The GDPR is the EU's landmark data-protection regulation that governs how personal data of EU residents is collected, processed, stored, and transferred. It applies to any organisation worldwide that targets or monitors EU residents, and enforces principles of data minimisation, purpose limitation, and storage limitation. Violations can carry fines of up to €20 million or 4% of global annual turnover, whichever is higher.

HIPAA establishes national standards to protect sensitive patient health information. The Privacy Rule restricts the use and disclosure of PHI; the Security Rule mandates administrative, physical, and technical safeguards for electronic PHI (ePHI); and the Breach Notification Rule requires covered entities and business associates to notify affected individuals and HHS within 60 days of discovering a breach.

PCI DSS v4.0 is a global security standard that defines 12 requirements across six control objectives for any organisation that accepts, processes, stores, or transmits cardholder data. It mandates network security controls, strong cryptography, access controls, regular monitoring and testing, vulnerability management, and an information security policy.

SOC 2 is an auditing procedure that ensures SaaS and cloud service providers securely manage customer data based on the five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

ISO/IEC 27001:2022 is the international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). The 2022 revision reorganised Annex A from 114 controls across 14 domains into 93 controls across four themes: Organisational, People, Physical, and Technological.

The CCPA, as amended by the California Privacy Rights Act (CPRA, effective January 2023), grants California consumers rights over their personal information - including the right to know, correct, delete, and opt out of the sale or sharing of their data. The CPRA added obligations around sensitive personal information (SPI) and created the California Privacy Protection Agency (CPPA) as the dedicated enforcement authority.

The NIST CSF 2.0 provides a framework for organisations to manage and reduce cybersecurity risk. It is organised around six core functions: Govern, Identify, Protect, Detect, Respond, and Recover.

DORA is EU regulation (2022/2554) that requires financial entities to demonstrate ICT operational resilience. It mandates ICT risk management, incident classification and reporting, digital operational resilience testing, and oversight of third-party ICT providers.

The Philippine Data Privacy Act of 2012 governs the lawful processing of personal information and sensitive personal information, enforced by the National Privacy Commission (NPC).

BSP Circular No. 1122 sets expectations for cybersecurity and IT risk management for BSP-supervised financial institutions, including governance, incident management, testing, and third-party oversight.

The Australia Privacy Act 1988 and its Australian Privacy Principles (APPs) regulate how organizations collect, use, disclose, and secure personal information.

APRA CPS 234 requires APRA-regulated entities to maintain robust information security capabilities, including control testing, incident notification, and third-party oversight.

Singapore's PDPA establishes rules for collecting, using, and disclosing personal data, including consent, notification, access/correction rights, and breach notification obligations.

Brazil's LGPD governs personal data processing and requires legal basis mapping, data subject rights support, accountability controls, and breach response governance.

PIPEDA is Canada's federal private-sector privacy law that governs how organizations collect, use, and disclose personal information in the course of commercial activities. It is based on ten fair information principles and requires meaningful consent, limited collection, safeguards, and accountable privacy management.

NIS2 expands the EU cybersecurity framework for essential and important entities. It requires risk management measures, incident reporting, supply-chain security, governance accountability, and business continuity controls, with stricter supervision and penalties than the original NIS Directive.

The SWIFT Customer Security Programme defines mandatory and advisory controls for institutions connected to the SWIFT network to reduce fraud and cyber risk in financial messaging. Organizations must implement baseline controls and attest annually through the KYC-SA process.

FedRAMP is a US government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. Cloud Service Providers (CSPs) must achieve a Provisional Authority to Operate (P-ATO) by demonstrating compliance with NIST SP 800-53 security controls validated by an accredited Third Party Assessment Organization (3PAO).

The Sarbanes-Oxley Act (SOX) mandates strict reforms to improve financial disclosures from public corporations and prevent accounting fraud. Section 404 requires management and external auditors to assess and report on the adequacy of internal controls over financial reporting (ICFR), including IT general controls (ITGCs) that support financial data integrity.

FISMA requires federal agencies and their contractors to develop, document, and implement an agency-wide information security program. It mandates risk-based security controls aligned with NIST standards, continuous monitoring of federal information systems, and annual reporting to OMB and Congress on the adequacy of security posture.

CMMC is the United States defense contracting program for verifying safeguards applied to Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The current model has three levels with self-assessment, third-party, or government assessment requirements based on the information handled and the contract. Implementation remains in Phase 1 while Phase 2 requirements are suspended for program review.

HITRUST CSF is a certifiable framework that harmonizes multiple regulations and standards (HIPAA, NIST, ISO, PCI DSS) into a single comprehensive security framework, primarily used in healthcare for managing risk and demonstrating compliance.

NIST SP 800-53 provides a comprehensive catalog of security and privacy controls for federal information systems, widely adopted as a baseline for organizations implementing robust security programs. Rev 5 integrates privacy controls and reorganizes controls into 20 families.

Regulation (EU) 2024/2847 establishes horizontal cybersecurity requirements for products with digital elements placed on the EU market. It covers secure product design, vulnerability handling, conformity assessment, documentation, and market-surveillance duties across the product lifecycle. Reporting obligations apply from 11 September 2026, while most provisions apply from 11 December 2027.

ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System. It gives organizations that develop, provide, or use AI systems a structured governance approach for managing AI risks, opportunities, accountability, transparency, and lifecycle controls.

23 NYCRR Part 500 requires financial services organizations regulated by the New York Department of Financial Services to maintain a risk-based cybersecurity program. The regulation was substantially amended in 2023, with phased requirements through 2025 for governance, technical controls, incident response, business continuity, and accountability.

Singapore's Cybersecurity Act creates the legal framework for protecting Critical Information Infrastructure, responding to serious cybersecurity threats and incidents, regulating licensable cybersecurity services, and overseeing additional regulated systems and entities. Key 2024 amendments came into force on 31 October 2025 and expanded coverage for cloud-era operating models, supply-chain incidents, and new classes of regulated entities.