IT Compliance category

International IT Regulations by Region

National and regional laws that apply to IT companies serving customers abroad. 28 entries, 8 with a full guide.

Exporting software or IT services means exporting compliance. Many laws apply because of where your customers or users are, not where you are registered. An Indian or US software company with EU users can be subject to the GDPR, and an AI product placed on the EU market falls under the EU AI Act.

This category groups the laws that most often reach across borders: EU rules (GDPR, AI Act, NIS2, DORA, Cyber Resilience Act, Data Act), US federal and state rules (HIPAA, CCPA/CPRA, SOX, FISMA, FedRAMP) and others such as the UK GDPR, Brazil's LGPD and China's PIPL. Check each one's territorial scope before you assume it does or does not apply.

International IT Regulations standards and laws

DPDP Act

Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (India)

Law Mandatory by law India, extraterritorial

India's Digital Personal Data Protection Act, 2023 governs the processing of digital personal data. Data fiduciaries must give clear notice, obtain free, specific and informed consent (or rely on a listed legitimate use), protect data with reasonable security safeguards, report breaches to the Data Protection Board and affected people, honour rights to access, correction, erasure and grievance redress, and delete data when no longer needed. The DPDP Rules 2025 phase most duties in from 13 May 2027. Penalties reach INR 250 crore.

Covers, who needs it and key requirements
What it covers
Digital personal data (and non-digital data later digitised): notice and consent, legitimate uses, consent managers, data fiduciary duties, processors, security safeguards, breach notification, children's and disabled persons' data, data principal rights, Significant Data Fiduciaries, cross-border transfers and the Data Protection Board.
Who needs it
Every Indian IT company, SaaS provider, app and IT service provider that processes personal data, and foreign companies offering goods or services to people in India. IT service providers acting for clients are data processors bound by contract.
Why it matters
It replaces the limited SPDI Rules with a full privacy regime, has penalties up to INR 250 crore per breach, and Indian and foreign clients will expect DPDP-ready processors.
Applies in
India; applies extraterritorially to processing connected with offering goods or services to data principals in India
Key requirements
  • Itemised notice in clear language before or at the time of seeking consent (Section 5, Rule 3)
  • Consent that is free, specific, informed, unconditional and unambiguous, with easy withdrawal (Section 6)
  • Reasonable security safeguards: encryption or masking, access control, logs kept at least one year, backups (Section 8(5), Rule 6)
  • Breach intimation to each affected person and to the Board without delay, with a detailed report within 72 hours (Section 8(6), Rule 7)
  • Verifiable parental consent for children's data; no tracking or targeted advertising to children (Section 9, Rule 10)
  • Rights to access, correction, erasure, grievance redressal and nomination, and processor contracts (Sections 8(2), 11 to 14)

GDPR

General Data Protection Regulation, Regulation (EU) 2016/679

Law Mandatory by law EU / EEA, extraterritorial

The GDPR is the EU's data protection law. It applies to any organisation that processes personal data in the context of an EU establishment, and to non-EU companies that offer goods or services to people in the EU or monitor their behaviour. It requires a lawful basis for processing, transparency, data minimisation, security, records of processing, data subject rights and breach notification within 72 hours. Fines reach EUR 20 million or 4% of global turnover.

Covers, who needs it and key requirements
What it covers
Personal data of people in the EU: principles, lawful bases, consent, transparency, data subject rights, controller and processor duties, data protection by design, DPIAs, DPOs, security, breach notification, international transfers and enforcement.
Who needs it
EU companies and any IT, SaaS or outsourcing company worldwide with EU users, customers or clients, including processors acting for EU clients.
Why it matters
It is the global benchmark for privacy law, carries some of the highest fines, and EU clients will not sign without a GDPR-compliant data processing agreement.
Applies in
European Union and EEA; applies extraterritorially to non-EU companies targeting or monitoring people in the EU
Key requirements
  • Lawful basis for every processing purpose (Article 6) and conditions for special category data (Article 9)
  • Transparent privacy notices (Articles 13 and 14)
  • Data subject rights: access, rectification, erasure, portability, objection (Articles 15 to 22)
  • Records of processing, DPIAs and, where required, a DPO (Articles 30, 35, 37)
  • Security of processing and breach notification within 72 hours (Articles 32 to 34)
  • Processor contracts and safeguards for transfers outside the EEA (Articles 28, 44 to 49)

EU AI Act

Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI (2026)

Law Mandatory if in scope EU, extraterritorial

The EU AI Act is the world's first comprehensive AI law. It sorts AI into risk tiers: prohibited practices (banned since February 2025), high-risk systems (strict requirements, now applying from 2 December 2027 and 2 August 2028 after the 2026 Digital Omnibus), limited-risk systems with transparency duties (from August 2026), and minimal risk. General-purpose AI model providers have had obligations since August 2025. It applies to providers and deployers inside and outside the EU, with fines up to EUR 35 million or 7% of turnover.

