| GDPR | Data protection law. Learn how to translate legal requirements into privacy controls. | Art. 5: privacy principles. Art. 6: lawful basis. Art. 7: consent. Art. 12–14: transparency/privacy notices. Art. 15–22: data subject rights. Art. 25: privacy by design/default. Art. 28: processors. Art. 30: records of processing. Art. 32: security. Art. 33–34: breach notification. Art. 35: DPIA. Art. 37–39: DPO. | GDPR official text — EUR-Lex (EUR-Lex) |
| UK GDPR + Data Protection Act 2018 | UK privacy/data protection requirements. Learn how to assess privacy governance, processing, rights and security. | Lawfulness, fairness, transparency; purpose limitation; minimisation; accuracy; retention; security; accountability; data subject rights; DPIAs; processors; international transfers; breach management; DPO/privacy governance. | UK GDPR / Data Protection Act guidance — ICO |
| DORA | Very important if you work in financial-services GRC. Focuses heavily on ICT risk and operational resilience. | ICT governance & risk management; ICT asset identification; protection & prevention; detection; response & recovery; backup; incident management/reporting; resilience testing; threat-led penetration testing; third-party ICT risk; contractual requirements; information sharing; business continuity. | DORA official regulation — EUR-Lex (EUR-Lex) |
| NIS2 Directive | Cybersecurity regulation for covered essential/important entities. Learn how regulatory requirements become cybersecurity controls. | Risk analysis; security policies; incident handling; business continuity; backup/DR; crisis management; supply-chain security; secure acquisition/development; vulnerability management; control effectiveness; cyber training; cryptography; HR security; access control; asset management; MFA. | NIS2 official Directive — EUR-Lex (EUR-Lex) |
| EU AI Act | AI governance and risk management. Particularly important for organizations developing/deploying high-risk AI systems. | AI risk management; data governance; technical documentation; record keeping/logging; transparency; human oversight; accuracy; robustness; cybersecurity; quality management; post-market monitoring; incident reporting. | EU AI Act official regulation — EUR-Lex (EUR-Lex) |