GDPR / DSGVO
EU baseline regulation for personal data — data-subject rights and controller obligations.
Key rules
- Lawfulness, fairness and transparency
- Purpose limitation and data minimisation
- Storage limitation
Compliance
Frameworks and regulations that shape data, privacy, security and AI governance — purpose, key rules and official sources.
Learning and orientation only — not legal advice.
No matches for your search.
BDSG (German Federal Data Protection Act)
German companion act to the GDPR — opening clauses, employee data and national specifics.
Key rules
- Supplement, not a GDPR replacement
- Employee data
- National opening clauses
EU Data Act
EU regulation on data access, sharing and portability — mainly for IoT, cloud and B2B data, not a substitute for the GDPR.
Key rules
- Fair data access for users and businesses
- Switching and portability
- B2B data sharing on fair terms
International transfers (Schrems II / SCCs)
Rules for transferring personal data to third countries — adequacy, standard contractual clauses and supplementary measures.
Key rules
- No transfer without a mechanism
- Check the adequacy decision
- Standard contractual clauses in the right module
ISO/IEC 27001
International standard for an information security management system (ISMS) — risk, controls and continual improvement.
Key rules
- Determine context and scope
- Leadership and security policy
- Risk assessment and treatment
ISO/IEC 27701
Privacy extension to ISO/IEC 27001 — PIMS for personal data, privacy by design and demonstrable privacy controls.
Key rules
- Build PIMS on the ISMS
- Privacy roles and accountability
- Select and justify PII controls
SOC 2
AICPA attestation report on Trust Services Criteria (security, availability, confidentiality, processing integrity, privacy) — common for SaaS vendors.
Key rules
- Trust Services Criteria selection
- Distinguish Type I and Type II
- The system description is the scope
BSI C5
BSI Cloud Computing Compliance Criteria Catalogue — requirements and attestation baseline for cloud providers, especially relevant in German/public-sector contexts.
Key rules
- Criteria catalogue across domains
- Basic and additional criteria
- Examination under ISAE 3000
NIST Zero Trust (SP 800-207)
Architecture model: never trust by default, always verify — identity, device, session and context instead of network perimeter.
Key rules
- All data sources and services are resources
- Secure all communication
- Per-session access
EU AI Act
EU regulation for AI systems — risk-based duties from prohibited practices to high-risk and transparency obligations.
Key rules
- Risk-based approach
- AI literacy in the team
- Risk management system
NIST AI RMF
Voluntary AI risk management framework: Govern, Map, Measure, Manage — practical and internationally usable.
Key rules
- Govern — frame and accountability
- Map — understand context and purpose
- Measure — metrics and testing
ISO/IEC 42001
Management system standard for artificial intelligence (AIMS) — analogous to ISO 27001, but for AI governance.
Key rules
- AIMS with a clear scope
- AI policy and objectives
- Risk assessment and treatment
GoBD
Principles for proper keeping and retention of books, records and documents in electronic form — German tax/commercial context.
Key rules
- Traceability and verifiability
- Completeness, accuracy, timely recording, order
- Immutability
NIS2
EU directive on cybersecurity for essential and important entities — risk management, incident reporting, supply chain.
Key rules
- Risk management measures
- Supply chain security
- Reporting duties with deadlines
DORA
Digital Operational Resilience Act — EU rules for ICT risk in the financial sector (banks, insurers, critical ICT providers).
Key rules
- ICT risk management framework
- Incident management and reporting
- Resilience testing