Covers, who needs it and key requirements
What it covers
AI systems and general-purpose AI models placed on the EU market or used in the EU: prohibited practices, high-risk classification, risk management, data governance, documentation, logging, transparency, human oversight, accuracy and cybersecurity, conformity assessment, post-market monitoring, GPAI duties and penalties.
Who needs it
AI product and SaaS companies selling to EU customers, IT service providers building AI systems for EU clients, and companies deploying AI in hiring, credit, education, healthcare or other high-risk uses.
Why it matters
It applies to non-EU companies, its fines exceed the GDPR's, and EU clients will require AI Act compliance in contracts.
Applies in
European Union; applies extraterritorially to non-EU providers placing AI on the EU market or whose AI output is used in the EU
Key requirements
  • Inventory AI systems and classify each by risk tier and your role (provider, deployer, importer, distributor)
  • Stop any prohibited practice (Article 5) and support AI literacy among staff (Article 4)
  • Transparency: tell people they are interacting with AI and mark synthetic content (Article 50)
  • High-risk systems: risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity (Articles 9 to 15)
  • High-risk providers: quality management system, conformity assessment, CE marking, EU database registration and post-market monitoring
  • GPAI model providers: technical documentation, copyright policy and training content summary; extra duties for systemic-risk models

HIPAA

Health Insurance Portability and Accountability Act of 1996 (Privacy, Security, Breach Notification and Enforcement Rules)

Law Mandatory if in scope United States

HIPAA is the US federal law that protects health information. Its Privacy Rule limits how protected health information (PHI) is used and disclosed, its Security Rule requires administrative, physical and technical safeguards for electronic PHI, and its Breach Notification Rule sets deadlines for telling patients and HHS. It applies to covered entities and to business associates such as software vendors, cloud hosts and IT support firms that handle PHI on their behalf.

Covers, who needs it and key requirements
What it covers
Protected health information held or transmitted by covered entities and business associates: permitted uses and disclosures, patient rights, security risk analysis, safeguards for ePHI, business associate agreements and breach notification.
Who needs it
Health tech and EHR vendors, telehealth apps, medical billing and transcription providers, cloud and managed service providers, and offshore IT teams that create, receive, maintain or transmit PHI for US healthcare clients.
Why it matters
US healthcare clients cannot share PHI without a signed business associate agreement, and OCR fines and corrective action plans apply directly to business associates.
Applies in
United States (federal)
Key requirements
  • Sign business associate agreements (BAAs) with covered entities and your own subcontractors
  • Perform and document an accurate and thorough security risk analysis
  • Administrative safeguards: security officer, workforce training, access management, contingency plan
  • Physical safeguards: facility access, workstation and device controls
  • Technical safeguards: access control, audit controls, integrity, authentication, transmission security
  • Breach notification without unreasonable delay and no later than 60 days after discovery

CCPA / CPRA

California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020

Law Mandatory if in scope California, US

The CCPA, as amended by the CPRA, gives California residents rights to know, delete, correct and opt out of the sale or sharing of their personal information, and to limit use of sensitive personal information. It applies to for-profit businesses that meet revenue or data-volume thresholds, wherever they are based. Service providers and contractors must sign specific contract terms. New 2026 regulations add risk assessments, cybersecurity audits and automated decision-making rules.

Covers, who needs it and key requirements
What it covers
Personal information of California residents, including employees and B2B contacts: notices at collection, privacy policy, consumer rights, opt-out of sale or sharing, sensitive data limits, service provider contracts, data security, risk assessments, cybersecurity audits and ADMT.
Who needs it
For-profit businesses that do business in California and meet a threshold, and the SaaS, IT and data vendors that act as their service providers or contractors.
Why it matters
It is the most detailed US privacy law, it is actively enforced by a dedicated agency, and US clients pass its service provider terms down to their vendors.
Applies in
California, USA; applies to businesses anywhere that meet the thresholds
Key requirements
  • Notice at collection and a privacy policy updated every 12 months
  • Honour requests to know, delete, correct and opt out within 45 days
  • Do Not Sell or Share link and recognition of opt-out preference signals (Global Privacy Control)
  • Limit use of sensitive personal information where required
  • Service provider and contractor contracts with the terms in section 1798.100(d)
  • Reasonable security; risk assessments and cybersecurity audits where the 2026 rules apply

FedRAMP

Federal Risk and Authorization Management Program

Government authorization Mandatory if in scope US federal

FedRAMP is the US government programme that standardises security assessment and authorization of cloud products used by federal agencies. Cloud service providers implement a NIST SP 800-53 baseline (Low, Moderate or High), are assessed by an accredited third-party assessment organisation (3PAO), and receive an authorization listed on the FedRAMP Marketplace, followed by continuous monitoring. FedRAMP 20x, launched in 2025, is replacing document-heavy Rev. 5 packages with automated, machine-readable evidence.

