Law / Frameworks / Crosswalk / FINOS AIGF to NIST Privacy Framework

The FINOS AI Governance Framework, mapped to the NIST Privacy Framework

15 of FINOS AIGF's controls connect to 47 of NIST Privacy Framework's through 1,063 laws in 199 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: FINOS AI Governance Framework, version 2, as maintained on October 7, 2026, FINOS
To: NIST Privacy Framework, version 1.0, January 2020, National Institute of Standards and Technology
See also: NIST Privacy Framework to FINOS AIGF, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: nist-privacy-framework--finos-ai-governance-framework.csv · nist-privacy-framework--finos-ai-governance-framework.json

FINOS AIGF	NIST Privacy Framework	Laws	Jurisdictions	Where the laws stand
AIR-PREV-005System Acceptance Testing	CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	290	139	265 in force, 17 not yet in force, 8 proposed
	The 290 laws behind AIR-PREV-005 and CT.PO-P1 Law No. 124/2024, special categories of personal data, criminal records and children's data, Albania Loi n° 18-07 relative à la protection des personnes physiques, catégories de données sensibles et biométriques, Algeria LQPD, special categories, children and criminal-offence data, Andorra Law on the Protection of Personal Data, sensitive data categories, Angola Data Protection Act, 2013, sensitive personal data, Antigua and Barbuda Ley 25.326, sensitive data categories and health data, Argentina Unlawful disclosure extended to AI-generated 'realistic pictorial representation' intimate images (SB 1462), Arizona Act 159 of 2025 (HB 1071), AI-Generated Replicas Amendment to Publicity Rights Act, Arkansas Act 827 of 2025 (HB 1529), Unlawful Creation or Distribution of Deepfake Visual Material, Arkansas Do Not Call Register Act 2006, Unsolicited Marketing Faxes, Australia and 280 more, every one in the free file.
	GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.	133	85	118 in force, 9 not yet in force, 6 proposed
	The 133 laws behind AIR-PREV-005 and GV.PO-P5 Law No. 124/2024 On the Protection of Personal Data, Albania Law No. 124/2024, Commissioner, remedies, liability and penalties, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Loi n° 18-07 relative à la protection des personnes physiques, contrôle, sanctions et voies de recours, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra LQPD, the Andorran Data Protection Agency, its powers, infractions and sanctions, Andorra Law on the Protection of Personal Data, enforcement and supervision, Angola Data Protection Act, 2013, information commissioner and enforcement, Antigua and Barbuda Ley 25.326, enforcement, sanctions, and the habeas data action, Argentina Ley 25.326, Ley de Protección de los Datos Personales, Argentina and 123 more, every one in the free file.
	CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing...	72	44	70 in force, 2 not yet in force
	The 72 laws behind AIR-PREV-005 and CT.PO-P3 Do Not Call Register Act 2006, Unsolicited Marketing Faxes, Australia Do Not Call Register Act 2006, Unsolicited Telemarketing Calls, Australia ECG, Austria TKG 2021, Austria Code de droit économique, Article XII.13, Advertising by Electronic Mail, Belgium Electronic Commerce Act, Articles 5(3) and 6, Identification of Commercial Messages and Unsolicited Commercial Messages, Bulgaria Electronic Communications Act, Article 261, Consent and Opt-out for Direct Marketing Calls, Messages and Electronic Mail, Bulgaria AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act), California from 1 Jan 2027, in 2 months Unsolicited and Unwanted Telephone Solicitations Act, California Canada's Anti-Spam Legislation, Canada and 62 more, every one in the free file.
	GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such...	58	53	48 in force, 6 not yet in force, 4 proposed
	The 58 laws behind AIR-PREV-005 and GV.PO-P1 Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Ley 25.326, Ley de Protección de los Datos Personales, Argentina Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Personal Information Protection Act, comprehensive regime, British Columbia Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, Burkina Faso Law No. 133/V/2001 on the Protection of Personal Data, data quality principles and processor contracts, Cabo Verde AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act), California from 1 Jan 2027, in 2 months Loi n° 24.001 portant protection des données à caractère personnel, Central African Republic Ley 1581 de 2012, General Personal Data Protection, Colombia and 48 more, every one in the free file.
	PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans...	50	36	47 in force, 2 not yet in force, 1 proposed
	The 50 laws behind AIR-PREV-005 and PR.PO-P7 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 40 more, every one in the free file.
	GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.	45	43	39 in force, 3 not yet in force, 3 proposed
	The 45 laws behind AIR-PREV-005 and GV.PO-P3 Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Law of the Republic of Belarus On Personal Data Protection, Belarus Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Personal Information Protection Act, comprehensive regime, British Columbia and 35 more, every one in the free file.
	ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.	41	37	36 in force, 3 not yet in force, 2 proposed
	The 41 laws behind AIR-PREV-005 and ID.RA-P4 Law No. 124/2024 On the Protection of Personal Data, Albania LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Law No. 133/V/2001 on the Protection of Personal Data, data protection impact assessment, Cabo Verde SB 1119 (2026), Adam's Law: companion chatbots and children's safety, California from 1 Jan 2027, in 2 months Draft Law on Personal Data Protection, final draft, Cambodia proposed Superintendencia Circular on AI and Personal Data, Colombia and 31 more, every one in the free file.
	CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data...	40	36	40 in force
	The 40 laws behind AIR-PREV-005 and CM.AW-P1 Electronic Communications Act, Article 261, Consent and Opt-out for Direct Marketing Calls, Messages and Electronic Mail, Bulgaria Canada's Anti-Spam Legislation, Canada Telecommunications Act, Unsolicited Telecommunications and the National Do Not Call List, Canada Ley 1581 de 2012, Sensitive Categories and Children's Data, Colombia Connecticut Action for Illegal Recording of Private Telephonic Communications, Connecticut Connecticut Telemarketing Act (Conn. Gen. Stat. 42-284 to 42-289, as substantially rewritten by Public Act 23-98), Connecticut Electronic Communications Act (Zakon o elektroničkim komunikacijama), Article 50, Paragraphs 1 to 4, Unsolicited Electronic Communications, Croatia Electronic Communications and Postal Services Regulation Law, Article 106, Unsolicited Calls, Fax and Electronic Mail for Direct Commercial Promotion, Cyprus Act No. 480/2004 on Certain Information Society Services, Section 7, Commercial Communications by Electronic Means, Czech Republic Ley para la Protección de Datos Personales, enforcement and sanctions, El Salvador and 30 more, every one in the free file.
	ID.IM-P4Data actions of the systems/products/services are inventoried.	32	31	29 in force, 1 not yet in force, 2 proposed
	The 32 laws behind AIR-PREV-005 and ID.IM-P4 Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Draft Law on Personal Data Protection, final draft, Cambodia proposed Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun, Cameroon Law No. 2013-450 on the Protection of Personal Data, Côte d'Ivoire and 22 more, every one in the free file.
	CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance...	16	11	11 in force, 5 not yet in force
	The 16 laws behind AIR-PREV-005 and CT.DM-P8 Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia e-Health Law Articles 26 to 27 and 32 to 35, Provider Records Banks, Access Logging and Confidentiality of Health Data, Cyprus from a date not yet set AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection), Lebanon and 6 more, every one in the free file.
	GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements...	10	8	8 in force, 1 not yet in force, 1 proposed
	The 10 laws behind AIR-PREV-005 and GV.MT-P3 SIC Circular on AI, Demonstrated Accountability, Colombia SPDP Norma General guaranteeing personal-data protection in the use of AI systems, Ecuador General Data Protection Regulation, Principles Relating to Processing of Personal Data and Accountability (Article 5), European Union MiFID II, European Union Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands Nigeria Data Protection Act, 2023 (NDPA), general data protection duties, Nigeria Nigeria Data Protection Act, 2023, complaints, enforcement and redress, Nigeria Law on Personal Data Protection, Serbia Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed
	GV.PO-P2Processes to instill organizational privacy values within system/product/service...	9	9	9 in force
	The 9 laws behind AIR-PREV-005 and GV.PO-P2 Law No. 124/2024 On the Protection of Personal Data, Albania LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Law No. 06/L-082 on Protection of Personal Data, Kosovo Law No. 195/2024 on Personal Data Protection, Moldova Nigeria Data Protection Act, 2023 (NDPA), general data protection duties, Nigeria San Marino Law No. 171 on the Protection of Natural Persons, San Marino Ley N° 19.670, accountability, extraterritorial scope and data-protection officer, Uruguay Cyber and Data Protection Regulations 2024, children's information and automated decisions, Zimbabwe
	PR.DS-P5Protections against data leaks are implemented.	9	9	9 in force
	The 9 laws behind AIR-PREV-005 and PR.DS-P5 Law No. 124/2024, special categories of personal data, criminal records and children's data, Albania Law of the Republic of Belarus On Personal Data Protection, Belarus Loi n° 24.001 portant protection des données à caractère personnel, données sensibles et mineurs, Central African Republic Ley No. 787, Ley de Protección de Datos Personales, Nicaragua San Marino Law No. 171 on the Protection of Natural Persons, San Marino Protection of Personal Information Act, special personal information and children, South Africa Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City Data Protection Act, 2021, personal data processing framework, Zambia
	CT.DM-P5Data are destroyed according to policy.	8	8	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-005 and CT.DM-P5 Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision, Cabo Verde AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act), California from 1 Jan 2027, in 2 months Illinois Eavesdropping Article, Interception and Civil Remedies (720 ILCS 5/14-2 as rewritten by Public Act 98-1142), Illinois Loi sur la Protection des Données Personnelles, Monaco DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York Personal Health Information Protection Act, 2004, offences and damages for breach of privacy, Ontario Wiretapping and Electronic Surveillance Control Act, Interception, Consent Exception and Civil Action, Pennsylvania Ley 29733, Ley de Protección de Datos Personales, Peru
	ID.IM-P1Systems/products/services that process data are inventoried.	8	6	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-005 and ID.IM-P1 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or...	5	5	5 in force
	The 5 laws behind AIR-PREV-005 and CT.PO-P2 Ley 25.326, Ley de Protección de los Datos Personales, Argentina Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, Burkina Faso Personal Data Protection Proclamation, Ethiopia Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection), Lebanon Fair Credit Reporting Act, consumer reporting agency, user and furnisher duties, United States
	CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and...	4	4	3 in force, 1 not yet in force
	The 4 laws behind AIR-PREV-005 and CT.DM-P10 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Cyber and Data Protection Regulations 2024, children's information and automated decisions, Zimbabwe
	CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations...	4	4	2 in force, 2 not yet in force
	The 4 laws behind AIR-PREV-005 and CM.AW-P5 Personal Data Protection Proclamation, enforcement, sanctions and offences, Ethiopia Data Protection Act, No. 1 of 2023, Information Commission, enforcement and offences, Grenada from a date not yet set Consumer Reporting Act, consumer reporting agencies and users of consumer reports, Ontario Data Protection Act, 2018, Information Commissioner, enforcement and offences, Saint Kitts and Nevis from a date not yet set
	ID.RA-P2Data analytic inputs and outputs are identified and evaluated for bias.	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-005 and ID.RA-P2 AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
	GV.AT-P1The workforce is informed and trained on its roles and responsibilities.	3	3	3 in force
	The 3 laws behind AIR-PREV-005 and GV.AT-P1 Law of the Republic of Belarus On Personal Data Protection, Belarus MiFID II, European Union Telephone Consumer Protection Act, National Do Not Call Registry and Company-Specific List, United States
	ID.RA-P5Risk responses are identified, prioritized, and implemented.	2	2	2 in force
	The 2 laws behind AIR-PREV-005 and ID.RA-P5 Superintendencia Circular on AI and Personal Data, Colombia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg
	ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate...	2	2	2 in force
	The 2 laws behind AIR-PREV-005 and ID.DE-P3 General Data Protection Regulation (GDPR), Comprehensive Regime, European Union Data Protection Act, sensitive personal data, Saint Lucia
	PR.PO-P3Backups of information are conducted, maintained, and tested.	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-005 and PR.PO-P3 e-Health Law Articles 26 to 27 and 32 to 35, Provider Records Banks, Access Logging and Confidentiality of Health Data, Cyprus from a date not yet set Organic Act on the Protection of Personal Data, Tunisia
	PR.PO-P8Response and recovery plans are tested.	2	2	2 in force
	The 2 laws behind AIR-PREV-005 and PR.PO-P8 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning,...	2	2	1 in force, 1 proposed
	The 2 laws behind AIR-PREV-005 and PR.PO-P9 Lei n.º 03/2016, Protecção de Dados Pessoais, Sao Tome and Principe Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed
	PR.PO-P10A vulnerability management plan is developed and implemented.	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-005 and PR.PO-P10 Cyber Resilience Act, Obligations of Open-Source Software Stewards, European Union from 11 Dec 2027, in 14 months Lag (2024:1278), DORA Supplementary Provisions, Sweden
	PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	2	2	2 in force
	The 2 laws behind AIR-PREV-005 and PR.AC-P4 Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg
	GV.MT-P4Policies, processes, and procedures for communicating progress on managing privacy...	2	1	2 in force
	The 2 laws behind AIR-PREV-005 and GV.MT-P4 Nigeria Data Protection Act, 2023 (NDPA), general data protection duties, Nigeria Nigeria Data Protection Act, 2023, sensitive personal data and a child's data, Nigeria
AIR-PREV-006Data Quality & Classification/Sensitivity	GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.	133	85	118 in force, 9 not yet in force, 6 proposed
	The 133 laws behind AIR-PREV-006 and GV.PO-P5 Law No. 124/2024 On the Protection of Personal Data, Albania Law No. 124/2024, Commissioner, remedies, liability and penalties, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Loi n° 18-07 relative à la protection des personnes physiques, contrôle, sanctions et voies de recours, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra LQPD, the Andorran Data Protection Agency, its powers, infractions and sanctions, Andorra Law on the Protection of Personal Data, enforcement and supervision, Angola Data Protection Act, 2013, information commissioner and enforcement, Antigua and Barbuda Ley 25.326, enforcement, sanctions, and the habeas data action, Argentina Ley 25.326, Ley de Protección de los Datos Personales, Argentina and 123 more, every one in the free file.
	CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing...	125	99	103 in force, 17 not yet in force, 5 proposed
	The 125 laws behind AIR-PREV-006 and CT.PO-P3 Law No. 124/2024, rights of the data subject, Albania Loi n° 18-07 relative à la protection des personnes physiques, droits de la personne concernée, Algeria LQPD, rights of the data subject, Andorra Law on the Protection of Personal Data, rights of data subjects, Angola Data Protection Act, 2013, notice and rights of data subjects, Antigua and Barbuda Ley 25.326, rights of data subjects, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas Data Protection Act, 2019, automated decisions, Barbados Data Protection Act, 2019, rights of a data subject, Barbados Law of the Republic of Belarus On Personal Data Protection, rights of the personal data subject, Belarus and 115 more, every one in the free file.
	CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	95	76	82 in force, 7 not yet in force, 6 proposed
	The 95 laws behind AIR-PREV-006 and CT.PO-P1 Law No. 124/2024, special categories of personal data, criminal records and children's data, Albania Loi n° 18-07 relative à la protection des personnes physiques, catégories de données sensibles et biométriques, Algeria LQPD, special categories, children and criminal-offence data, Andorra Data Protection Act, 2019, a child's consent and sensitive personal data, Barbados Law of the Republic of Belarus On Personal Data Protection, special personal data, Belarus Data Protection Act 2021, comprehensive regime, Belize from a date not yet set Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, données sensibles et mineurs, Benin Personal Information Protection Act 2016, Commissioner, enforcement and offences, Bermuda Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Law on the Protection of Personal Data of Bosnia and Herzegovina, biometric data processing, Bosnia and Herzegovina and 85 more, every one in the free file.
	CT.DM-P1Data elements can be accessed for review.	61	59	54 in force, 7 not yet in force
	The 61 laws behind AIR-PREV-006 and CT.DM-P1 Loi n° 18-07 relative à la protection des personnes physiques, droits de la personne concernée, Algeria LQPD, rights of the data subject, Andorra Law on the Protection of Personal Data, rights of data subjects, Angola Data Protection Act, 2013, notice and rights of data subjects, Antigua and Barbuda Ley 25.326, rights of data subjects, Argentina Data Protection Act, 2024, rights of data subjects, Botswana LGPD, rights of the data subject, Brazil Personal Information Protection Act, comprehensive regime, British Columbia Personal Data Protection Law, rights of the data subject, Burkina Faso Law No. 133/V/2001 on the Protection of Personal Data, open-network warning, health-data access and marketing objection, Cabo Verde and 51 more, every one in the free file.
	GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such...	55	52	48 in force, 4 not yet in force, 3 proposed
	The 55 laws behind AIR-PREV-006 and GV.PO-P1 Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Ley 25.326, Ley de Protección de los Datos Personales, Argentina Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Personal Information Protection Act, comprehensive regime, British Columbia Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, Burkina Faso Law No. 133/V/2001 on the Protection of Personal Data, data quality principles and processor contracts, Cabo Verde Loi n° 24.001 portant protection des données à caractère personnel, Central African Republic Ley 1581 de 2012, General Personal Data Protection, Colombia Law on the Protection of Personal Data, Comoros and 45 more, every one in the free file.
	PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans...	50	36	47 in force, 2 not yet in force, 1 proposed
	The 50 laws behind AIR-PREV-006 and PR.PO-P7 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 40 more, every one in the free file.
	CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations...	47	45	44 in force, 3 not yet in force
	The 47 laws behind AIR-PREV-006 and CM.AW-P5 Law No. 124/2024, rights of the data subject, Albania LQPD, rights of the data subject, Andorra Law on the Protection of Personal Data, rights of data subjects, Angola Ley 25.326, rights of data subjects, Argentina Data Protection Act, 2019, rights of a data subject, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, droits des personnes concernées, Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, rights of data subjects, Bosnia and Herzegovina Personal Information Protection Act, comprehensive regime, British Columbia Personal Data Protection Law, rights of the data subject, Burkina Faso Law No. 133/V/2001 on the Protection of Personal Data, rights of data subjects, Cabo Verde and 37 more, every one in the free file.
	GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.	46	44	40 in force, 3 not yet in force, 3 proposed
	The 46 laws behind AIR-PREV-006 and GV.PO-P3 Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Law of the Republic of Belarus On Personal Data Protection, Belarus Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Personal Information Protection Act, comprehensive regime, British Columbia and 36 more, every one in the free file.
	CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data...	33	32	27 in force, 3 not yet in force, 3 proposed
	The 33 laws behind AIR-PREV-006 and CM.AW-P1 Law No. 124/2024, rights of the data subject, Albania LQPD, rights of the data subject, Andorra California Consumer Privacy Act, as amended by the California Privacy Rights Act (Proposition 24), California Cambodia's Draft Law on Personal Data Protection, rights of data subjects, Cambodia proposed Ley 1581 de 2012, Sensitive Categories and Children's Data, Colombia Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks Resolución 58/2022 (MINCOM), security and localization rules for personal data in electronic form, Cuba Law No. 2013-450 on the Protection of Personal Data, rights of the data subject, Côte d'Ivoire Digital Code, Title III, rights of the data subject, Democratic Republic of the Congo Personal Data Protection Proclamation, rights of data subjects, Ethiopia and 23 more, every one in the free file.
	ID.IM-P4Data actions of the systems/products/services are inventoried.	32	31	29 in force, 1 not yet in force, 2 proposed
	The 32 laws behind AIR-PREV-006 and ID.IM-P4 Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Draft Law on Personal Data Protection, final draft, Cambodia proposed Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun, Cameroon Law No. 2013-450 on the Protection of Personal Data, Côte d'Ivoire and 22 more, every one in the free file.
	CT.DM-P3Data elements can be accessed for alteration.	21	21	15 in force, 6 not yet in force
	The 21 laws behind AIR-PREV-006 and CT.DM-P3 LQPD, rights of the data subject, Andorra Data Protection Act, 2013, notice and rights of data subjects, Antigua and Barbuda Personal Information Protection Act, comprehensive regime, British Columbia Digital Code, Title III, rights of the data subject, Democratic Republic of the Congo Ley para la Protección de Datos Personales, rights of data subjects, El Salvador Personal Data Protection Proclamation, rights of data subjects, Ethiopia European Health Data Space Regulation, Rights of Natural Persons in the Primary Use of Electronic Health Data (Articles 3 to 10), European Union from 26 Mar 2029, in 2.4 years Personal Data Protection and Privacy Act, 2025, rights of the data subject, Gambia from a date not yet set Data Protection Act, No. 1 of 2023, rights of data subjects, Grenada from a date not yet set Health Information Act 2026 Sections 7, 8 and 13 to 15, Duty to Share Health Data and Patient Access to Electronic Health Records, Ireland from a date not yet set and 11 more, every one in the free file.
	CT.DM-P2Data elements can be accessed for transmission or disclosure.	21	19	17 in force, 3 not yet in force, 1 proposed
	The 21 laws behind AIR-PREV-006 and CT.DM-P2 Law No. 124/2024, rights of the data subject, Albania LQPD, rights of the data subject, Andorra Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, droits des personnes concernées, Benin Law No. 2013-450 on the Protection of Personal Data, rights of the data subject, Côte d'Ivoire Digital Code, Title III, rights of the data subject, Democratic Republic of the Congo Ley para la Protección de Datos Personales, rights of data subjects, El Salvador Personal Data Protection Proclamation, rights of data subjects, Ethiopia Data Act, User Access to Connected-Product Data and Sharing with Third Parties (Articles 3 to 5), European Union European Health Data Space Regulation, Rights of Natural Persons in the Primary Use of Electronic Health Data (Articles 3 to 10), European Union from 26 Mar 2029, in 2.4 years Platform Work Directive, Transparency, Human Oversight and Human Review of Automated Systems (Articles 9 to 11), European Union from 2 Dec 2026, in 6 weeks and 11 more, every one in the free file.
	CT.DM-P4Data elements can be accessed for deletion.	18	18	17 in force, 1 not yet in force
	The 18 laws behind AIR-PREV-006 and CT.DM-P4 LQPD, rights of the data subject, Andorra Law of the Republic of Belarus On Personal Data Protection, rights of the personal data subject, Belarus Personal Data Protection Law, rights of the data subject, Burkina Faso Law No. 2013-450 on the Protection of Personal Data, rights of the data subject, Côte d'Ivoire Digital Code, Title III, rights of the data subject, Democratic Republic of the Congo Ley para la Protección de Datos Personales, rights of data subjects, El Salvador Personal Data Protection Proclamation, rights of data subjects, Ethiopia Personal Data Protection and Privacy Act, 2025, rights of the data subject, Gambia from a date not yet set Law No. 06/L-082 on Protection of Personal Data, rights of the data subject, Kosovo Loi sur la Protection des Données Personnelles, droits de la personne concernée, Monaco and 8 more, every one in the free file.
	CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance...	16	11	11 in force, 5 not yet in force
	The 16 laws behind AIR-PREV-006 and CT.DM-P8 Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia e-Health Law Articles 26 to 27 and 32 to 35, Provider Records Banks, Access Logging and Confidentiality of Health Data, Cyprus from a date not yet set AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection), Lebanon and 6 more, every one in the free file.
	ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.	13	13	11 in force, 1 not yet in force, 1 proposed
	The 13 laws behind AIR-PREV-006 and ID.RA-P4 Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Draft Law on Personal Data Protection, final draft, Cambodia proposed Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Data Protection Act 2025, Kiribati Law No. 06/L-082 on Protection of Personal Data, Kosovo Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Law No. 195/2024 on Personal Data Protection, Moldova Loi sur la Protection des Données Personnelles, Monaco Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguay, Paraguay from 27 Nov 2027, in 13 months Law No. 29-2019 on the Protection of Personal Data, Republic of the Congo and 3 more, every one in the free file.
	GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements...	10	8	8 in force, 1 not yet in force, 1 proposed
	The 10 laws behind AIR-PREV-006 and GV.MT-P3 SIC Circular on AI, Demonstrated Accountability, Colombia SPDP Norma General guaranteeing personal-data protection in the use of AI systems, Ecuador General Data Protection Regulation, Principles Relating to Processing of Personal Data and Accountability (Article 5), European Union MiFID II, European Union Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands Nigeria Data Protection Act, 2023 (NDPA), general data protection duties, Nigeria Nigeria Data Protection Act, 2023, complaints, enforcement and redress, Nigeria Law on Personal Data Protection, Serbia Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed
	PR.DS-P5Protections against data leaks are implemented.	9	9	9 in force
	The 9 laws behind AIR-PREV-006 and PR.DS-P5 Law No. 124/2024, special categories of personal data, criminal records and children's data, Albania Law of the Republic of Belarus On Personal Data Protection, Belarus Loi n° 24.001 portant protection des données à caractère personnel, données sensibles et mineurs, Central African Republic Ley No. 787, Ley de Protección de Datos Personales, Nicaragua San Marino Law No. 171 on the Protection of Natural Persons, San Marino Protection of Personal Information Act, special personal information and children, South Africa Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City Data Protection Act, 2021, personal data processing framework, Zambia
	ID.IM-P1Systems/products/services that process data are inventoried.	8	6	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-006 and ID.IM-P1 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	GV.PO-P2Processes to instill organizational privacy values within system/product/service...	6	6	6 in force
	The 6 laws behind AIR-PREV-006 and GV.PO-P2 Law No. 124/2024 On the Protection of Personal Data, Albania LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Law No. 06/L-082 on Protection of Personal Data, Kosovo Law No. 195/2024 on Personal Data Protection, Moldova San Marino Law No. 171 on the Protection of Natural Persons, San Marino
	GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to...	6	6	6 in force
	The 6 laws behind AIR-PREV-006 and GV.MT-P7 Data Protection Act, 2013, notice and rights of data subjects, Antigua and Barbuda Personal Information Protection Act, comprehensive regime, British Columbia Data Protection Act, 2022, rights of data subjects, Eswatini Data Protection Act, 2011, rights of data subjects, Lesotho Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications, Nauru National Digital Identification Act 2024, registered persons' data-subject rights, Samoa
	CT.DM-P5Data are destroyed according to policy.	6	6	6 in force
	The 6 laws behind AIR-PREV-006 and CT.DM-P5 Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision, Cabo Verde Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, article 74 (atteinte à la vie privée et traitement illicite des données à caractère personnel), Cameroon Loi sur la Protection des Données Personnelles, Monaco DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York Ley No. 787, Ley de Protección de Datos Personales, rights of data subjects, Nicaragua Ley 29733, Ley de Protección de Datos Personales, Peru
	CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or...	6	5	6 in force
	The 6 laws behind AIR-PREV-006 and CT.PO-P2 Ley 25.326, Ley de Protección de los Datos Personales, Argentina Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, Burkina Faso Personal Data Protection Proclamation, Ethiopia Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection), Lebanon Law No. 81/2018, Part V, notice, objection, access and correction, Lebanon Fair Credit Reporting Act, consumer reporting agency, user and furnisher duties, United States
	CT.DM-P6Data are transmitted using standardized formats.	5	4	2 in force, 2 not yet in force, 1 proposed
	The 5 laws behind AIR-PREV-006 and CT.DM-P6 Data Act, User Access to Connected-Product Data and Sharing with Third Parties (Articles 3 to 5), European Union European Health Data Space Regulation, Rights of Natural Persons in the Primary Use of Electronic Health Data (Articles 3 to 10), European Union from 26 Mar 2029, in 2.4 years Health Information Act 2026 Sections 7, 8 and 13 to 15, Duty to Share Health Data and Patient Access to Electronic Health Records, Ireland from a date not yet set Loi n° 2022-59, droits des personnes concernées, Niger Draft Law on the Protection of Privacy and Personal Data, rights of the data subject, Suriname proposed
	CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and...	4	4	2 in force, 2 not yet in force
	The 4 laws behind AIR-PREV-006 and CT.DM-P10 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Consumer Credit Act (2026:1011), Chapter 2 Section 7 and Chapter 3 Section 15, Personalised Offers and Credit Assessment by Automated Processing, Sweden from 20 Nov 2026, in 4 weeks
	ID.RA-P2Data analytic inputs and outputs are identified and evaluated for bias.	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-006 and ID.RA-P2 AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
	CM.AW-P4Records of data disclosures and sharing are maintained and can be accessed for review...	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-006 and CM.AW-P4 LGPD, rights of the data subject, Brazil Health Information Act 2026 Sections 7, 8 and 13 to 15, Duty to Share Health Data and Patient Access to Electronic Health Records, Ireland from a date not yet set Law No. 06/L-082 on Protection of Personal Data, rights of the data subject, Kosovo
	PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	3	3	3 in force
	The 3 laws behind AIR-PREV-006 and PR.AC-P4 Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Law on Personal Data Protection, special categories of data, Montenegro
	ID.IM-P6Data elements within the data actions are inventoried.	2	2	2 in force
	The 2 laws behind AIR-PREV-006 and ID.IM-P6 Data Classification Policy, Kuwait Law on Personal Data Protection, special categories of data, Montenegro
	GV.AT-P1The workforce is informed and trained on its roles and responsibilities.	2	2	2 in force
	The 2 laws behind AIR-PREV-006 and GV.AT-P1 Law of the Republic of Belarus On Personal Data Protection, Belarus MiFID II, European Union
	PR.PO-P3Backups of information are conducted, maintained, and tested.	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-006 and PR.PO-P3 e-Health Law Articles 26 to 27 and 32 to 35, Provider Records Banks, Access Logging and Confidentiality of Health Data, Cyprus from a date not yet set Organic Act on the Protection of Personal Data, Tunisia
	PR.PO-P8Response and recovery plans are tested.	2	2	2 in force
	The 2 laws behind AIR-PREV-006 and PR.PO-P8 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning,...	2	2	1 in force, 1 proposed
	The 2 laws behind AIR-PREV-006 and PR.PO-P9 Lei n.º 03/2016, Protecção de Dados Pessoais, Sao Tome and Principe Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed
PR.PO-P10A vulnerability management plan is developed and implemented.	2	2	1 in force, 1 not yet in force
The 2 laws behind AIR-PREV-006 and PR.PO-P10 Cyber Resilience Act, Obligations of Open-Source Software Stewards, European Union from 11 Dec 2027, in 14 months Lag (2024:1278), DORA Supplementary Provisions, Sweden
AIR-PREV-007Legal and Contractual Frameworks for AI Systems	PR.DS-P5Protections against data leaks are implemented.	125	105	113 in force, 8 not yet in force, 4 proposed
	The 125 laws behind AIR-PREV-007 and PR.DS-P5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Law on the Protection of Personal Data, Angola Law on the Protection of Personal Data, sensitive data categories, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas and 115 more, every one in the free file.
	CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or...	88	84	78 in force, 5 not yet in force, 5 proposed
	The 88 laws behind AIR-PREV-007 and CT.PO-P2 Law No. 124/2024, international data transfer, Albania Loi n° 18-07 relative à la protection des personnes physiques, transfert de données vers un pays étranger, Algeria LQPD, transfers of personal data to third countries or international organisations, Andorra Law on the Protection of Personal Data, cross border transfer, Angola Ley 25.326, cross-border transfer, Argentina Data Protection Act, 2019, transfers of personal data outside of Barbados, Barbados Law of the Republic of Belarus On Personal Data Protection, cross border transfer of personal data, Belarus Data Protection Act 2021, cross-border transfer of personal data, Belize from a date not yet set Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, transfert transfrontalier de données, Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, cross-border transfer, Bosnia and Herzegovina and 78 more, every one in the free file.
	PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans...	32	24	31 in force, 1 not yet in force
	The 32 laws behind AIR-PREV-007 and PR.PO-P7 Law No. 124/2024 On the Protection of Personal Data, Albania Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2019, Barbados OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union and 22 more, every one in the free file.
	PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	20	15	20 in force
	The 20 laws behind AIR-PREV-007 and PR.AC-P4 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures, Cabo Verde Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands and 10 more, every one in the free file.
	ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate...	18	15	18 in force
	The 18 laws behind AIR-PREV-007 and ID.DE-P3 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Law of the Republic of Belarus On Personal Data Protection, Belarus Personal Data Protection Law, cross-border transfer of personal data, Burkina Faso Loi n° 24.001 portant protection des données à caractère personnel, Central African Republic Loi n° 24.001 portant protection des données à caractère personnel, flux transfrontalier, Central African Republic Ley para la Protección de Datos Personales, cross border transfer of personal data, El Salvador Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini General Data Protection Regulation (GDPR), Comprehensive Regime, European Union Standard Contractual Clauses for Transfers to Third Countries, Commission Implementing Decision (EU) 2021/914, European Union and 8 more, every one in the free file.
	PR.PO-P10A vulnerability management plan is developed and implemented.	15	10	13 in force, 2 not yet in force
	The 15 laws behind AIR-PREV-007 and PR.PO-P10 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months and 5 more, every one in the free file.
	ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners,...	14	14	11 in force, 3 not yet in force
	The 14 laws behind AIR-PREV-007 and ID.DE-P2 Data Protection Act, 2013, Antigua and Barbuda Data Protection Act, 2019, transfers of personal data outside of Barbados, Barbados Law on the Protection of Personal Data of Bosnia and Herzegovina, cross-border transfer, Bosnia and Herzegovina Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Loi n° 24.001 portant protection des données à caractère personnel, flux transfrontalier, Central African Republic Egypt Personal Data Protection Law, cross-border transfer of Personal Data, Egypt Personal Data Protection Proclamation, cross-border transfer and data sovereignty, Ethiopia Standard Contractual Clauses for Transfers to Third Countries, Commission Implementing Decision (EU) 2021/914, European Union Personal Data Protection and Privacy Act, 2025, transfer of personal data outside The Gambia, Gambia from a date not yet set Data Protection Act, No. 1 of 2023, Grenada from a date not yet set and 4 more, every one in the free file.
	PR.DS-P2Data-in-transit are protected.	12	12	12 in force
	The 12 laws behind AIR-PREV-007 and PR.DS-P2 Ley General de Telecomunicaciones, Inviolabilidad y Secreto de las Comunicaciones y Protección de Datos Personales, Bolivia Electronic Communications and Postal Services Regulation Law, Article 99(1) to (4), Confidentiality of Communications and Business Recording, Cyprus Ley para la Protección de Datos Personales, cross border transfer of personal data, El Salvador Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Loi n° 2022-59, transfert transfrontalier des données, Niger Telecommunications Act 2005, confidentiality and protection of customer personal information, Samoa and 2 more, every one in the free file.
	PR.DS-P1Data-at-rest are protected.	8	8	8 in force
	The 8 laws behind AIR-PREV-007 and PR.DS-P1 Law No. 124/2024 On the Protection of Personal Data, Albania Data Protection Act, 2019, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law 506/2004 on the Processing of Personal Data and the Protection of Privacy in Electronic Communications (Legea nr. 506/2004), Article 4, Paragraphs 1 to 4, Confidentiality of Communications, Romania Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda
	CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	8	7	8 in force
	The 8 laws behind AIR-PREV-007 and CT.PO-P1 Ley 1581 de 2012, General Personal Data Protection, Colombia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1), Mexico Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists, Mexico Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications, Nauru Telecommunications Act 2005, confidentiality and protection of customer personal information, Samoa Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe Telecommunications Act 2009, Confidentiality and Consent Duties, Solomon Islands
	ID.IM-P7The data processing environment is identified (e.g., geographic location, internal,...	6	6	6 in force
	The 6 laws behind AIR-PREV-007 and ID.IM-P7 Data Protection Act, 2024, transfer of personal data to third countries or international organisations, Botswana Resolución 58/2022 (MINCOM), security and localization rules for personal data in electronic form, Cuba Digital Code, Title III, cross-border transfer of personal data, Democratic Republic of the Congo Personal Data Protection Proclamation, cross-border transfer and data sovereignty, Ethiopia Law relating to the Protection of Personal Data and Privacy, cross-border transfer and data storage, Rwanda Data Protection Act, 2021, transfer of personal data outside the Republic, Zambia
	GV.PO-P2Processes to instill organizational privacy values within system/product/service...	6	6	5 in force, 1 proposed
	The 6 laws behind AIR-PREV-007 and GV.PO-P2 Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Draft Law on Personal Data Protection, final draft, Cambodia proposed Digital Code, Book I: Personal Data Protection and CNDP, Djibouti LOPDP, comprehensive personal-data protection regime, Ecuador Radio Equipment Directive, Network, Privacy and Fraud Protection Requirements for Internet-Connected Radio Equipment, European Union Loi n° 2022-59, protection des données à caractère personnel, Niger
	PR.PO-P8Response and recovery plans are tested.	6	5	6 in force
	The 6 laws behind AIR-PREV-007 and PR.PO-P8 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms, Ireland Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms, Luxembourg
	GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.	5	5	5 in force
	The 5 laws behind AIR-PREV-007 and GV.PO-P5 Law on the Protection of Personal Data, sensitive data categories, Angola Law No. 133/V/2001 on the Protection of Personal Data, cross border transfer, Cabo Verde San Marino Law No. 171 on the Protection of Natural Persons, San Marino Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, transferts vers un pays tiers, Senegal
	PR.AC-P1Identities and credentials are issued, managed, verified, revoked, and audited for...	5	5	5 in force
	The 5 laws behind AIR-PREV-007 and PR.AC-P1 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Product Security Requirements for Connectable Products, United Kingdom
	GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.	4	4	4 in force
	The 4 laws behind AIR-PREV-007 and GV.PO-P3 Law of the Republic of Belarus On Personal Data Protection, Belarus General Data Protection Regulation (GDPR), Comprehensive Regime, European Union Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City
	GV.AT-P1The workforce is informed and trained on its roles and responsibilities.	4	4	4 in force
	The 4 laws behind AIR-PREV-007 and GV.AT-P1 Law of the Republic of Belarus On Personal Data Protection, Belarus Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda Data Protection Act, Saint Lucia
	CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance...	4	4	4 in force
	The 4 laws behind AIR-PREV-007 and CT.DM-P8 Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Law No. 09-08, sensitive personal data and offense records, Morocco Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
	CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data...	4	4	4 in force
	The 4 laws behind AIR-PREV-007 and CM.AW-P1 LQPD, transfers of personal data to third countries or international organisations, Andorra LGPD, international transfer of data, Brazil Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1), Mexico Data Protection Act, 2011, cross border disclosure of personal information, Trinidad and Tobago
	GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such...	3	3	3 in force
	The 3 laws behind AIR-PREV-007 and GV.PO-P1 Ley de Protección de Datos Personales, Equatorial Guinea Ley No. 787, Ley de Protección de Datos Personales, Nicaragua Data Protection Act, 2021, personal data processing framework, Zambia
	PR.PO-P3Backups of information are conducted, maintained, and tested.	3	3	3 in force
	The 3 laws behind AIR-PREV-007 and PR.PO-P3 Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act), Senegal
	PR.AC-P6Individuals and devices are proofed and bound to credentials, and authenticated...	3	2	3 in force
	The 3 laws behind AIR-PREV-007 and PR.AC-P6 Ley No. 172-13 sobre Protección Integral de los Datos Personales, Dominican Republic DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
	CT.DM-P5Data are destroyed according to policy.	2	2	2 in force
	The 2 laws behind AIR-PREV-007 and CT.DM-P5 Ley 25.326, Ley de Protección de los Datos Personales, Argentina Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut
	CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.	2	2	2 in force
	The 2 laws behind AIR-PREV-007 and CM.AW-P7 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union
	PR.AC-P2Physical access to data and devices is managed.	2	2	2 in force
	The 2 laws behind AIR-PREV-007 and PR.AC-P2 Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures, Cabo Verde Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	PR.DS-P5Protections against data leaks are implemented.	124	105	112 in force, 8 not yet in force, 4 proposed
	The 124 laws behind AIR-PREV-008 and PR.DS-P5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Law on the Protection of Personal Data, Angola Law on the Protection of Personal Data, sensitive data categories, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas and 114 more, every one in the free file.
	PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans...	32	24	31 in force, 1 not yet in force
	The 32 laws behind AIR-PREV-008 and PR.PO-P7 Law No. 124/2024 On the Protection of Personal Data, Albania Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2019, Barbados OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union and 22 more, every one in the free file.
	PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	20	15	20 in force
	The 20 laws behind AIR-PREV-008 and PR.AC-P4 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures, Cabo Verde Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands and 10 more, every one in the free file.
	PR.PO-P10A vulnerability management plan is developed and implemented.	15	10	13 in force, 2 not yet in force
	The 15 laws behind AIR-PREV-008 and PR.PO-P10 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months and 5 more, every one in the free file.
	PR.DS-P2Data-in-transit are protected.	11	11	11 in force
	The 11 laws behind AIR-PREV-008 and PR.DS-P2 Ley General de Telecomunicaciones, Inviolabilidad y Secreto de las Comunicaciones y Protección de Datos Personales, Bolivia Electronic Communications and Postal Services Regulation Law, Article 99(1) to (4), Confidentiality of Communications and Business Recording, Cyprus Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Loi n° 2022-59, transfert transfrontalier des données, Niger Telecommunications Act 2005, confidentiality and protection of customer personal information, Samoa Electronic Communications Act, Section 117, Paragraphs 1 and 2, Telecommunications Secrecy, Slovakia and 1 more, every one in the free file.
	PR.DS-P1Data-at-rest are protected.	8	8	8 in force
	The 8 laws behind AIR-PREV-008 and PR.DS-P1 Law No. 124/2024 On the Protection of Personal Data, Albania Data Protection Act, 2019, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law 506/2004 on the Processing of Personal Data and the Protection of Privacy in Electronic Communications (Legea nr. 506/2004), Article 4, Paragraphs 1 to 4, Confidentiality of Communications, Romania Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda
	CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	7	7	7 in force
	The 7 laws behind AIR-PREV-008 and CT.PO-P1 Ley 1581 de 2012, General Personal Data Protection, Colombia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1), Mexico Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications, Nauru Telecommunications Act 2005, confidentiality and protection of customer personal information, Samoa Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe Telecommunications Act 2009, Confidentiality and Consent Duties, Solomon Islands
	ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate...	6	6	6 in force
	The 6 laws behind AIR-PREV-008 and ID.DE-P3 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini Data Protection Act, Ghana Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Lei n.º 03/2016, Protecção de Dados Pessoais, Sao Tome and Principe
	GV.PO-P2Processes to instill organizational privacy values within system/product/service...	6	6	5 in force, 1 proposed
	The 6 laws behind AIR-PREV-008 and GV.PO-P2 Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Draft Law on Personal Data Protection, final draft, Cambodia proposed Digital Code, Book I: Personal Data Protection and CNDP, Djibouti LOPDP, comprehensive personal-data protection regime, Ecuador Radio Equipment Directive, Network, Privacy and Fraud Protection Requirements for Internet-Connected Radio Equipment, European Union Loi n° 2022-59, protection des données à caractère personnel, Niger
	PR.PO-P8Response and recovery plans are tested.	6	5	6 in force
	The 6 laws behind AIR-PREV-008 and PR.PO-P8 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms, Ireland Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms, Luxembourg
	ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners,...	5	5	3 in force, 2 not yet in force
	The 5 laws behind AIR-PREV-008 and ID.DE-P2 Data Protection Act, 2013, Antigua and Barbuda Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Loi n° 2013-015, protection des données à caractère personnel, Mali Data Protection Act, 2018, Saint Kitts and Nevis from a date not yet set
	PR.AC-P1Identities and credentials are issued, managed, verified, revoked, and audited for...	5	5	5 in force
	The 5 laws behind AIR-PREV-008 and PR.AC-P1 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Product Security Requirements for Connectable Products, United Kingdom
	GV.AT-P1The workforce is informed and trained on its roles and responsibilities.	4	4	4 in force
	The 4 laws behind AIR-PREV-008 and GV.AT-P1 Law of the Republic of Belarus On Personal Data Protection, Belarus Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda Data Protection Act, Saint Lucia
	CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or...	4	4	3 in force, 1 proposed
	The 4 laws behind AIR-PREV-008 and CT.PO-P2 Ley 1581 de 2012, General Personal Data Protection, Colombia Protection of Children (Online Age Verification) Bill 2026, Ireland proposed Loi n° 2022-59, transfert transfrontalier des données, Niger Ley 81 de 2019, Sobre Protección de Datos Personales, Panama
	CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance...	4	4	4 in force
	The 4 laws behind AIR-PREV-008 and CT.DM-P8 Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Law No. 09-08, sensitive personal data and offense records, Morocco Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
	GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such...	3	3	3 in force
	The 3 laws behind AIR-PREV-008 and GV.PO-P1 Ley de Protección de Datos Personales, Equatorial Guinea Ley No. 787, Ley de Protección de Datos Personales, Nicaragua Data Protection Act, 2021, personal data processing framework, Zambia
	GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.	3	3	3 in force
	The 3 laws behind AIR-PREV-008 and GV.PO-P3 Law of the Republic of Belarus On Personal Data Protection, Belarus Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City
	GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.	3	3	3 in force
	The 3 laws behind AIR-PREV-008 and GV.PO-P5 Law on the Protection of Personal Data, sensitive data categories, Angola San Marino Law No. 171 on the Protection of Natural Persons, San Marino Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
	PR.PO-P3Backups of information are conducted, maintained, and tested.	3	3	3 in force
	The 3 laws behind AIR-PREV-008 and PR.PO-P3 Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act), Senegal
	PR.AC-P6Individuals and devices are proofed and bound to credentials, and authenticated...	3	2	3 in force
	The 3 laws behind AIR-PREV-008 and PR.AC-P6 Ley No. 172-13 sobre Protección Integral de los Datos Personales, Dominican Republic DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
	CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.	2	2	2 in force
	The 2 laws behind AIR-PREV-008 and CM.AW-P7 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union
	PR.AC-P2Physical access to data and devices is managed.	2	2	2 in force
	The 2 laws behind AIR-PREV-008 and PR.AC-P2 Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures, Cabo Verde Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
AIR-PREV-012Role-Based Access Control for AI Data	PR.DS-P5Protections against data leaks are implemented.	124	105	112 in force, 8 not yet in force, 4 proposed
	The 124 laws behind AIR-PREV-012 and PR.DS-P5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Law on the Protection of Personal Data, Angola Law on the Protection of Personal Data, sensitive data categories, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas and 114 more, every one in the free file.
	PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans...	32	24	31 in force, 1 not yet in force
	The 32 laws behind AIR-PREV-012 and PR.PO-P7 Law No. 124/2024 On the Protection of Personal Data, Albania Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2019, Barbados OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union and 22 more, every one in the free file.
	PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	20	15	20 in force
	The 20 laws behind AIR-PREV-012 and PR.AC-P4 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures, Cabo Verde Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands and 10 more, every one in the free file.
	PR.PO-P10A vulnerability management plan is developed and implemented.	15	10	13 in force, 2 not yet in force
	The 15 laws behind AIR-PREV-012 and PR.PO-P10 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months and 5 more, every one in the free file.
	PR.DS-P2Data-in-transit are protected.	11	11	11 in force
	The 11 laws behind AIR-PREV-012 and PR.DS-P2 Ley General de Telecomunicaciones, Inviolabilidad y Secreto de las Comunicaciones y Protección de Datos Personales, Bolivia Electronic Communications and Postal Services Regulation Law, Article 99(1) to (4), Confidentiality of Communications and Business Recording, Cyprus Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Loi n° 2022-59, transfert transfrontalier des données, Niger Telecommunications Act 2005, confidentiality and protection of customer personal information, Samoa Electronic Communications Act, Section 117, Paragraphs 1 and 2, Telecommunications Secrecy, Slovakia and 1 more, every one in the free file.
