The GDPR is the EU's landmark data-protection regulation that governs how personal data of EU residents is collected, processed, stored, and transferred. It applies to any organisation worldwide that targets or monitors EU residents, and enforces principles of data minimisation, purpose limitation, and storage limitation. Violations can carry fines of up to €20 million or 4% of global annual turnover, whichever is higher.

HIPAA establishes national standards to protect sensitive patient health information. The Privacy Rule restricts the use and disclosure of PHI; the Security Rule mandates administrative, physical, and technical safeguards for electronic PHI (ePHI); and the Breach Notification Rule requires covered entities and business associates to notify affected individuals and HHS within 60 days of discovering a breach.

PCI DSS v4.0 is a global security standard that defines 12 requirements across six control objectives for any organisation that accepts, processes, stores, or transmits cardholder data. It mandates network security controls, strong cryptography, access controls, regular monitoring and testing, vulnerability management, and an information security policy.

SOC 2 is an auditing procedure that ensures SaaS and cloud service providers securely manage customer data based on the five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

ISO/IEC 27001:2022 is the international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). The 2022 revision reorganised Annex A from 114 controls across 14 domains into 93 controls across four themes: Organisational, People, Physical, and Technological.

The CCPA, as amended by the California Privacy Rights Act (CPRA, effective January 2023), grants California consumers rights over their personal information - including the right to know, correct, delete, and opt out of the sale or sharing of their data. The CPRA added obligations around sensitive personal information (SPI) and created the California Privacy Protection Agency (CPPA) as the dedicated enforcement authority.

The NIST CSF 2.0 provides a framework for organisations to manage and reduce cybersecurity risk. It is organised around six core functions: Govern, Identify, Protect, Detect, Respond, and Recover.

DORA is EU regulation (2022/2554) that requires financial entities to demonstrate ICT operational resilience. It mandates ICT risk management, incident classification and reporting, digital operational resilience testing, and oversight of third-party ICT providers.

The Philippine Data Privacy Act of 2012 governs the lawful processing of personal information and sensitive personal information, enforced by the National Privacy Commission (NPC).

BSP Circular No. 1122 sets expectations for cybersecurity and IT risk management for BSP-supervised financial institutions, including governance, incident management, testing, and third-party oversight.

The Australia Privacy Act 1988 and its Australian Privacy Principles (APPs) regulate how organizations collect, use, disclose, and secure personal information.

APRA CPS 234 requires APRA-regulated entities to maintain robust information security capabilities, including control testing, incident notification, and third-party oversight.