Covers, who needs it and key requirements
What it covers
Cloud service offerings (IaaS, PaaS, SaaS) used by federal agencies: security baselines, system security plan, 3PAO assessment, authorization, continuous monitoring, incident reporting and significant change management.
Who needs it
SaaS, PaaS and IaaS providers that sell, or want to sell, to US federal agencies, and their subcontractors handling federal data.
Why it matters
Agencies cannot use a cloud service without it, and a FedRAMP authorization is reused across agencies and trusted by state governments and regulated industries.
Applies in
United States (federal)
Key requirements
  • Choose an impact level (Low, Moderate, High) based on FIPS 199 categorisation
  • Implement the FedRAMP baseline controls from NIST SP 800-53 Rev. 5
  • Document the system security plan and boundary (or 20x key security indicators)
  • Independent assessment by an accredited 3PAO
  • Authorization by an agency or the FedRAMP Board
  • Continuous monitoring: monthly vulnerability scanning, POA&M updates and annual assessments

FISMA

Federal Information Security Modernization Act of 2014 (originally the Federal Information Security Management Act of 2002)

Law Mandatory if in scope US federal

FISMA is the US federal law that requires every federal agency to run an agency-wide information security programme, including for systems operated by contractors. Agencies categorise systems, apply NIST SP 800-53 controls under the Risk Management Framework, authorize systems to operate, continuously monitor them and report annually to OMB and Congress. IT companies meet FISMA through contract clauses when they build, host or operate systems for federal agencies.

Covers, who needs it and key requirements
What it covers
Federal information and information systems, including those run by contractors: risk-based security programmes, system categorisation, security controls, authorization, continuous monitoring, incident reporting to CISA and annual reporting.
Who needs it
US federal agencies and the IT contractors, integrators and cloud providers that operate systems or process information on their behalf.
Why it matters
Federal contracts flow FISMA duties down to vendors; without an ATO a system cannot go live.
Applies in
United States (federal)
Key requirements
  • Inventory information systems and categorise them (FIPS 199)
  • Select and implement NIST SP 800-53 controls (FIPS 200 minimum requirements)
  • Write a system security plan and assess controls
  • Obtain an Authorization to Operate from the authorizing official
  • Continuously monitor and report incidents to CISA
  • Annual independent evaluation and FISMA reporting to OMB

SOX

Sarbanes-Oxley Act of 2002 (IT general controls under Sections 302 and 404)

Law Mandatory if in scope US-listed companies

The Sarbanes-Oxley Act requires US-listed companies to certify their financial reports and maintain effective internal control over financial reporting (ICFR). Section 302 makes the CEO and CFO certify each report, and Section 404 requires an annual management assessment of ICFR, with auditor attestation for larger filers. For IT, this means tested IT general controls (ITGCs) over access, change management and operations for every system that affects the financial statements.

Covers, who needs it and key requirements
What it covers
Internal control over financial reporting, including IT general controls over financial systems (ERP, billing, payroll, data warehouses), application controls, access, change management, computer operations and outsourced service providers.
Who needs it
SEC-registered public companies and companies preparing for a US IPO, plus the SaaS, ERP, payroll and managed IT providers whose systems support their financial reporting.
Why it matters
IT control failures can become material weaknesses that must be disclosed to investors, and listed clients will ask vendors for SOC 1 reports and evidence.
Applies in
United States; applies to SEC-registered companies worldwide
Key requirements
  • Scope financially significant applications and supporting infrastructure
  • Logical access controls: provisioning, periodic reviews, privileged access, segregation of duties
  • Change management: approval, testing and segregation for changes to in-scope systems
  • Computer operations: job scheduling, backups, incident management
  • Obtain and review SOC 1 reports for outsourced services, including complementary user entity controls
  • Document, test and remediate controls each year for management's assessment and the auditor

NIS2 Directive

Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2)

Law Mandatory if in scope EU

NIS2 is the EU's cybersecurity law for essential and important entities in 18 sectors, including digital infrastructure, cloud and data centre providers, managed service and managed security service providers, and many manufacturers. Member states had to transpose it by 17 October 2024. In-scope entities must take risk management measures, report significant incidents (early warning within 24 hours, notification within 72 hours, final report within a month) and hold management accountable. Fines reach EUR 10 million or 2% of turnover.