	PR.DS-P1Data-at-rest are protected.	8	8	8 in force
	The 8 laws behind AIR-PREV-012 and PR.DS-P1 Law No. 124/2024 On the Protection of Personal Data, Albania Data Protection Act, 2019, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law 506/2004 on the Processing of Personal Data and the Protection of Privacy in Electronic Communications (Legea nr. 506/2004), Article 4, Paragraphs 1 to 4, Confidentiality of Communications, Romania Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda
	CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	7	7	7 in force
	The 7 laws behind AIR-PREV-012 and CT.PO-P1 Ley 1581 de 2012, General Personal Data Protection, Colombia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1), Mexico Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications, Nauru Telecommunications Act 2005, confidentiality and protection of customer personal information, Samoa Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe Telecommunications Act 2009, Confidentiality and Consent Duties, Solomon Islands
	ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate...	6	6	6 in force
	The 6 laws behind AIR-PREV-012 and ID.DE-P3 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini Data Protection Act, Ghana Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Lei n.º 03/2016, Protecção de Dados Pessoais, Sao Tome and Principe
	GV.PO-P2Processes to instill organizational privacy values within system/product/service...	6	6	5 in force, 1 proposed
	The 6 laws behind AIR-PREV-012 and GV.PO-P2 Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Draft Law on Personal Data Protection, final draft, Cambodia proposed Digital Code, Book I: Personal Data Protection and CNDP, Djibouti LOPDP, comprehensive personal-data protection regime, Ecuador Radio Equipment Directive, Network, Privacy and Fraud Protection Requirements for Internet-Connected Radio Equipment, European Union Loi n° 2022-59, protection des données à caractère personnel, Niger
	PR.PO-P8Response and recovery plans are tested.	6	5	6 in force
	The 6 laws behind AIR-PREV-012 and PR.PO-P8 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms, Ireland Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms, Luxembourg
	ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners,...	5	5	3 in force, 2 not yet in force
	The 5 laws behind AIR-PREV-012 and ID.DE-P2 Data Protection Act, 2013, Antigua and Barbuda Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Loi n° 2013-015, protection des données à caractère personnel, Mali Data Protection Act, 2018, Saint Kitts and Nevis from a date not yet set
	PR.AC-P1Identities and credentials are issued, managed, verified, revoked, and audited for...	5	5	5 in force
	The 5 laws behind AIR-PREV-012 and PR.AC-P1 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Product Security Requirements for Connectable Products, United Kingdom
	GV.AT-P1The workforce is informed and trained on its roles and responsibilities.	4	4	4 in force
	The 4 laws behind AIR-PREV-012 and GV.AT-P1 Law of the Republic of Belarus On Personal Data Protection, Belarus Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda Data Protection Act, Saint Lucia
	CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or...	4	4	3 in force, 1 proposed
	The 4 laws behind AIR-PREV-012 and CT.PO-P2 Ley 1581 de 2012, General Personal Data Protection, Colombia Protection of Children (Online Age Verification) Bill 2026, Ireland proposed Loi n° 2022-59, transfert transfrontalier des données, Niger Ley 81 de 2019, Sobre Protección de Datos Personales, Panama
	CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance...	4	4	4 in force
	The 4 laws behind AIR-PREV-012 and CT.DM-P8 Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Law No. 09-08, sensitive personal data and offense records, Morocco Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
	GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such...	3	3	3 in force
	The 3 laws behind AIR-PREV-012 and GV.PO-P1 Ley de Protección de Datos Personales, Equatorial Guinea Ley No. 787, Ley de Protección de Datos Personales, Nicaragua Data Protection Act, 2021, personal data processing framework, Zambia
	GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.	3	3	3 in force
	The 3 laws behind AIR-PREV-012 and GV.PO-P3 Law of the Republic of Belarus On Personal Data Protection, Belarus Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City
	GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.	3	3	3 in force
	The 3 laws behind AIR-PREV-012 and GV.PO-P5 Law on the Protection of Personal Data, sensitive data categories, Angola San Marino Law No. 171 on the Protection of Natural Persons, San Marino Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
	PR.PO-P3Backups of information are conducted, maintained, and tested.	3	3	3 in force
	The 3 laws behind AIR-PREV-012 and PR.PO-P3 Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act), Senegal
	PR.AC-P6Individuals and devices are proofed and bound to credentials, and authenticated...	3	2	3 in force
	The 3 laws behind AIR-PREV-012 and PR.AC-P6 Ley No. 172-13 sobre Protección Integral de los Datos Personales, Dominican Republic DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
	CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.	2	2	2 in force
	The 2 laws behind AIR-PREV-012 and CM.AW-P7 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union
	PR.AC-P2Physical access to data and devices is managed.	2	2	2 in force
	The 2 laws behind AIR-PREV-012 and PR.AC-P2 Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures, Cabo Verde Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
AIR-PREV-014Encryption of AI Data at Rest	PR.DS-P5Protections against data leaks are implemented.	124	105	112 in force, 8 not yet in force, 4 proposed
	The 124 laws behind AIR-PREV-014 and PR.DS-P5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Law on the Protection of Personal Data, Angola Law on the Protection of Personal Data, sensitive data categories, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas and 114 more, every one in the free file.
	PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans...	32	24	31 in force, 1 not yet in force
	The 32 laws behind AIR-PREV-014 and PR.PO-P7 Law No. 124/2024 On the Protection of Personal Data, Albania Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2019, Barbados OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union and 22 more, every one in the free file.
	PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	20	15	20 in force
	The 20 laws behind AIR-PREV-014 and PR.AC-P4 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures, Cabo Verde Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands and 10 more, every one in the free file.
	PR.PO-P10A vulnerability management plan is developed and implemented.	15	10	13 in force, 2 not yet in force
	The 15 laws behind AIR-PREV-014 and PR.PO-P10 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months and 5 more, every one in the free file.
	PR.DS-P2Data-in-transit are protected.	11	11	11 in force
	The 11 laws behind AIR-PREV-014 and PR.DS-P2 Ley General de Telecomunicaciones, Inviolabilidad y Secreto de las Comunicaciones y Protección de Datos Personales, Bolivia Electronic Communications and Postal Services Regulation Law, Article 99(1) to (4), Confidentiality of Communications and Business Recording, Cyprus Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Loi n° 2022-59, transfert transfrontalier des données, Niger Telecommunications Act 2005, confidentiality and protection of customer personal information, Samoa Electronic Communications Act, Section 117, Paragraphs 1 and 2, Telecommunications Secrecy, Slovakia and 1 more, every one in the free file.
	PR.DS-P1Data-at-rest are protected.	8	8	8 in force
	The 8 laws behind AIR-PREV-014 and PR.DS-P1 Law No. 124/2024 On the Protection of Personal Data, Albania Data Protection Act, 2019, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law 506/2004 on the Processing of Personal Data and the Protection of Privacy in Electronic Communications (Legea nr. 506/2004), Article 4, Paragraphs 1 to 4, Confidentiality of Communications, Romania Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda
	CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	7	7	7 in force
	The 7 laws behind AIR-PREV-014 and CT.PO-P1 Ley 1581 de 2012, General Personal Data Protection, Colombia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1), Mexico Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications, Nauru Telecommunications Act 2005, confidentiality and protection of customer personal information, Samoa Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe Telecommunications Act 2009, Confidentiality and Consent Duties, Solomon Islands
	ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate...	6	6	6 in force
	The 6 laws behind AIR-PREV-014 and ID.DE-P3 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini Data Protection Act, Ghana Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Lei n.º 03/2016, Protecção de Dados Pessoais, Sao Tome and Principe
	GV.PO-P2Processes to instill organizational privacy values within system/product/service...	6	6	5 in force, 1 proposed
	The 6 laws behind AIR-PREV-014 and GV.PO-P2 Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Draft Law on Personal Data Protection, final draft, Cambodia proposed Digital Code, Book I: Personal Data Protection and CNDP, Djibouti LOPDP, comprehensive personal-data protection regime, Ecuador Radio Equipment Directive, Network, Privacy and Fraud Protection Requirements for Internet-Connected Radio Equipment, European Union Loi n° 2022-59, protection des données à caractère personnel, Niger
	PR.PO-P8Response and recovery plans are tested.	6	5	6 in force
	The 6 laws behind AIR-PREV-014 and PR.PO-P8 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms, Ireland Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms, Luxembourg
	ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners,...	5	5	3 in force, 2 not yet in force
	The 5 laws behind AIR-PREV-014 and ID.DE-P2 Data Protection Act, 2013, Antigua and Barbuda Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Loi n° 2013-015, protection des données à caractère personnel, Mali Data Protection Act, 2018, Saint Kitts and Nevis from a date not yet set
	PR.AC-P1Identities and credentials are issued, managed, verified, revoked, and audited for...	5	5	5 in force
	The 5 laws behind AIR-PREV-014 and PR.AC-P1 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Product Security Requirements for Connectable Products, United Kingdom
	GV.AT-P1The workforce is informed and trained on its roles and responsibilities.	4	4	4 in force
	The 4 laws behind AIR-PREV-014 and GV.AT-P1 Law of the Republic of Belarus On Personal Data Protection, Belarus Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda Data Protection Act, Saint Lucia
	CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or...	4	4	3 in force, 1 proposed
	The 4 laws behind AIR-PREV-014 and CT.PO-P2 Ley 1581 de 2012, General Personal Data Protection, Colombia Protection of Children (Online Age Verification) Bill 2026, Ireland proposed Loi n° 2022-59, transfert transfrontalier des données, Niger Ley 81 de 2019, Sobre Protección de Datos Personales, Panama
	CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance...	4	4	4 in force
	The 4 laws behind AIR-PREV-014 and CT.DM-P8 Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Law No. 09-08, sensitive personal data and offense records, Morocco Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
	GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such...	3	3	3 in force
	The 3 laws behind AIR-PREV-014 and GV.PO-P1 Ley de Protección de Datos Personales, Equatorial Guinea Ley No. 787, Ley de Protección de Datos Personales, Nicaragua Data Protection Act, 2021, personal data processing framework, Zambia
	GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.	3	3	3 in force
	The 3 laws behind AIR-PREV-014 and GV.PO-P3 Law of the Republic of Belarus On Personal Data Protection, Belarus Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City
	GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.	3	3	3 in force
	The 3 laws behind AIR-PREV-014 and GV.PO-P5 Law on the Protection of Personal Data, sensitive data categories, Angola San Marino Law No. 171 on the Protection of Natural Persons, San Marino Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
	PR.PO-P3Backups of information are conducted, maintained, and tested.	3	3	3 in force
	The 3 laws behind AIR-PREV-014 and PR.PO-P3 Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act), Senegal
	PR.AC-P6Individuals and devices are proofed and bound to credentials, and authenticated...	3	2	3 in force
	The 3 laws behind AIR-PREV-014 and PR.AC-P6 Ley No. 172-13 sobre Protección Integral de los Datos Personales, Dominican Republic DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
	CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.	2	2	2 in force
	The 2 laws behind AIR-PREV-014 and CM.AW-P7 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union
	PR.AC-P2Physical access to data and devices is managed.	2	2	2 in force
	The 2 laws behind AIR-PREV-014 and PR.AC-P2 Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures, Cabo Verde Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
AIR-PREV-017AI Firewall Implementation and Management	PR.DS-P5Protections against data leaks are implemented.	124	105	112 in force, 8 not yet in force, 4 proposed
	The 124 laws behind AIR-PREV-017 and PR.DS-P5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Law on the Protection of Personal Data, Angola Law on the Protection of Personal Data, sensitive data categories, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas and 114 more, every one in the free file.
	PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans...	32	24	31 in force, 1 not yet in force
	The 32 laws behind AIR-PREV-017 and PR.PO-P7 Law No. 124/2024 On the Protection of Personal Data, Albania Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2019, Barbados OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union and 22 more, every one in the free file.
	PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	20	15	20 in force
	The 20 laws behind AIR-PREV-017 and PR.AC-P4 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures, Cabo Verde Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands and 10 more, every one in the free file.
	PR.PO-P10A vulnerability management plan is developed and implemented.	15	10	13 in force, 2 not yet in force
	The 15 laws behind AIR-PREV-017 and PR.PO-P10 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months and 5 more, every one in the free file.
	PR.DS-P2Data-in-transit are protected.	11	11	11 in force
	The 11 laws behind AIR-PREV-017 and PR.DS-P2 Ley General de Telecomunicaciones, Inviolabilidad y Secreto de las Comunicaciones y Protección de Datos Personales, Bolivia Electronic Communications and Postal Services Regulation Law, Article 99(1) to (4), Confidentiality of Communications and Business Recording, Cyprus Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Loi n° 2022-59, transfert transfrontalier des données, Niger Telecommunications Act 2005, confidentiality and protection of customer personal information, Samoa Electronic Communications Act, Section 117, Paragraphs 1 and 2, Telecommunications Secrecy, Slovakia and 1 more, every one in the free file.
