Explore the frameworks shaping data responsibility.

What it covers

• Processing for a lawful purpose, based on consent or specified legitimate uses
• A notice to individuals when consent is requested
• Verifiable consent of a parent or guardian for children's data
• Individual rights over their data, including through registered Consent Managers
• Reasonable security safeguards and breach-related duties, with penalties set by the Act

Who or what it applies to

Organizations that decide the purpose and means of processing digital personal data (Data Fiduciaries). Scope and exemptions are set out in the Act.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Digital personal data
• Children's personal data

How discovery and classification may help

Knowing where data such as digital personal data may be held can help teams prepare. It does not by itself make an organization compliant.

Status

Commencement is staged under the DPDP Rules, 2025. Most substantive obligations take effect about 18 months after the Rules were notified in November 2025, around mid-May 2027.

Official source

• Ministry of Electronics and IT: the Act (PDF) (opens in a new tab)
• Press Information Bureau: notification of the DPDP Rules (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Setting up and running the Data Protection Board of India as a digital body
• A phased timetable: Board provisions first, consent manager provisions after 12 months, and most other provisions after 18 months
• Appeals against Board decisions to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT)

Who or what it applies to

Organizations and individuals within the scope of the DPDP Act.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Digital personal data

How discovery and classification may help

Knowing where data such as digital personal data may be held can help teams prepare. It does not by itself make an organization compliant.

Official source

• Press Information Bureau: DPDP Rules, 2025 notified (PDF) (opens in a new tab)
• Press Information Bureau: press release (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Protection of identifiable health information in any form: electronic, paper or oral
• Administrative, physical and technical safeguards for electronic protected health information
• Written agreements between covered entities and business associates
• Direct liability of business associates for certain provisions

Who or what it applies to

Covered entities (health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with standard transactions) and their business associates.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Protected health information (PHI)
• Electronic protected health information (ePHI)

How discovery and classification may help

Knowing where data such as protected health information (phi) may be held can help teams prepare. It does not by itself make an organization compliant.

Official source

• US Department of Health and Human Services: Privacy Rule summary (opens in a new tab)
• HHS: Security Rule summary (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Rights to know, delete and correct personal information, and to opt out of its sale or sharing
• A right to limit the use of sensitive personal information
• Protection from discrimination for exercising these rights
• Enforcement by the California Privacy Protection Agency and the California Attorney General

Who or what it applies to

For-profit businesses that do business in California and meet at least one threshold: annual revenue, the volume of personal information handled, or the share of revenue from selling or sharing it.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Personal information
• Sensitive personal information

How discovery and classification may help

Knowing where data such as personal information may be held can help teams prepare. It does not by itself make an organization compliant.

Status

A California state law. It was amended by Proposition 24 (the CPRA), which created the California Privacy Protection Agency.

Official source

• California Attorney General: CCPA (opens in a new tab)
• California Privacy Protection Agency: FAQs (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• A written information security program with administrative, technical and physical safeguards
• Oversight of service providers that handle customer information
• Notifying the FTC of certain events involving unencrypted customer information of at least 500 consumers, as soon as possible and no later than 30 days after discovery

Who or what it applies to

Financial institutions under FTC jurisdiction. Some provisions have exemptions for smaller institutions, so check the rule.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Customer information held by a financial institution

How discovery and classification may help

Knowing where data such as customer information held by a financial institution may be held can help teams prepare. It does not by itself make an organization compliant.

Official source

• eCFR: 16 CFR Part 314, Standards for Safeguarding Customer Information (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Rules for processing personal data wholly or partly by automated means, and in structured filing systems
• Stricter treatment of special categories, such as health, biometric and genetic data
• Individual rights, including access, portability and erasure
• Independent supervisory authorities in each Member State

Who or what it applies to

Organizations that process personal data in the scope of the Regulation, and in some cases non-EU organizations that offer goods or services to people in the Union.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Personal data
• Special categories of personal data (such as health, biometric and genetic data)

How discovery and classification may help

Knowing where data such as personal data may be held can help teams prepare. It does not by itself make an organization compliant.