Covers, who needs it and key requirements
What it covers
Cybersecurity risk management measures, supply chain security, incident reporting, management body accountability, registration and supervision for essential and important entities.
Who needs it
Medium and large entities in listed sectors operating in the EU, including cloud, data centre, DNS, managed service and managed security service providers.
Why it matters
Managed service providers are directly in scope, and in-scope clients pass NIS2 security requirements to their IT suppliers.
Applies in
European Union, through national transposition laws
Key requirements
  • Determine whether you are an essential or important entity in each member state
  • Implement the risk management measures in Article 21, including supply chain security
  • Report significant incidents within 24 hours, 72 hours and one month
  • Train management bodies and make them approve and oversee measures
  • Register with national authorities where required

DORA

Digital Operational Resilience Act, Regulation (EU) 2022/2554

Law Mandatory if in scope EU

DORA is the EU regulation on digital operational resilience for the financial sector, applying since 17 January 2025 to banks, insurers, investment firms, payment and crypto-asset providers and others. It requires an ICT risk management framework, classification and reporting of major ICT incidents, resilience testing including threat-led penetration testing for some firms, and strict management of ICT third-party risk with mandatory contract terms. Critical ICT third-party providers are directly overseen by EU supervisors.

Covers, who needs it and key requirements
What it covers
ICT risk management, ICT incident management and reporting, digital operational resilience testing, ICT third-party risk and contracts, information sharing and oversight of critical ICT providers.
Who needs it
EU financial entities, and the IT, cloud and software providers that serve them through contracts (critical providers are overseen directly).
Why it matters
Financial clients must put DORA contract terms, audit rights and exit plans into every ICT service agreement, so their vendors must comply in practice.
Applies in
European Union
Key requirements
  • ICT risk management framework approved by the management body
  • Classify and report major ICT-related incidents
  • Regular resilience testing, with TLPT for significant entities
  • Register of information on ICT third-party arrangements
  • Contracts with the mandatory provisions of Article 30, including exit strategies

Cyber Resilience Act

Cyber Resilience Act, Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements

Law Mandatory if in scope EU

The Cyber Resilience Act sets cybersecurity requirements for hardware and software products with digital elements sold in the EU. Manufacturers must design products securely, handle vulnerabilities for the support period, provide security updates and an SBOM, and carry out conformity assessment and CE marking. Reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026; the main requirements apply from 11 December 2027. Fines reach EUR 15 million or 2.5% of turnover.

Covers, who needs it and key requirements
What it covers
Security by design, vulnerability handling, security updates, SBOMs, technical documentation, conformity assessment, CE marking and reporting of exploited vulnerabilities and incidents for products with digital elements.
Who needs it
Manufacturers, importers and distributors of software and connected products placed on the EU market, including software companies selling licensed products. Pure SaaS is mostly covered by NIS2 instead.
Why it matters
It makes secure development and vulnerability handling a legal condition for selling software and connected products in the EU.
Applies in
European Union; applies to products placed on the EU market from anywhere
Key requirements
  • Meet the essential cybersecurity requirements in Annex I
  • Vulnerability handling for the support period, with an SBOM
  • Report actively exploited vulnerabilities and severe incidents (early warning within 24 hours)
  • Conformity assessment and CE marking before placing on the market
  • Technical documentation and user security information

EU Data Act

Data Act, Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data

Law Mandatory if in scope EU

The EU Data Act, applying since 12 September 2025, gives users of connected products and related services rights to access and share the data they generate, limits unfair data-sharing terms in contracts, and makes cloud and other data processing service providers support customer switching and remove switching charges in stages (fully by 12 January 2027). It also sets safeguards against unlawful non-EU government access to non-personal data held in the EU.

Covers, who needs it and key requirements
What it covers
Access to IoT and related service data, B2B contract fairness, public sector access in emergencies, cloud switching and interoperability, and international data safeguards.
Who needs it
Makers of connected products and related services, and cloud, SaaS and data processing service providers with EU customers.
Why it matters
Cloud and SaaS providers must support switching and data export, which changes contracts and product design.
Applies in
European Union
Key requirements
  • Make product and service data accessible to users
  • Support customer switching and data portability for data processing services
  • Phase out switching and egress charges by 12 January 2027
  • Avoid unfair data-sharing terms in B2B contracts
  • Protect non-personal data from unlawful third-country access

UK GDPR

UK General Data Protection Regulation and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025

Law Mandatory by law United Kingdom

The UK GDPR and the Data Protection Act 2018 form the UK's data protection law after Brexit. They closely follow the EU GDPR but are enforced by the Information Commissioner's Office. The Data (Use and Access) Act 2025 amends them in stages, for example on recognised legitimate interests, automated decision-making, cookies and complaints. Companies outside the UK that offer services to people in the UK or monitor them must comply, and fines reach GBP 17.5 million or 4% of turnover.

