trust on the shop floor and behind the scenes
Choosing ISO 27001 certification is a deliberate choice: information security is not the responsibility of a single department, but of every employee and every process within Vandeputte. This is how we build trust every day: not only in the equipment we deliver, but also in the way we handle your information.
Download our ISO 27001 certificate here
Want to know more about how we combine safety and information security? Get in touch with our team.