Official source

• EUR-Lex: Regulation (EU) 2016/679 (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Cybersecurity risk-management measures, approved and overseen by an entity's management body
• Incident reporting: an early warning within 24 hours of becoming aware of a significant incident, followed by a notification within 72 hours
• Different supervision for essential entities and important entities

Who or what it applies to

Essential and important entities in the sectors listed in the Directive, defined largely by sector and size and designated by Member States.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Network and information systems
• Incident information

How discovery and classification may help

Knowing where data such as network and information systems may be held can help teams prepare. It does not by itself make an organization compliant.

Status

A directive: it applies through the national laws of each Member State, so check the implementing law of the country concerned.

Official source

• EUR-Lex: Directive (EU) 2022/2555 (opens in a new tab)
• European Commission: NIS2 FAQs (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• The UK's rules for processing personal data under the UK GDPR and the Data Protection Act 2018
• Changes made by the 2025 Act, including updates to the ICO's enforcement powers
• A requirement for organizations to handle data protection complaints, from 19 June 2026 according to the ICO

Who or what it applies to

Organizations that process personal data within the scope of UK data protection law. See the ICO's guidance for scope.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Personal data

How discovery and classification may help

Knowing where data such as personal data may be held can help teams prepare. It does not by itself make an organization compliant.

Official source

• ICO: the Data (Use and Access) Act 2025 and what it means for organizations (opens in a new tab)
• GOV.UK: Data (Use and Access) Act factsheet on the UK GDPR and DPA (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Accountability for personal information under an organization's control
• Identifying purposes and obtaining meaningful consent
• Limiting collection, use, disclosure and retention to what is needed
• Accuracy and safeguards appropriate to the sensitivity of the information
• Openness, individual access, and the ability to challenge compliance

Who or what it applies to

Private-sector organizations handling personal information in commercial activities, regardless of their size, according to the Office of the Privacy Commissioner. Provincial laws, such as Quebec's, are separate.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Personal information

How discovery and classification may help

Knowing where data such as personal information may be held can help teams prepare. It does not by itself make an organization compliant.

Official source

• Office of the Privacy Commissioner of Canada: PIPEDA (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Responsibility of any person carrying on an enterprise for the personal information it holds
• Privacy impact assessments
• High-confidentiality default settings for technological products offered to the public
• A right to portability of computerized personal information collected from the person
• Administrative monetary penalties of up to $10 million or 2% of worldwide turnover, whichever is higher

Who or what it applies to

Persons carrying on an enterprise that collect, hold, use or communicate personal information in Quebec's private sector.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Personal information

How discovery and classification may help

Knowing where data such as personal information may be held can help teams prepare. It does not by itself make an organization compliant.

Status

Law 25 (2021) was phased in over three years, with portability rights taking effect on 22 September 2024.

Official source

• LégisQuébec: Act respecting the protection of personal information in the private sector (opens in a new tab)
• Commission d'accès à l'information: main changes under Law 25 (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• The Australian Privacy Principles for collecting, using, securing and disclosing personal information
• A clarification that reasonable steps to secure personal information include technical and organizational measures (APP 11)
• OAIC infringement notices for some administrative breaches
• From 10 December 2026, privacy policies must describe certain uses of personal information in automated decision-making

Who or what it applies to

APP entities, meaning the organizations and agencies the Act covers.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Personal information

How discovery and classification may help

Knowing where data such as personal information may be held can help teams prepare. It does not by itself make an organization compliant.

Status

Recent amendments are being phased in. A transparency duty for automated decision-making starts on 10 December 2026.