Covers, who needs it and key requirements
What it covers
Personal data of people in the UK: principles, lawful bases, rights, controller and processor duties, international transfers (UK IDTA and addendum), breach reporting and PECR rules on cookies and marketing.
Who needs it
UK companies and non-UK companies with UK users or clients, including processors serving UK clients.
Why it matters
UK clients require UK GDPR terms and transfer safeguards, and the ICO enforces it independently of the EU.
Applies in
United Kingdom; extraterritorial for organisations targeting or monitoring people in the UK
Key requirements
  • Lawful basis and transparency for processing
  • Data subject rights within one month
  • Breach reporting to the ICO within 72 hours where required
  • UK transfer mechanisms (IDTA or Addendum) for restricted transfers
  • A UK representative if you have no UK establishment but are in scope

Cyber Essentials

Cyber Essentials and Cyber Essentials Plus (UK government-backed certification scheme)

Certifiable standard Mandatory if in scope United Kingdom

Cyber Essentials is a UK government-backed certification, run by the National Cyber Security Centre with IASME as delivery partner, that proves five basic technical controls: firewalls, secure configuration, user access control, malware protection and security update management. The basic level is a verified self-assessment; Cyber Essentials Plus adds hands-on technical testing. It is required for many UK central government contracts that involve personal data or certain ICT services.

Covers, who needs it and key requirements
What it covers
Five technical controls applied to internet-connected devices, servers, cloud services and users in scope.
Who needs it
Suppliers to UK government and many UK businesses, including IT and software companies with UK public sector clients.
Why it matters
It is a low-cost entry to UK public sector work and blocks most common internet-based attacks.
Applies in
United Kingdom
Key requirements
  • Boundary firewalls and internet gateways
  • Secure configuration of devices and software
  • User access control, including MFA for cloud services
  • Malware protection
  • Security update management within 14 days for high and critical fixes

CMMC 2.0

Cybersecurity Maturity Model Certification 2.0 (US Department of Defense / Department of War)

Certifiable standard Mandatory if in scope US defence

CMMC is the US defence department's programme for verifying that contractors protect Federal Contract Information and Controlled Unclassified Information. Level 1 covers 15 basic safeguards, Level 2 the 110 requirements of NIST SP 800-171, and Level 3 adds selected SP 800-172 requirements. Phase 1 (self-assessments) began on 10 November 2025. In July 2026 the department paused Phase 2, which would have made third-party Level 2 assessments mandatory from 10 November 2026, pending a review.

Covers, who needs it and key requirements
What it covers
Protection of Federal Contract Information and Controlled Unclassified Information in contractor systems, with self, third-party (C3PAO) or government assessments by level.
Who needs it
US defence contractors and subcontractors at every tier, including software and IT service suppliers handling FCI or CUI.
Why it matters
Defence contracts can require a CMMC status as a condition of award; the rules remain in place even while Phase 2 is paused.
Applies in
United States (defence contracts)
Key requirements
  • Identify FCI and CUI and the systems that handle them
  • Implement FAR 52.204-21 (Level 1) or NIST SP 800-171 (Level 2) requirements
  • Complete the required self or third-party assessment and affirm in SPRS
  • Maintain a System Security Plan and POA&M
  • Keep watching the Phase 2 status for contract requirements

WCAG 2.2

Web Content Accessibility Guidelines (WCAG) 2.2

Framework Mandatory if in scope Global

WCAG 2.2 is the W3C standard for making web content and apps accessible to people with disabilities, published as a W3C Recommendation in October 2023. Its success criteria are grouped under four principles (perceivable, operable, understandable, robust) at levels A, AA and AAA. Level AA is the benchmark referenced by laws and procurement rules such as the European Accessibility Act (through EN 301 549), US Section 508 and ADA settlements, and Indian government guidelines.

Covers, who needs it and key requirements
What it covers
Text alternatives, captions, adaptable and distinguishable content, keyboard access, timing, navigation, input modalities, readable and predictable interfaces, and compatibility with assistive technologies.
Who needs it
Software and web development companies, SaaS and e-commerce businesses, and anyone selling digital products to public bodies or consumers in regulated markets.
Why it matters
Accessibility is now a legal requirement for many digital products and a common tender requirement.
Applies in
Worldwide; legally referenced in the EU, US, UK, India and elsewhere
Key requirements
  • Meet WCAG 2.2 Level AA success criteria
  • Test with automated tools and manual keyboard and screen reader checks
  • Publish an accessibility statement
  • Fix issues found and test new releases

European Accessibility Act

European Accessibility Act, Directive (EU) 2019/882 on the accessibility requirements for products and services

Law Mandatory if in scope EU

The European Accessibility Act requires listed products and services sold in the EU to be accessible to people with disabilities, applying since 28 June 2025. It covers e-commerce, consumer banking, e-books, electronic communications, transport ticketing, computers, smartphones, self-service terminals and their software. In practice websites and apps are expected to meet EN 301 549, which incorporates WCAG Level AA. Micro-enterprises providing services are exempt.

