Standards & frameworks

Privacy & data protection: standards and frameworks, from data protection standards and laws to privacy certification

Data protection standards and laws decide how personal data may be collected, used, shared and kept, and what you must be able to prove when a regulator, a customer or the person concerned asks. This family brings together the privacy laws of the markets Sterling works in, the ISO/IEC 27701 management system standard and the frameworks that sit between them, so you can see which apply to you and how one programme can answer several.

Privacy and data protection

One body of personal data, many laws and one way to manage it

Privacy obligations follow the data, not the head office. A payroll provider in Manila serving a European client, a health-records processor in Bangalore working for a US hospital group and a software company in Dubai selling across the Gulf may each answer to three or four laws at once: the law of the country where they operate, the law of the people whose data they hold and the contract terms their customers pass down. Buyers usually come to this family for one of three reasons: a new law with a commencement date, a customer questionnaire that asks for evidence rather than a policy, or a tender that asks for a recognised certificate.

Most of the records here are laws. They set duties such as a lawful basis or consent, notices, rights requests, breach notification and limits on transfers abroad, but none of them issues a certificate for compliance. ISO/IEC 27701 is the certifiable standard in the family: a privacy information management system that turns those duties into roles, records, controls and reviews an accredited body can audit. ISO/IEC 29100, the NIST Privacy Framework and APEC CBPR give shared vocabulary, outcomes or a cross-border scheme. The practical pattern is to build one inventory of processing, one set of procedures and one evidence file, then map each law onto it rather than starting again country by country. Sterling's consultants build that programme with your privacy, legal, technology and operations teams, either through Design™, where we develop and you implement under our advice and supervision, or through Drive™, where we design and build under your approval. Effivity, the GRC software used in 50+ countries, is included with the engagement at no additional cost. Sterling does not give legal advice: questions of legal interpretation stay with your own counsel, and compliance is assessed by regulators and your customers' auditors.

The catalogue

77 standards, frameworks and schemes in this family

Laws by country and region, the certifiable ISO/IEC 27701 standard and the frameworks that support them. Each card opens the page for that record.

UAE and Saudi Arabia PDPL are covered within related pages rather than on pages of their own. HIPAA and GLBA also appear in the sector families they serve. A law listed here is described for orientation; whether it applies to you is a question for your legal counsel.

60+countries where Sterling has delivered certification
21countries with a Sterling office, eight regions, one coordinated team
2003the year the group began implementing ISO management systems; the same method, refined, since
8,100+client engagements across the group, from single-site SMEs to multinationals

FAQs

Questions buyers ask about data protection standards and laws

Short answers on where to start, combining requirements and who checks what.

Which data protection law or standard should we address first?

Start with the laws that already apply to you, because they are obligations rather than choices: the law where you are established and the laws of the people whose data you process, with your legal counsel confirming which. Where customers or tenders ask for a certificate, ISO/IEC 27701 is the recognised route, and it can be built on the same inventory and procedures the laws require. Frameworks such as the NIST Privacy Framework suit organisations that want a structured programme without a certificate.

Can one programme cover GDPR, the DPDP Act and other privacy laws together?

Yes, for most of the work. Records of processing, notices, rights handling, breach response, vendor contracts and training are common to nearly every law in this family; what differs is the detail, such as deadlines, consent rules, transfer mechanisms and registration duties. One programme with a mapping for each law is easier to keep current than separate projects, and ISO/IEC 27701 can be integrated with an existing ISO/IEC 27001 system.

What does a certification body, assessor or regulator actually check?

It depends on the route. For ISO/IEC 27701 certification, an accredited certification body audits the privacy information management system in two stages and decides on the certificate. For the laws, there is no certificate: regulators examine complaints, breaches and inquiries, and customers' auditors check evidence against their contracts and questionnaires. APEC CBPR certification is granted by an Accountability Agent recognised in the system. Sterling prepares the programme and the evidence; it does not certify or assess compliance.

Talk to a consultant

Working out which privacy laws apply? Talk to a Sterling consultant.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Get certified to a standard for the first timeUnderstand cost, scope and timingCertify several sites or countries in one programmeAdd a standard, or integrate the systems we have

Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice

End to end, from one team

On every engagement, in every country

Multi-country programmes

100% success guarantee · 8,100+ client engagements in 60+ countries · since 2003