Official source

• OAIC: the Privacy Act (opens in a new tab)
• Federal Register of Legislation: Privacy Act 1988 (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Consent and purpose limitation for collecting, using and disclosing personal data
• Reasonable security arrangements, and limits on retention
• Limits on transferring personal data outside Singapore
• Access and correction requests from individuals
• Notifying the PDPC of data breaches likely to cause significant harm or affecting 500 or more individuals, no later than 3 calendar days after the breach is assessed as notifiable

Who or what it applies to

Organizations that handle personal data. A data intermediary processing data under a written contract is generally subject to a narrower set of obligations.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Personal data

How discovery and classification may help

Knowing where data such as personal data may be held can help teams prepare. It does not by itself make an organization compliant.

Official source

• PDPC: data protection obligations (opens in a new tab)
• Singapore Statutes Online: PDPA 2012 (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Obligations for operators that use personal information databases in business
• Reporting to the PPC when a leak, loss or damage occurs
• Rules on providing personal data to third parties, including more information for transfers to recipients in foreign countries
• Pseudonymously processed information
• Reports and orders that can extend to foreign operators supplying goods or services in Japan

Who or what it applies to

Personal information handling business operators. Central government bodies, local governments and incorporated administrative agencies are excluded from that definition.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Personal information
• Pseudonymously processed information

How discovery and classification may help

Knowing where data such as personal information may be held can help teams prepare. It does not by itself make an organization compliant.

Official source

• Personal Information Protection Commission: amended Act (English translation, PDF) (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Legal bases for processing, such as consent and legitimate interest
• Consent that must be informed and clear: consent is void if the information given is misleading or was not presented clearly beforehand
• Limits on relying on legitimate interest, including a balancing test described in ANPD guidance
• Individual petitions to the ANPD against a controller

Who or what it applies to

Organizations that process personal data within the scope of the Law.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Personal data

How discovery and classification may help

Knowing where data such as personal data may be held can help teams prepare. It does not by itself make an organization compliant.

Official source

• ANPD: LGPD, Law No. 13,709 (English, PDF) (opens in a new tab)
• Planalto: consolidated text (Portuguese) (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• A framework for protecting personal data and privacy
• The UAE Data Office as the federal regulator, issuing guidance and instructions for applying the law
• Executive regulations for specific matters, such as when a Data Protection Officer is needed

Who or what it applies to

Organizations that process personal data within the scope of the law. Free zones such as the DIFC have their own laws.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Personal data

How discovery and classification may help

Knowing where data such as personal data may be held can help teams prepare. It does not by itself make an organization compliant.

Status

The official UAE portal gives 2 January 2022 as the date the law came into force.

Official source

• UAE Government portal: data protection laws (opens in a new tab)
• UAE Legislation portal: Federal Decree-Law No. 45 of 2021 (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Supervision and enforcement by the Commissioner of Data Protection
• Accompanying Data Protection Regulations covering notifications to the Commissioner, fines and sanctions, and international data transfers
• Complaints to the Commissioner when an access request is refused

Who or what it applies to

Entities established in the Dubai International Financial Centre.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Personal data

How discovery and classification may help

Knowing where data such as personal data may be held can help teams prepare. It does not by itself make an organization compliant.

Status

Took effect on 1 July 2020, according to the DIFC.

Official source

• DIFC: Commissioner of Data Protection (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Implementing Regulations and a regulation on transfers of personal data outside the Kingdom
• Notifying the regulator of a personal data incident within 72 hours of becoming aware, where harm is possible
• Requests for access, correction and destruction, answered within 30 days and extendable by a further 30
• Monitoring, investigation and complaint handling by SDAIA

Who or what it applies to

Organizations that process personal data within the scope of the law.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Personal data

How discovery and classification may help

Knowing where data such as personal data may be held can help teams prepare. It does not by itself make an organization compliant.

Status

In force from 14 September 2023, with a one-year grace period in which penalties would not be applied. Compliance was expected by 14 September 2024.