Covers, who needs it and key requirements
What it covers
Accessibility requirements for listed products and services, including websites and mobile apps for e-commerce and banking, plus documentation and conformity duties.
Who needs it
Businesses selling covered products or services to EU consumers, and the agencies and software firms that build their websites and apps.
Why it matters
EU clients now need accessible websites and apps by law, so development contracts include accessibility requirements.
Applies in
European Union, through national laws
Key requirements
  • Check whether your product or service is in scope
  • Meet the accessibility requirements, usually via EN 301 549 / WCAG AA
  • Provide accessibility information about the service
  • Monitor and fix accessibility issues

LGPD

Lei Geral de Proteção de Dados Pessoais (Brazil's General Data Protection Law), Law No. 13,709/2018

Law Mandatory by law Brazil

The LGPD is Brazil's comprehensive data protection law, in force since September 2020 with sanctions enforceable since August 2021 by the national authority ANPD. Modelled on the GDPR, it requires a legal basis for processing, transparency, data subject rights, security, a data protection officer (encarregado) and incident reporting. It applies to processing in Brazil and to companies abroad offering goods or services to people in Brazil. Fines reach 2% of Brazilian revenue, capped at BRL 50 million per infraction.

Covers, who needs it and key requirements
What it covers
Personal data processing in Brazil or of people in Brazil: legal bases, rights, controllers and processors, DPO, security, incident reporting and international transfers.
Who needs it
Companies with users or clients in Brazil, including foreign SaaS and IT providers.
Why it matters
Brazil is a large digital market and ANPD actively enforces the law.
Applies in
Brazil; extraterritorial for processing of data collected in Brazil or offering goods or services there
Key requirements
  • Legal basis for each processing activity
  • Appoint an encarregado (DPO)
  • Honour data subject rights
  • Report security incidents to ANPD and data subjects
  • Safeguards for international transfers

PIPL

Personal Information Protection Law of the People's Republic of China

Law Mandatory by law China

China's Personal Information Protection Law, in force since 1 November 2021, regulates personal information processing in China and processing abroad that targets people in China. It requires a legal basis (often separate consent), notices, impact assessments for sensitive data and transfers, local representatives for foreign processors, and strict cross-border transfer mechanisms such as CAC security assessments, standard contracts or certification. Fines reach CNY 50 million or 5% of the previous year's turnover.

Covers, who needs it and key requirements
What it covers
Personal information processing, sensitive information, cross-border transfers, individual rights, processor duties, and obligations for large platforms.
Who needs it
Companies processing personal information of people in China, including foreign SaaS and IT providers serving Chinese users.
Why it matters
Cross-border transfer rules can block data flows without the right mechanism.
Applies in
China; extraterritorial for processing of personal information of people in China
Key requirements
  • Legal basis and separate consent where required
  • Personal information protection impact assessments
  • Cross-border transfer mechanism (CAC assessment, standard contract or certification)
  • Local representative for foreign processors
  • Honour individual rights

PIPEDA

Personal Information Protection and Electronic Documents Act (Canada)

Law Mandatory by law Canada

PIPEDA is Canada's federal private-sector privacy law. It applies to organisations that collect, use or disclose personal information in commercial activities, built around ten fair information principles including accountability, consent, limiting use and safeguards. Breaches that create a real risk of significant harm must be reported to the Privacy Commissioner and affected individuals. Quebec's Law 25, Alberta and British Columbia have their own laws for local private-sector activity.

Covers, who needs it and key requirements
What it covers
Ten fair information principles, consent, access and correction, safeguards, breach reporting and record keeping.
Who needs it
Organisations handling personal information of Canadians in commercial activity, including foreign SaaS and IT providers.
Why it matters
Canadian clients expect PIPEDA-compliant processing and breach reporting.
Applies in
Canada (private sector, federal; provinces such as Quebec have their own laws)
Key requirements
  • Designate a person accountable for privacy
  • Obtain meaningful consent
  • Safeguard personal information
  • Report breaches with real risk of significant harm
  • Keep breach records for 24 months

Singapore PDPA

Personal Data Protection Act 2012 (Singapore)

Law Mandatory by law Singapore

Singapore's Personal Data Protection Act governs collection, use and disclosure of personal data by organisations, enforced by the Personal Data Protection Commission. Amendments in force since 2021 added mandatory breach notification (to the PDPC within three calendar days of assessing a notifiable breach), new consent exceptions and higher fines of up to 10% of Singapore turnover for organisations with turnover above SGD 10 million, or SGD 1 million otherwise.

