Privacy Laws and Standards Across Jurisdictions is the body of legally binding regulations, voluntary standards, and governance frameworks that govern how organizations collect, process, store, transfer, and delete personal data — varying by geography, sector, and data type. The core competency is threefold: identify which laws apply to a given data processing activity, determine what controls those laws require, and design governance structures that satisfy multiple overlapping regimes simultaneously. It encompasses major regulations (GDPR, CCPA/CPRA, LGPD, PIPL, DPDPA), sectoral standards (HIPAA, PCI-DSS), and technical standards (ISO/IEC 27701, NIST Privacy Framework).
Where it stops · what it isn't
- —IS: Legally enforceable privacy regulations and recognized technical standards governing personal data processing (e.g., GDPR, CCPA/CPRA, LGPD, HIPAA, ISO/IEC 27701, NIST Privacy Framework)
- —IS: The governance competency of mapping applicable laws to organizational data flows, designing compliant controls, and managing multi-jurisdictional compliance programs
- —IS: Requirements for data subject rights (access, deletion, portability, opt-out), consent mechanisms, breach notification timelines, cross-border transfer restrictions, and Data Protection Impact Assessments (DPIAs)
- —IS NOT: A substitute for qualified legal counsel on jurisdiction-specific interpretation
- —IS NOT: Pure cybersecurity or IT security architecture — GDPR Article 32 security requirements are in scope, but network architecture is not
- —IS NOT: General data governance disciplines (data quality, data architecture) — related but distinct
- —IS NOT: Intellectual property law, contract law, or other non-privacy regulatory domains
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFISACA CDPSE Domain 1: Privacy Governance
REQUIRESData Lifecycle Management and ClassificationOrganizational Risk Management Frameworks
ENABLESPrivacy Impact Assessment (PIA) / DPIA ExecutionCross-Border Data Transfer ArchitectureConsent Management and Data Subject Rights Programs
RELATED TOPrivacy-by-Design Principles and ImplementationPrivacy Governance Roles and Structures (DPO, CPO)
CONSTRAINSData Retention and Deletion PoliciesThird-Party Vendor and Processor Management