Law / regulation
EU AI Act
The European Union's binding, risk-based law for AI systems and general-purpose AI models, with obligations that vary by risk level and by role.
Hub
AI Governance & Privacy
AI and personal data now sit under binding law in many jurisdictions. Voluntary standards provide the machinery to comply. These guides keep the two distinct.
How the pieces fit
Three layers of AI and privacy requirements
- 1
Binding law
Sets outcomes you must achieve, enforced by regulators. Examples: the EU AI Act, GDPR, India's DPDP Act.
- 2
Certifiable management standards
Provide auditable governance machinery. Examples: ISO/IEC 42001 for AI, ISO/IEC 27701 for privacy.
- 3
Voluntary frameworks
Deepen method and vocabulary. Example: the NIST AI Risk Management Framework and its Generative AI Profile.
AI governance & AI security
AI governance frameworks
Certifiable standard
ISO/IEC 42001
The first certifiable international standard for an AI management system (AIMS): how an organisation governs the AI systems it develops, provides or uses.
Voluntary framework
NIST AI RMF
NIST's voluntary framework for managing the risks of AI systems, organised around four functions: Govern, Map, Measure and Manage.
Privacy & data protection
Privacy laws and standards
Law / regulation
DPDP Act (India)
India's data protection law for digital personal data, made operational by the DPDP Rules, 2025, which come into force in phases until May 2027.
Law / regulation
GDPR
The EU's comprehensive data protection law, setting principles, lawful bases, individual rights and accountability duties for anyone processing personal data in its scope.
Certifiable standard
ISO/IEC 27701
The international standard for a privacy information management system (PIMS). Since its 2025 edition it can be implemented and certified on its own, without ISO/IEC 27001.
Law / regulation Profile
APPI
Japan's data protection law, administered by the Personal Information Protection Commission, with mandatory breach reporting and cross-border transfer rules.
Law / regulation Profile
CCPA / CPRA
California's consumer privacy law, giving residents rights over their personal information and imposing duties on businesses that meet its thresholds.
Law / regulation Profile
Kenya Data Protection Act
Kenya's comprehensive data protection law, enforced by the Office of the Data Protection Commissioner, with registration and 72-hour breach notification.
Law / regulation Profile
LGPD
Brazil's general data protection law, closely modelled on the GDPR and enforced by the national data protection authority, the ANPD.
Law / regulation Profile
NDPA
Nigeria's data protection law, which established the Nigeria Data Protection Commission and set duties for data controllers and processors.
Law / regulation Profile
PDPA (Singapore)
Singapore's main personal data protection law, administered by the Personal Data Protection Commission, including mandatory breach notification.
Law / regulation Profile
PIPA (South Korea)
South Korea's comprehensive data protection law, overseen by the Personal Information Protection Commission and substantially amended in 2023.
Law / regulation Profile
PIPEDA
Canada's federal private-sector privacy law, built on ten fair information principles and overseen by the Office of the Privacy Commissioner of Canada.
Law / regulation Profile
PIPL
China's comprehensive personal information law, in force since November 2021, with strict rules on consent, sensitive information and cross-border transfers.
Law / regulation Profile
POPIA
South Africa's data protection law, built on eight conditions for lawful processing and enforced by the Information Regulator.
Law / regulation Profile
Privacy Act 1988 (Australia)
Australia's federal privacy law, built on 13 Australian Privacy Principles and the Notifiable Data Breaches scheme, administered by the OAIC.
Law / regulation Profile
Privacy Act 2020 (New Zealand)
New Zealand's privacy law, built on information privacy principles, with mandatory notification of serious privacy breaches, overseen by the Privacy Commissioner.
Law / regulation Profile
Saudi PDPL
Saudi Arabia's comprehensive personal data protection law, supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA).
Law / regulation Profile
UAE PDPL
The UAE's federal personal data protection law, with separate regimes in financial free zones such as DIFC and ADGM.
Law / regulation Profile
UK GDPR
The United Kingdom's data protection framework: the retained GDPR plus the Data Protection Act 2018, enforced by the Information Commissioner's Office.
Reading
Explainers and latest developments
AI governance
Standards, Frameworks and Laws: Reading AI Governance Requirements Correctly
ISO/IEC 42001, the NIST AI RMF and the EU AI Act are often mentioned together. One is a certifiable standard, one a voluntary framework, one binding law — and that changes everything.
Practical guide
Breach Notification Clocks Compared: GDPR, India's DPDP Rules and HIPAA
72 hours, 'without delay', 60 days: how breach notification deadlines, thresholds and recipients differ under GDPR, the DPDP Rules 2025 and HIPAA — and how SOC teams should prepare.
Briefing · 13 November 2026
DPDP Rules: Consent Manager Provisions Commence in November 2026
One year after India notified the DPDP Rules 2025, Rule 4 on Consent Managers comes into force. Core Data Fiduciary obligations follow eighteen months after publication, in May 2027.
Briefing · 13 October 2026
EDPB Publishes a Statement on the Data Protection Risks of Smart Glasses
The EDPB set out preliminary, non-binding views on smart glasses: wearers, makers and app providers can all be GDPR controllers, and bystanders need clear warning when recording is possible.
Briefing · 24 July 2026
EU Adopts the Digital Omnibus on AI: High-Risk Deadlines Move to 2027 and 2028
Regulation (EU) 2026/1744 amends the AI Act: Annex III high-risk obligations now apply from 2 December 2027 and Annex I from 2 August 2028, with changes to AI literacy and new prohibitions.