Covers, who needs it and key requirements
What it covers
Consent, purpose limitation, notification, access and correction, accuracy, protection, retention, transfer limitation, breach notification, data portability and the Do Not Call registry.
Who needs it
Organisations collecting or processing personal data in Singapore, including foreign IT and SaaS vendors serving Singapore clients.
Why it matters
Singapore is a regional hub and PDPC publishes enforcement decisions regularly.
Applies in
Singapore
Key requirements
  • Appoint a data protection officer
  • Consent and purpose limitation
  • Reasonable security arrangements
  • Notify notifiable breaches within 3 days
  • Transfer limitation obligations

Australian Privacy Act

Privacy Act 1988 (Cth), including the Australian Privacy Principles and the Notifiable Data Breaches scheme

Law Mandatory if in scope Australia

Australia's Privacy Act 1988 and its 13 Australian Privacy Principles govern how government agencies and organisations with annual turnover above AUD 3 million (and some smaller ones) handle personal information. The Notifiable Data Breaches scheme requires notifying the OAIC and affected individuals of eligible breaches. 2022 and 2024 amendments raised maximum penalties to the greater of AUD 50 million, three times the benefit obtained or 30% of adjusted turnover, and added a statutory privacy tort.

Covers, who needs it and key requirements
What it covers
Australian Privacy Principles, cross-border disclosure, notifiable data breaches, OAIC enforcement powers and the statutory tort for serious invasions of privacy.
Who needs it
Organisations with an Australian link that meet the turnover test or are otherwise covered, including foreign IT and SaaS providers.
Why it matters
Penalties are among the highest worldwide and Australian clients expect APP compliance from vendors.
Applies in
Australia; applies to organisations with an Australian link
Key requirements
  • Open and transparent privacy policy
  • Collection, use and disclosure according to the APPs
  • Reasonable steps to secure personal information
  • Assess and notify eligible data breaches
  • Accountability for overseas disclosures

Essential Eight

Australian Cyber Security Centre Essential Eight Maturity Model

Framework Mandatory if in scope Australia

The Essential Eight is the Australian Cyber Security Centre's prioritised set of eight mitigation strategies: application control, patching applications, configuring Microsoft Office macros, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. Each is assessed at maturity levels one to three. Australian government entities must implement it, and it is widely requested from suppliers.

Covers, who needs it and key requirements
What it covers
Eight mitigation strategies and a maturity model from Level 1 to Level 3.
Who needs it
Australian government entities and their IT suppliers, and organisations wanting a practical baseline.
Why it matters
It is short, measurable and focused on stopping common attacks.
Applies in
Australia (mandatory for many federal agencies; voluntary elsewhere)
Key requirements
  • Application control and macro restrictions
  • Patch applications and operating systems promptly
  • User application hardening
  • Restrict admin privileges and use MFA
  • Regular, tested backups

NYDFS Part 500

New York Department of Financial Services Cybersecurity Regulation, 23 NYCRR Part 500

Regulation Mandatory if in scope New York, US

Part 500 requires banks, insurers and other financial services companies licensed by the New York DFS to run a risk-based cybersecurity programme. The second amendment (November 2023) phased in duties through November 2025, including CISO reporting to the board, MFA for all remote and privileged access, asset inventories, stricter controls for larger Class A companies, notification of cybersecurity events within 72 hours and of extortion payments within 24 hours, and annual certification by 15 April.

Covers, who needs it and key requirements
What it covers
Cybersecurity programme and policies, governance, risk assessment, access privileges, MFA, encryption, vendor management, incident response, notification and annual certification.
Who needs it
DFS-regulated financial institutions and the IT and SaaS vendors that serve them (through third-party service provider policies).
Why it matters
DFS enforces actively, and covered entities must assess and contractually bind their technology vendors.
Applies in
New York State, USA (DFS-licensed entities)
Key requirements
  • Risk-based cybersecurity programme and CISO
  • MFA for remote and privileged access
  • Third-party service provider security policy
  • Notify DFS within 72 hours of a cybersecurity event
  • Annual certification or acknowledgement of non-compliance by 15 April

GLBA Safeguards Rule

Gramm-Leach-Bliley Act and the FTC Standards for Safeguarding Customer Information (Safeguards Rule, 16 CFR Part 314)

Law Mandatory if in scope United States

The Gramm-Leach-Bliley Act requires US financial institutions to protect customers' nonpublic personal information. For non-bank financial institutions such as lenders, fintechs, tax preparers and many others, the FTC's amended Safeguards Rule requires a written information security programme with a qualified individual, risk assessment, encryption, MFA, service provider oversight and, since May 2024, notification to the FTC of security events affecting 500 or more consumers within 30 days.