Official source

• SDAIA: Implementing Regulations of the PDPL (PDF) (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Requirements for an information security management system
• Edition 3, published in October 2022, with Amendment 1:2024 on climate action changes
• Certification is optional and is carried out by external certification bodies; ISO does not certify organizations

Who or what it applies to

Any organization that chooses to adopt it.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Information assets (information security)

How discovery and classification may help

Knowing where data such as information assets (information security) may be held can help teams prepare. It does not by itself make an organization compliant.

Official source

• ISO: ISO/IEC 27001:2022 (opens in a new tab)
• ISO: Amendment 1:2024 (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Requirements for establishing, implementing, maintaining and continually improving a PIMS
• A standalone management system standard in its 2025 edition
• Separate ISO/IEC 27706:2025 sets requirements for bodies that audit and certify a PIMS

Who or what it applies to

Any organization that chooses to adopt it, as a PII controller or processor.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Personally identifiable information (PII)

How discovery and classification may help

Knowing where data such as personally identifiable information (pii) may be held can help teams prepare. It does not by itself make an organization compliant.

Status

The 2019 edition was withdrawn on 14 October 2025.

Official source

• ISO: ISO/IEC 27701:2025 (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Protection of cardholder data (such as the primary account number, cardholder name and expiration date)
• Protection of sensitive authentication data (such as full track data, card verification codes and PINs)
• Twelve requirements, from network security controls to organizational policies and programs
• Version 4.0 was published on 31 March 2022 and expanded multi-factor authentication requirements

Who or what it applies to

Entities that store, process or transmit cardholder data and/or sensitive authentication data, or that could affect the security of the cardholder data environment.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Cardholder data
• Sensitive authentication data

How discovery and classification may help

Knowing where data such as cardholder data may be held can help teams prepare. It does not by itself make an organization compliant.

Official source

• PCI Security Standards Council: PCI DSS v4.0 announcement (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Six functions: Govern, Identify, Protect, Detect, Respond and Recover
• Govern is new in version 2.0 and links cybersecurity work to risk management and legal obligations
• Functions are not strict steps; NIST describes them as running concurrently

Who or what it applies to

Organizations that choose to use it to understand and manage cybersecurity risk.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Assets, suppliers and risks (Identify)
• Safeguards for assets (Protect)

How discovery and classification may help

Knowing where data such as assets, suppliers and risks (identify) may be held can help teams prepare. It does not by itself make an organization compliant.

Official source

• NIST: release of Cybersecurity Framework 2.0 (opens in a new tab)
• NIST CSWP 29: The NIST Cybersecurity Framework 2.0 (PDF) (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Five Core functions: Identify-P, Govern-P, Control-P, Communicate-P and Protect-P
• A risk- and outcome-based approach, not a checklist of required actions
• Designed to be used regardless of technology, sector, law or jurisdiction

Who or what it applies to

Organizations that choose to use it to manage privacy risk.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Data processing activities that create privacy risk

How discovery and classification may help

Knowing where data such as data processing activities that create privacy risk may be held can help teams prepare. It does not by itself make an organization compliant.

Official source

• NIST: Privacy Framework, Version 1.0 (opens in a new tab)

Last reviewed: 27 October 2026

What it covers

• Five trust services categories: security, availability, processing integrity, confidentiality and privacy
• The 2017 Trust Services Criteria, with revised points of focus issued in 2022
• Separate 2018 description criteria for how a service organization describes its system in a SOC 2 report

Who or what it applies to

Service organizations that choose to be examined and report under SOC 2.

This is a high-level description. Whether it applies to your organization is a legal question.

Relevant data categories

• Customer information handled by a service organization

How discovery and classification may help

Knowing where data such as customer information handled by a service organization may be held can help teams prepare. It does not by itself make an organization compliant.

Official source

• AICPA: 2017 Trust Services Criteria (with revised points of focus, 2022) (opens in a new tab)

Last reviewed: 27 October 2026