Covers, who needs it and key requirements
What it covers
Privacy notices and the Safeguards Rule: written information security programme, risk assessment, access controls, encryption, MFA, monitoring, training, vendor oversight, incident response and FTC notification.
Who needs it
US financial institutions in the broad GLBA sense, including fintechs and non-bank lenders, and their IT and SaaS service providers.
Why it matters
The FTC enforces the Safeguards Rule against non-bank financial companies, and requires them to oversee their service providers.
Applies in
United States (federal)
Key requirements
  • Designate a qualified individual and write an information security programme
  • Risk assessment and safeguards including encryption and MFA
  • Oversee service providers by contract and monitoring
  • Incident response plan
  • Notify the FTC within 30 days of events affecting 500+ consumers

COPPA

Children's Online Privacy Protection Act and the FTC COPPA Rule (16 CFR Part 312)

Law Mandatory if in scope United States

COPPA requires operators of websites, apps and online services directed to children under 13, or that knowingly collect children's personal information, to give notice and obtain verifiable parental consent before collecting it. The FTC's amended COPPA Rule, published in April 2025 with compliance required by 22 April 2026, adds separate consent for third-party disclosure such as targeted advertising, a written information security programme and data retention limits.

Covers, who needs it and key requirements
What it covers
Notice, verifiable parental consent, parental rights, data minimisation, retention, security and third-party disclosures for children's personal information.
Who needs it
Apps, games, edtech and websites directed to US children, and the developers and SaaS providers building them.
Why it matters
The FTC imposes large penalties and requires deletion of unlawfully collected data and models.
Applies in
United States (federal); applies to foreign services directed to US children
Key requirements
  • Determine whether the service is child-directed or has actual knowledge
  • Post a COPPA-compliant privacy notice
  • Obtain verifiable parental consent, with separate consent for third-party disclosures
  • Written information security programme and retention policy
  • Honour parental review and deletion requests

SEC Cybersecurity Disclosure Rules

US SEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rules (2023)

Regulation Mandatory if in scope US-listed companies

Since December 2023, US-listed companies must disclose material cybersecurity incidents on Form 8-K Item 1.05 within four business days of determining materiality, and describe their cybersecurity risk management, strategy and governance annually under Regulation S-K Item 106. Foreign private issuers make equivalent disclosures on Forms 6-K and 20-F. IT vendors are affected because incidents at third parties can trigger client disclosures.

Covers, who needs it and key requirements
What it covers
Material incident disclosure, annual description of risk management processes, board oversight and management's role in cybersecurity.
Who needs it
SEC registrants and companies preparing to list, and their critical IT and SaaS vendors.
Why it matters
Listed clients need fast, accurate incident information from vendors to meet the four-day clock.
Applies in
United States (SEC registrants, including foreign private issuers via Forms 6-K and 20-F)
Key requirements
  • Process to assess materiality of incidents without unreasonable delay
  • File Form 8-K Item 1.05 within four business days of a materiality determination
  • Annual Item 106 disclosure of risk management, strategy and governance
  • Third-party risk processes that surface vendor incidents quickly

TISAX

Trusted Information Security Assessment Exchange (automotive industry), based on the VDA Information Security Assessment (ISA)

Certifiable standard Contractually required Global (automotive)

TISAX is the automotive industry's assessment and exchange mechanism for information security, run by the ENX Association on behalf of the German automotive association VDA. Suppliers are assessed by accredited audit providers against the VDA ISA catalogue, which is based on ISO 27001 with automotive extensions for prototype protection and data protection, and receive labels they share with OEMs through the ENX portal. Car makers commonly require it from IT and engineering suppliers.

Covers, who needs it and key requirements
What it covers
Information security, prototype protection and data protection controls from the VDA ISA catalogue at assessment levels 1 to 3.
Who needs it
IT, software and engineering suppliers to automotive OEMs and Tier 1 suppliers.
Why it matters
Automotive customers often make a TISAX label a contract condition.
Applies in
Worldwide, mainly suppliers to European (especially German) automotive companies
Key requirements
  • Register with ENX and select assessment objectives
  • Self-assess against the VDA ISA catalogue
  • Assessment by an accredited TISAX audit provider
  • Share labels with partners via the ENX portal and renew every three years

Need help with international it regulations compliance?

Get a gap assessment from vetted compliance and cybersecurity firms, or ask us a question.

Get an assessment Find a company

List your IT company for free

Create a profile in minutes, get reviewed by our editors and start receiving enquiries from clients looking for your skills.

Get listed free