	PR.DS-P1Data-at-rest are protected.	8	8	8 in force
	The 8 laws behind AIR-PREV-017 and PR.DS-P1 Law No. 124/2024 On the Protection of Personal Data, Albania Data Protection Act, 2019, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law 506/2004 on the Processing of Personal Data and the Protection of Privacy in Electronic Communications (Legea nr. 506/2004), Article 4, Paragraphs 1 to 4, Confidentiality of Communications, Romania Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda
	CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	7	7	7 in force
	The 7 laws behind AIR-PREV-017 and CT.PO-P1 Ley 1581 de 2012, General Personal Data Protection, Colombia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1), Mexico Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications, Nauru Telecommunications Act 2005, confidentiality and protection of customer personal information, Samoa Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe Telecommunications Act 2009, Confidentiality and Consent Duties, Solomon Islands
	ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate...	6	6	6 in force
	The 6 laws behind AIR-PREV-017 and ID.DE-P3 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini Data Protection Act, Ghana Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Lei n.º 03/2016, Protecção de Dados Pessoais, Sao Tome and Principe
	GV.PO-P2Processes to instill organizational privacy values within system/product/service...	6	6	5 in force, 1 proposed
	The 6 laws behind AIR-PREV-017 and GV.PO-P2 Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Draft Law on Personal Data Protection, final draft, Cambodia proposed Digital Code, Book I: Personal Data Protection and CNDP, Djibouti LOPDP, comprehensive personal-data protection regime, Ecuador Radio Equipment Directive, Network, Privacy and Fraud Protection Requirements for Internet-Connected Radio Equipment, European Union Loi n° 2022-59, protection des données à caractère personnel, Niger
	PR.PO-P8Response and recovery plans are tested.	6	5	6 in force
	The 6 laws behind AIR-PREV-017 and PR.PO-P8 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms, Ireland Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms, Luxembourg
	ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners,...	5	5	3 in force, 2 not yet in force
	The 5 laws behind AIR-PREV-017 and ID.DE-P2 Data Protection Act, 2013, Antigua and Barbuda Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Loi n° 2013-015, protection des données à caractère personnel, Mali Data Protection Act, 2018, Saint Kitts and Nevis from a date not yet set
	PR.AC-P1Identities and credentials are issued, managed, verified, revoked, and audited for...	5	5	5 in force
	The 5 laws behind AIR-PREV-017 and PR.AC-P1 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Product Security Requirements for Connectable Products, United Kingdom
	GV.AT-P1The workforce is informed and trained on its roles and responsibilities.	4	4	4 in force
	The 4 laws behind AIR-PREV-017 and GV.AT-P1 Law of the Republic of Belarus On Personal Data Protection, Belarus Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda Data Protection Act, Saint Lucia
	CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or...	4	4	3 in force, 1 proposed
	The 4 laws behind AIR-PREV-017 and CT.PO-P2 Ley 1581 de 2012, General Personal Data Protection, Colombia Protection of Children (Online Age Verification) Bill 2026, Ireland proposed Loi n° 2022-59, transfert transfrontalier des données, Niger Ley 81 de 2019, Sobre Protección de Datos Personales, Panama
	CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance...	4	4	4 in force
	The 4 laws behind AIR-PREV-017 and CT.DM-P8 Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Law No. 09-08, sensitive personal data and offense records, Morocco Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
	GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such...	3	3	3 in force
	The 3 laws behind AIR-PREV-017 and GV.PO-P1 Ley de Protección de Datos Personales, Equatorial Guinea Ley No. 787, Ley de Protección de Datos Personales, Nicaragua Data Protection Act, 2021, personal data processing framework, Zambia
	GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.	3	3	3 in force
	The 3 laws behind AIR-PREV-017 and GV.PO-P3 Law of the Republic of Belarus On Personal Data Protection, Belarus Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City
	GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.	3	3	3 in force
	The 3 laws behind AIR-PREV-017 and GV.PO-P5 Law on the Protection of Personal Data, sensitive data categories, Angola San Marino Law No. 171 on the Protection of Natural Persons, San Marino Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
	PR.PO-P3Backups of information are conducted, maintained, and tested.	3	3	3 in force
	The 3 laws behind AIR-PREV-017 and PR.PO-P3 Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act), Senegal
	PR.AC-P6Individuals and devices are proofed and bound to credentials, and authenticated...	3	2	3 in force
	The 3 laws behind AIR-PREV-017 and PR.AC-P6 Ley No. 172-13 sobre Protección Integral de los Datos Personales, Dominican Republic DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
	CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.	2	2	2 in force
	The 2 laws behind AIR-PREV-017 and CM.AW-P7 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union
	PR.AC-P2Physical access to data and devices is managed.	2	2	2 in force
	The 2 laws behind AIR-PREV-017 and PR.AC-P2 Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures, Cabo Verde Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
AIR-PREV-018Agent Authority Least Privilege Framework	CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	25	24	25 in force
	The 25 laws behind AIR-PREV-018 and CT.PO-P1 Criminal use of a computer, Alaska Penal Code, Attacks on Information Systems, Andorra StGB Sections 118a and 126a to 126c, Computer-Misuse Offenses, Austria Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybercriminalité), atteintes aux réseaux et systèmes d'information, Benin Loi n°025-2018/AN du 31 mai 2018 portant Code pénal, computer and data systems offenses (Livre VII, Titre I, Chapitre 1), Burkina Faso Código Penal, Violación de Datos Personales, Colombia Kazneni zakon, Computer Crime Chapter (Arts. 266-273), Croatia Computer Crime Proclamation, Ethiopia Cybercrime Directive, Articles 2(d) and 3 to 12 (offenses against information systems, penalties and jurisdiction), European Union Information and Communications Act, 2009, Computer Misuse and Cyber Crime part, Gambia and 15 more, every one in the free file.
	PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	2	2	2 in force
	The 2 laws behind AIR-PREV-018 and PR.AC-P4 Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
AIR-PREV-020MCP Server Security Governance	PR.DS-P5Protections against data leaks are implemented.	124	105	112 in force, 8 not yet in force, 4 proposed
	The 124 laws behind AIR-PREV-020 and PR.DS-P5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Law on the Protection of Personal Data, Angola Law on the Protection of Personal Data, sensitive data categories, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas and 114 more, every one in the free file.
	PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans...	32	24	31 in force, 1 not yet in force
	The 32 laws behind AIR-PREV-020 and PR.PO-P7 Law No. 124/2024 On the Protection of Personal Data, Albania Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2019, Barbados OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union and 22 more, every one in the free file.
	PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	20	15	20 in force
	The 20 laws behind AIR-PREV-020 and PR.AC-P4 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures, Cabo Verde Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands and 10 more, every one in the free file.
	PR.PO-P10A vulnerability management plan is developed and implemented.	15	10	13 in force, 2 not yet in force
	The 15 laws behind AIR-PREV-020 and PR.PO-P10 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months and 5 more, every one in the free file.
	PR.DS-P2Data-in-transit are protected.	11	11	11 in force
	The 11 laws behind AIR-PREV-020 and PR.DS-P2 Ley General de Telecomunicaciones, Inviolabilidad y Secreto de las Comunicaciones y Protección de Datos Personales, Bolivia Electronic Communications and Postal Services Regulation Law, Article 99(1) to (4), Confidentiality of Communications and Business Recording, Cyprus Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Loi n° 2022-59, transfert transfrontalier des données, Niger Telecommunications Act 2005, confidentiality and protection of customer personal information, Samoa Electronic Communications Act, Section 117, Paragraphs 1 and 2, Telecommunications Secrecy, Slovakia and 1 more, every one in the free file.
	PR.DS-P1Data-at-rest are protected.	8	8	8 in force
	The 8 laws behind AIR-PREV-020 and PR.DS-P1 Law No. 124/2024 On the Protection of Personal Data, Albania Data Protection Act, 2019, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law 506/2004 on the Processing of Personal Data and the Protection of Privacy in Electronic Communications (Legea nr. 506/2004), Article 4, Paragraphs 1 to 4, Confidentiality of Communications, Romania Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda
	CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	7	7	7 in force
	The 7 laws behind AIR-PREV-020 and CT.PO-P1 Ley 1581 de 2012, General Personal Data Protection, Colombia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1), Mexico Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications, Nauru Telecommunications Act 2005, confidentiality and protection of customer personal information, Samoa Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe Telecommunications Act 2009, Confidentiality and Consent Duties, Solomon Islands
	ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate...	6	6	6 in force
	The 6 laws behind AIR-PREV-020 and ID.DE-P3 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini Data Protection Act, Ghana Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Lei n.º 03/2016, Protecção de Dados Pessoais, Sao Tome and Principe
	GV.PO-P2Processes to instill organizational privacy values within system/product/service...	6	6	5 in force, 1 proposed
	The 6 laws behind AIR-PREV-020 and GV.PO-P2 Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Draft Law on Personal Data Protection, final draft, Cambodia proposed Digital Code, Book I: Personal Data Protection and CNDP, Djibouti LOPDP, comprehensive personal-data protection regime, Ecuador Radio Equipment Directive, Network, Privacy and Fraud Protection Requirements for Internet-Connected Radio Equipment, European Union Loi n° 2022-59, protection des données à caractère personnel, Niger
	PR.PO-P8Response and recovery plans are tested.	6	5	6 in force
	The 6 laws behind AIR-PREV-020 and PR.PO-P8 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms, Ireland Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms, Luxembourg
	ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners,...	5	5	3 in force, 2 not yet in force
	The 5 laws behind AIR-PREV-020 and ID.DE-P2 Data Protection Act, 2013, Antigua and Barbuda Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Loi n° 2013-015, protection des données à caractère personnel, Mali Data Protection Act, 2018, Saint Kitts and Nevis from a date not yet set
	PR.AC-P1Identities and credentials are issued, managed, verified, revoked, and audited for...	5	5	5 in force
	The 5 laws behind AIR-PREV-020 and PR.AC-P1 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Product Security Requirements for Connectable Products, United Kingdom
	GV.AT-P1The workforce is informed and trained on its roles and responsibilities.	4	4	4 in force
	The 4 laws behind AIR-PREV-020 and GV.AT-P1 Law of the Republic of Belarus On Personal Data Protection, Belarus Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda Data Protection Act, Saint Lucia
	CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or...	4	4	3 in force, 1 proposed
	The 4 laws behind AIR-PREV-020 and CT.PO-P2 Ley 1581 de 2012, General Personal Data Protection, Colombia Protection of Children (Online Age Verification) Bill 2026, Ireland proposed Loi n° 2022-59, transfert transfrontalier des données, Niger Ley 81 de 2019, Sobre Protección de Datos Personales, Panama
	CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance...	4	4	4 in force
	The 4 laws behind AIR-PREV-020 and CT.DM-P8 Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Law No. 09-08, sensitive personal data and offense records, Morocco Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
	GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such...	3	3	3 in force
	The 3 laws behind AIR-PREV-020 and GV.PO-P1 Ley de Protección de Datos Personales, Equatorial Guinea Ley No. 787, Ley de Protección de Datos Personales, Nicaragua Data Protection Act, 2021, personal data processing framework, Zambia
	GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.	3	3	3 in force
	The 3 laws behind AIR-PREV-020 and GV.PO-P3 Law of the Republic of Belarus On Personal Data Protection, Belarus Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City
	GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.	3	3	3 in force
	The 3 laws behind AIR-PREV-020 and GV.PO-P5 Law on the Protection of Personal Data, sensitive data categories, Angola San Marino Law No. 171 on the Protection of Natural Persons, San Marino Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
	PR.PO-P3Backups of information are conducted, maintained, and tested.	3	3	3 in force
	The 3 laws behind AIR-PREV-020 and PR.PO-P3 Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act), Senegal
	PR.AC-P6Individuals and devices are proofed and bound to credentials, and authenticated...	3	2	3 in force
	The 3 laws behind AIR-PREV-020 and PR.AC-P6 Ley No. 172-13 sobre Protección Integral de los Datos Personales, Dominican Republic DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
	CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.	2	2	2 in force
	The 2 laws behind AIR-PREV-020 and CM.AW-P7 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union
	PR.AC-P2Physical access to data and devices is managed.	2	2	2 in force
	The 2 laws behind AIR-PREV-020 and PR.AC-P2 Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures, Cabo Verde Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
AIR-PREV-023Agentic System Credential Protection Framework	CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	25	24	25 in force
	The 25 laws behind AIR-PREV-023 and CT.PO-P1 Criminal use of a computer, Alaska Penal Code, Attacks on Information Systems, Andorra StGB Sections 118a and 126a to 126c, Computer-Misuse Offenses, Austria Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybercriminalité), atteintes aux réseaux et systèmes d'information, Benin Loi n°025-2018/AN du 31 mai 2018 portant Code pénal, computer and data systems offenses (Livre VII, Titre I, Chapitre 1), Burkina Faso Código Penal, Violación de Datos Personales, Colombia Kazneni zakon, Computer Crime Chapter (Arts. 266-273), Croatia Computer Crime Proclamation, Ethiopia Cybercrime Directive, Articles 2(d) and 3 to 12 (offenses against information systems, penalties and jurisdiction), European Union Information and Communications Act, 2009, Computer Misuse and Cyber Crime part, Gambia and 15 more, every one in the free file.
	PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	2	2	2 in force
	The 2 laws behind AIR-PREV-023 and PR.AC-P4 Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
AIR-PREV-024Human-in-the-Loop Action Approval Gate	GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.	132	85	117 in force, 9 not yet in force, 6 proposed
	The 132 laws behind AIR-PREV-024 and GV.PO-P5 Law No. 124/2024 On the Protection of Personal Data, Albania Law No. 124/2024, Commissioner, remedies, liability and penalties, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Loi n° 18-07 relative à la protection des personnes physiques, contrôle, sanctions et voies de recours, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra LQPD, the Andorran Data Protection Agency, its powers, infractions and sanctions, Andorra Law on the Protection of Personal Data, enforcement and supervision, Angola Data Protection Act, 2013, information commissioner and enforcement, Antigua and Barbuda Ley 25.326, enforcement, sanctions, and the habeas data action, Argentina Ley 25.326, Ley de Protección de los Datos Personales, Argentina and 122 more, every one in the free file.
	GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such...	55	52	48 in force, 4 not yet in force, 3 proposed
	The 55 laws behind AIR-PREV-024 and GV.PO-P1 Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Ley 25.326, Ley de Protección de los Datos Personales, Argentina Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Personal Information Protection Act, comprehensive regime, British Columbia Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, Burkina Faso Law No. 133/V/2001 on the Protection of Personal Data, data quality principles and processor contracts, Cabo Verde Loi n° 24.001 portant protection des données à caractère personnel, Central African Republic Ley 1581 de 2012, General Personal Data Protection, Colombia Law on the Protection of Personal Data, Comoros and 45 more, every one in the free file.
	PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans...	50	36	47 in force, 2 not yet in force, 1 proposed
	The 50 laws behind AIR-PREV-024 and PR.PO-P7 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 40 more, every one in the free file.
	GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.	45	43	39 in force, 3 not yet in force, 3 proposed
	The 45 laws behind AIR-PREV-024 and GV.PO-P3 Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Law of the Republic of Belarus On Personal Data Protection, Belarus Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Personal Information Protection Act, comprehensive regime, British Columbia and 35 more, every one in the free file.
	ID.IM-P4Data actions of the systems/products/services are inventoried.	32	31	29 in force, 1 not yet in force, 2 proposed
	The 32 laws behind AIR-PREV-024 and ID.IM-P4 Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Draft Law on Personal Data Protection, final draft, Cambodia proposed Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun, Cameroon Law No. 2013-450 on the Protection of Personal Data, Côte d'Ivoire and 22 more, every one in the free file.
	CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	18	17	15 in force, 1 not yet in force, 2 proposed
	The 18 laws behind AIR-PREV-024 and CT.PO-P1 Personal Information Protection Act 2016, Commissioner, enforcement and offences, Bermuda Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Law No. 133/V/2001 on the Protection of Personal Data, data quality principles and processor contracts, Cabo Verde AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Einwilligungsverwaltungsverordnung (EinwV, Consent Management Services Ordinance), Recognized Consent-Management Services, Germany Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Law No. 06/L-082 on Protection of Personal Data, Kosovo Use of artificial intelligence in therapy or psychotherapy services, Maine Personal Data Protection Bill, pending before the People's Majlis, Maldives proposed and 8 more, every one in the free file.
	CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance...	16	11	11 in force, 5 not yet in force
	The 16 laws behind AIR-PREV-024 and CT.DM-P8 Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia e-Health Law Articles 26 to 27 and 32 to 35, Provider Records Banks, Access Logging and Confidentiality of Health Data, Cyprus from a date not yet set AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection), Lebanon and 6 more, every one in the free file.
	ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.	13	13	11 in force, 1 not yet in force, 1 proposed
	The 13 laws behind AIR-PREV-024 and ID.RA-P4 Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Draft Law on Personal Data Protection, final draft, Cambodia proposed Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Data Protection Act 2025, Kiribati Law No. 06/L-082 on Protection of Personal Data, Kosovo Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Law No. 195/2024 on Personal Data Protection, Moldova Loi sur la Protection des Données Personnelles, Monaco Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguay, Paraguay from 27 Nov 2027, in 13 months Law No. 29-2019 on the Protection of Personal Data, Republic of the Congo and 3 more, every one in the free file.
	GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements...	10	8	8 in force, 1 not yet in force, 1 proposed
	The 10 laws behind AIR-PREV-024 and GV.MT-P3 SIC Circular on AI, Demonstrated Accountability, Colombia SPDP Norma General guaranteeing personal-data protection in the use of AI systems, Ecuador General Data Protection Regulation, Principles Relating to Processing of Personal Data and Accountability (Article 5), European Union MiFID II, European Union Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands Nigeria Data Protection Act, 2023 (NDPA), general data protection duties, Nigeria Nigeria Data Protection Act, 2023, complaints, enforcement and redress, Nigeria Law on Personal Data Protection, Serbia Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed
	ID.IM-P1Systems/products/services that process data are inventoried.	8	6	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-024 and ID.IM-P1 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	GV.PO-P2Processes to instill organizational privacy values within system/product/service...	6	6	6 in force
	The 6 laws behind AIR-PREV-024 and GV.PO-P2 Law No. 124/2024 On the Protection of Personal Data, Albania LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Law No. 06/L-082 on Protection of Personal Data, Kosovo Law No. 195/2024 on Personal Data Protection, Moldova San Marino Law No. 171 on the Protection of Natural Persons, San Marino
	PR.DS-P5Protections against data leaks are implemented.	6	6	6 in force
	The 6 laws behind AIR-PREV-024 and PR.DS-P5 Law of the Republic of Belarus On Personal Data Protection, Belarus Ley No. 787, Ley de Protección de Datos Personales, Nicaragua San Marino Law No. 171 on the Protection of Natural Persons, San Marino Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City Data Protection Act, 2021, personal data processing framework, Zambia
	CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data...	5	5	5 in force
	The 5 laws behind AIR-PREV-024 and CM.AW-P1 Use of artificial intelligence in therapy or psychotherapy services, Maine FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Electronic Transactions Law, Protection of Personal Electronic Data, Mozambique Personal Health Information Protection Act, 2004, custodian and agent duties: consent, safeguards, information practices and marketing, Ontario Organic Act on the Protection of Personal Data, Tunisia
	CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or...	4	4	4 in force
	The 4 laws behind AIR-PREV-024 and CT.PO-P2 Ley 25.326, Ley de Protección de los Datos Personales, Argentina Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, Burkina Faso Personal Data Protection Proclamation, Ethiopia Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection), Lebanon
	CT.DM-P5Data are destroyed according to policy.	4	4	4 in force
	The 4 laws behind AIR-PREV-024 and CT.DM-P5 Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision, Cabo Verde Loi sur la Protection des Données Personnelles, Monaco DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York Ley 29733, Ley de Protección de Datos Personales, Peru
	ID.RA-P2Data analytic inputs and outputs are identified and evaluated for bias.	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-024 and ID.RA-P2 AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
	CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and...	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-024 and CT.DM-P10 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius
	CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations...	3	3	1 in force, 2 not yet in force
	The 3 laws behind AIR-PREV-024 and CM.AW-P5 Personal Data Protection Proclamation, enforcement, sanctions and offences, Ethiopia Data Protection Act, No. 1 of 2023, Information Commission, enforcement and offences, Grenada from a date not yet set Data Protection Act, 2018, Information Commissioner, enforcement and offences, Saint Kitts and Nevis from a date not yet set
	GV.AT-P1The workforce is informed and trained on its roles and responsibilities.	2	2	2 in force
	The 2 laws behind AIR-PREV-024 and GV.AT-P1 Law of the Republic of Belarus On Personal Data Protection, Belarus MiFID II, European Union
	PR.PO-P3Backups of information are conducted, maintained, and tested.	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-024 and PR.PO-P3 e-Health Law Articles 26 to 27 and 32 to 35, Provider Records Banks, Access Logging and Confidentiality of Health Data, Cyprus from a date not yet set Organic Act on the Protection of Personal Data, Tunisia
	PR.PO-P8Response and recovery plans are tested.	2	2	2 in force
	The 2 laws behind AIR-PREV-024 and PR.PO-P8 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning,...	2	2	1 in force, 1 proposed
	The 2 laws behind AIR-PREV-024 and PR.PO-P9 Lei n.º 03/2016, Protecção de Dados Pessoais, Sao Tome and Principe Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed
	PR.PO-P10A vulnerability management plan is developed and implemented.	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-024 and PR.PO-P10 Cyber Resilience Act, Obligations of Open-Source Software Stewards, European Union from 11 Dec 2027, in 14 months Lag (2024:1278), DORA Supplementary Provisions, Sweden
	PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	2	2	2 in force
	The 2 laws behind AIR-PREV-024 and PR.AC-P4 Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg
AIR-DET-001AI Data Leakage Prevention and Detection	PR.DS-P5Protections against data leaks are implemented.	124	105	112 in force, 8 not yet in force, 4 proposed
	The 124 laws behind AIR-DET-001 and PR.DS-P5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Law on the Protection of Personal Data, Angola Law on the Protection of Personal Data, sensitive data categories, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas and 114 more, every one in the free file.
	CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.	90	82	81 in force, 5 not yet in force, 4 proposed
	The 90 laws behind AIR-DET-001 and CM.AW-P7 Law No. 124/2024, notification of a personal data breach, Albania Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données, Algeria LQPD, personal data breach notification, Andorra Data Protection Act, 2019, personal data breach notification, Barbados Law of the Republic of Belarus On Personal Data Protection, notification of personal data protection violations, Belarus Data Protection Act 2021, personal data breach notification, Belize from a date not yet set Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, notification des ruptures de sécurité, Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notification, Bosnia and Herzegovina Data Protection Act, 2024, personal data breach notification, Botswana LGPD, security incident notification, Brazil and 80 more, every one in the free file.
	PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans...	61	46	59 in force, 1 not yet in force, 1 proposed
	The 61 laws behind AIR-DET-001 and PR.PO-P7 Law No. 124/2024 On the Protection of Personal Data, Albania Law No. 124/2024, notification of a personal data breach, Albania Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données, Algeria LQPD, personal data breach notification, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2019, Barbados Data Protection Act, 2019, personal data breach notification, Barbados Law on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notification, Bosnia and Herzegovina Electronic Communications Act Articles 261в to 261д, Personal Data Breach Notification by Providers of Public Electronic Communications Services, Bulgaria and 51 more, every one in the free file.
	PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	20	15	20 in force
	The 20 laws behind AIR-DET-001 and PR.AC-P4 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures, Cabo Verde Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands and 10 more, every one in the free file.
	PR.PO-P10A vulnerability management plan is developed and implemented.	15	10	13 in force, 2 not yet in force
	The 15 laws behind AIR-DET-001 and PR.PO-P10 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months and 5 more, every one in the free file.
	PR.DS-P2Data-in-transit are protected.	11	11	11 in force
	The 11 laws behind AIR-DET-001 and PR.DS-P2 Ley General de Telecomunicaciones, Inviolabilidad y Secreto de las Comunicaciones y Protección de Datos Personales, Bolivia Electronic Communications and Postal Services Regulation Law, Article 99(1) to (4), Confidentiality of Communications and Business Recording, Cyprus Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Loi n° 2022-59, transfert transfrontalier des données, Niger Telecommunications Act 2005, confidentiality and protection of customer personal information, Samoa Electronic Communications Act, Section 117, Paragraphs 1 and 2, Telecommunications Secrecy, Slovakia and 1 more, every one in the free file.
	PR.DS-P1Data-at-rest are protected.	8	8	8 in force
	The 8 laws behind AIR-DET-001 and PR.DS-P1 Law No. 124/2024 On the Protection of Personal Data, Albania Data Protection Act, 2019, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law 506/2004 on the Processing of Personal Data and the Protection of Privacy in Electronic Communications (Legea nr. 506/2004), Article 4, Paragraphs 1 to 4, Confidentiality of Communications, Romania Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda
	CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	7	7	7 in force
	The 7 laws behind AIR-DET-001 and CT.PO-P1 Ley 1581 de 2012, General Personal Data Protection, Colombia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1), Mexico Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications, Nauru Telecommunications Act 2005, confidentiality and protection of customer personal information, Samoa Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe Telecommunications Act 2009, Confidentiality and Consent Duties, Solomon Islands
	ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate...	6	6	6 in force
	The 6 laws behind AIR-DET-001 and ID.DE-P3 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini Data Protection Act, Ghana Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Lei n.º 03/2016, Protecção de Dados Pessoais, Sao Tome and Principe
	GV.PO-P2Processes to instill organizational privacy values within system/product/service...	6	6	5 in force, 1 proposed
	The 6 laws behind AIR-DET-001 and GV.PO-P2 Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Draft Law on Personal Data Protection, final draft, Cambodia proposed Digital Code, Book I: Personal Data Protection and CNDP, Djibouti LOPDP, comprehensive personal-data protection regime, Ecuador Radio Equipment Directive, Network, Privacy and Fraud Protection Requirements for Internet-Connected Radio Equipment, European Union Loi n° 2022-59, protection des données à caractère personnel, Niger
	PR.PO-P8Response and recovery plans are tested.	6	5	6 in force
	The 6 laws behind AIR-DET-001 and PR.PO-P8 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms, Ireland Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms, Luxembourg
	ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners,...	5	5	3 in force, 2 not yet in force
	The 5 laws behind AIR-DET-001 and ID.DE-P2 Data Protection Act, 2013, Antigua and Barbuda Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Loi n° 2013-015, protection des données à caractère personnel, Mali Data Protection Act, 2018, Saint Kitts and Nevis from a date not yet set
	PR.AC-P1Identities and credentials are issued, managed, verified, revoked, and audited for...	5	5	5 in force
	The 5 laws behind AIR-DET-001 and PR.AC-P1 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Product Security Requirements for Connectable Products, United Kingdom
	GV.AT-P1The workforce is informed and trained on its roles and responsibilities.	4	4	4 in force
	The 4 laws behind AIR-DET-001 and GV.AT-P1 Law of the Republic of Belarus On Personal Data Protection, Belarus Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda Data Protection Act, Saint Lucia
	CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or...	4	4	3 in force, 1 proposed
	The 4 laws behind AIR-DET-001 and CT.PO-P2 Ley 1581 de 2012, General Personal Data Protection, Colombia Protection of Children (Online Age Verification) Bill 2026, Ireland proposed Loi n° 2022-59, transfert transfrontalier des données, Niger Ley 81 de 2019, Sobre Protección de Datos Personales, Panama
	CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance...	4	4	4 in force
	The 4 laws behind AIR-DET-001 and CT.DM-P8 Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Law No. 09-08, sensitive personal data and offense records, Morocco Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
	GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such...	3	3	3 in force
	The 3 laws behind AIR-DET-001 and GV.PO-P1 Ley de Protección de Datos Personales, Equatorial Guinea Ley No. 787, Ley de Protección de Datos Personales, Nicaragua Data Protection Act, 2021, personal data processing framework, Zambia
	GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.	3	3	3 in force
	The 3 laws behind AIR-DET-001 and GV.PO-P3 Law of the Republic of Belarus On Personal Data Protection, Belarus Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City
	GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.	3	3	3 in force
	The 3 laws behind AIR-DET-001 and GV.PO-P5 Law on the Protection of Personal Data, sensitive data categories, Angola San Marino Law No. 171 on the Protection of Natural Persons, San Marino Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
	PR.PO-P3Backups of information are conducted, maintained, and tested.	3	3	3 in force
	The 3 laws behind AIR-DET-001 and PR.PO-P3 Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act), Senegal
	PR.AC-P6Individuals and devices are proofed and bound to credentials, and authenticated...	3	2	3 in force
	The 3 laws behind AIR-DET-001 and PR.AC-P6 Ley No. 172-13 sobre Protección Integral de los Datos Personales, Dominican Republic DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
	CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data...	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-DET-001 and CM.AW-P1 Act on the Protection of Personal Information, personal information of persons under 16, Japan from a date not yet set Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1), Mexico
	PR.AC-P2Physical access to data and devices is managed.	2	2	2 in force
	The 2 laws behind AIR-DET-001 and PR.AC-P2 Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures, Cabo Verde Lei n.º 03/2016, sensitive categories and suspect records, Sao Tome and Principe
AIR-DET-004AI System Observability	GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.	140	87	125 in force, 9 not yet in force, 6 proposed
	The 140 laws behind AIR-DET-004 and GV.PO-P5 Law No. 124/2024 On the Protection of Personal Data, Albania Law No. 124/2024, Commissioner, remedies, liability and penalties, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Loi n° 18-07 relative à la protection des personnes physiques, contrôle, sanctions et voies de recours, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra LQPD, the Andorran Data Protection Agency, its powers, infractions and sanctions, Andorra Law on the Protection of Personal Data, enforcement and supervision, Angola Data Protection Act, 2013, information commissioner and enforcement, Antigua and Barbuda Ley 25.326, enforcement, sanctions, and the habeas data action, Argentina Ley 25.326, Ley de Protección de los Datos Personales, Argentina and 130 more, every one in the free file.
	CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.	123	99	110 in force, 5 not yet in force, 8 proposed
	The 123 laws behind AIR-DET-004 and CM.AW-P7 Law No. 124/2024, notification of a personal data breach, Albania Law No. 25/2024, On Cybersecurity, Albania Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données, Algeria Llei 22/2022, Incident Handling and Notification Obligation, Andorra LQPD, personal data breach notification, Andorra Data Protection Act, 2019, personal data breach notification, Barbados Law of the Republic of Belarus On Personal Data Protection, notification of personal data protection violations, Belarus Data Protection Act 2021, personal data breach notification, Belize from a date not yet set Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, notification des ruptures de sécurité, Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notification, Bosnia and Herzegovina and 113 more, every one in the free file.
	PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans...	88	60	82 in force, 4 not yet in force, 2 proposed
	The 88 laws behind AIR-DET-004 and PR.PO-P7 Law No. 124/2024, notification of a personal data breach, Albania Law No. 25/2024, On Cybersecurity, Albania Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données, Algeria Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra LQPD, personal data breach notification, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Data Protection Act, 2019, personal data breach notification, Barbados Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium and 78 more, every one in the free file.
	GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such...	64	60	55 in force, 6 not yet in force, 3 proposed
	The 64 laws behind AIR-DET-004 and GV.PO-P1 Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Personal Information Protection Act, comprehensive regime, British Columbia Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, Burkina Faso Law No. 133/V/2001 on the Protection of Personal Data, data quality principles and processor contracts, Cabo Verde AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act), California from 1 Jan 2027, in 2 months California Consumer Privacy Act, as amended by the California Privacy Rights Act (Proposition 24), California and 54 more, every one in the free file.
	CT.DM-P5Data are destroyed according to policy.	56	50	51 in force, 4 not yet in force, 1 proposed
	The 56 laws behind AIR-DET-004 and CT.DM-P5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina HB2112, internet pornography, minors, age verification, Arizona Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas Act of 30 July 2018, Article 10/1, Recording of Electronic Communications in Lawful Commercial Transactions, Belgium Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Personal Information Protection Act, comprehensive regime, British Columbia Electronic Communications Act, Articles 246 and 247, Confidentiality of Communications and Recording, Bulgaria Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision, Cabo Verde and 46 more, every one in the free file.
	GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.	45	43	39 in force, 3 not yet in force, 3 proposed
	The 45 laws behind AIR-DET-004 and GV.PO-P3 Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Law of the Republic of Belarus On Personal Data Protection, Belarus Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Personal Information Protection Act, comprehensive regime, British Columbia and 35 more, every one in the free file.
	CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or...	40	35	34 in force, 5 not yet in force, 1 proposed
	The 40 laws behind AIR-DET-004 and CT.PO-P2 Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, Burkina Faso AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act), California from 1 Jan 2027, in 2 months Loi n° 24.001 portant protection des données à caractère personnel, Central African Republic Loi n°007/PR/2015, principes directeurs du traitement des données (consentement, licéité, finalité, conservation), Chad Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Personal Data Protection Proclamation, Ethiopia and 30 more, every one in the free file.
	ID.IM-P4Data actions of the systems/products/services are inventoried.	32	31	29 in force, 1 not yet in force, 2 proposed
	The 32 laws behind AIR-DET-004 and ID.IM-P4 Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Draft Law on Personal Data Protection, final draft, Cambodia proposed Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun, Cameroon Law No. 2013-450 on the Protection of Personal Data, Côte d'Ivoire and 22 more, every one in the free file.
	CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	20	19	17 in force, 1 not yet in force, 2 proposed
	The 20 laws behind AIR-DET-004 and CT.PO-P1 Ley 25.326, Ley de Protección de los Datos Personales, Argentina Personal Information Protection Act 2016, Commissioner, enforcement and offences, Bermuda Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Law No. 133/V/2001 on the Protection of Personal Data, data quality principles and processor contracts, Cabo Verde Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, article 74 (atteinte à la vie privée et traitement illicite des données à caractère personnel), Cameroon AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Einwilligungsverwaltungsverordnung (EinwV, Consent Management Services Ordinance), Recognized Consent-Management Services, Germany Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Law No. 06/L-082 on Protection of Personal Data, Kosovo and 10 more, every one in the free file.
	CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance...	20	15	15 in force, 5 not yet in force
	The 20 laws behind AIR-DET-004 and CT.DM-P8 Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia e-Health Law Articles 26 to 27 and 32 to 35, Provider Records Banks, Access Logging and Confidentiality of Health Data, Cyprus from a date not yet set AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Health Data Use Act (GDNG) Sections 1 and 6 to 9, Secondary Use and Protection of Health Data, Germany and 10 more, every one in the free file.
	ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.	13	13	11 in force, 1 not yet in force, 1 proposed
	The 13 laws behind AIR-DET-004 and ID.RA-P4 Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Draft Law on Personal Data Protection, final draft, Cambodia proposed Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Data Protection Act 2025, Kiribati Law No. 06/L-082 on Protection of Personal Data, Kosovo Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Law No. 195/2024 on Personal Data Protection, Moldova Loi sur la Protection des Données Personnelles, Monaco Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguay, Paraguay from 27 Nov 2027, in 13 months Law No. 29-2019 on the Protection of Personal Data, Republic of the Congo and 3 more, every one in the free file.
	CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data...	10	10	9 in force, 1 not yet in force
	The 10 laws behind AIR-DET-004 and CM.AW-P1 Act of 30 July 2018, Article 10/1, Recording of Electronic Communications in Lawful Commercial Transactions, Belgium Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Act on the Protection of Personal Information, personal information of persons under 16, Japan from a date not yet set Act of 30 May 2005, Article 4(1) to (3), Confidentiality of Communications and Recording in Professional Practice, Luxembourg Use of artificial intelligence in therapy or psychotherapy services, Maine FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Electronic Transactions Law, Protection of Personal Electronic Data, Mozambique Personal Health Information Protection Act, 2004, custodian and agent duties: consent, safeguards, information practices and marketing, Ontario Telecommunications Act 2009, Confidentiality and Consent Duties, Solomon Islands Organic Act on the Protection of Personal Data, Tunisia
	PR.DS-P5Protections against data leaks are implemented.	10	10	9 in force, 1 proposed
	The 10 laws behind AIR-DET-004 and PR.DS-P5 Law of the Republic of Belarus On Personal Data Protection, Belarus Protection of Children (Online Age Verification) Bill 2026, Ireland proposed Ley No. 787, Ley de Protección de Datos Personales, Nicaragua Ley 81 de 2019, Sobre Protección de Datos Personales, Panama Ley N° 6534/2020, de Protección de Datos Personales Crediticios, Paraguay San Marino Law No. 171 on the Protection of Natural Persons, San Marino Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria Data Protection Act, 2011, Trinidad and Tobago General Regulation on the Protection of Personal Data for Vatican City State, Vatican City Data Protection Act, 2021, personal data processing framework, Zambia
	GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements...	10	8	8 in force, 1 not yet in force, 1 proposed
	The 10 laws behind AIR-DET-004 and GV.MT-P3 SIC Circular on AI, Demonstrated Accountability, Colombia SPDP Norma General guaranteeing personal-data protection in the use of AI systems, Ecuador General Data Protection Regulation, Principles Relating to Processing of Personal Data and Accountability (Article 5), European Union MiFID II, European Union Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands Nigeria Data Protection Act, 2023 (NDPA), general data protection duties, Nigeria Nigeria Data Protection Act, 2023, complaints, enforcement and redress, Nigeria Law on Personal Data Protection, Serbia Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed
	ID.IM-P1Systems/products/services that process data are inventoried.	8	6	7 in force, 1 not yet in force
	The 8 laws behind AIR-DET-004 and ID.IM-P1 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	GV.PO-P2Processes to instill organizational privacy values within system/product/service...	6	6	6 in force
	The 6 laws behind AIR-DET-004 and GV.PO-P2 Law No. 124/2024 On the Protection of Personal Data, Albania LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Law No. 06/L-082 on Protection of Personal Data, Kosovo Law No. 195/2024 on Personal Data Protection, Moldova San Marino Law No. 171 on the Protection of Natural Persons, San Marino
	GV.MT-P4Policies, processes, and procedures for communicating progress on managing privacy...	5	5	5 in force
	The 5 laws behind AIR-DET-004 and GV.MT-P4 CCPA Cybersecurity Audit Regulations, California Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun, Cameroon Personal Data Protection Act 2025, competent authority, remedies, and complaints, Marshall Islands Nigeria Data Protection Act, 2023 (NDPA), general data protection duties, Nigeria Law No. 12 of 2024 on Protection of Electronic Personal Data, Authority, complaints and penalties, Syria
	CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations...	5	4	3 in force, 2 not yet in force
	The 5 laws behind AIR-DET-004 and CM.AW-P5 Ley 25.326, Ley de Protección de los Datos Personales, Argentina Personal Data Protection Proclamation, Ethiopia Personal Data Protection Proclamation, enforcement, sanctions and offences, Ethiopia Data Protection Act, No. 1 of 2023, Information Commission, enforcement and offences, Grenada from a date not yet set Data Protection Act, 2018, Information Commissioner, enforcement and offences, Saint Kitts and Nevis from a date not yet set
	PR.PO-P10A vulnerability management plan is developed and implemented.	4	3	3 in force, 1 not yet in force
	The 4 laws behind AIR-DET-004 and PR.PO-P10 Cybersecurity Law, Network Product and Service Security Duties, China Cyber Resilience Act, Obligations of Open-Source Software Stewards, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Impact Analysis Report and Disclosure, European Union Lag (2024:1278), DORA Supplementary Provisions, Sweden
	ID.RA-P2Data analytic inputs and outputs are identified and evaluated for bias.	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-004 and ID.RA-P2 AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
	CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and...	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-004 and CT.DM-P10 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius
	PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	3	3	3 in force
	The 3 laws behind AIR-DET-004 and PR.AC-P4 Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Health Data Use Act (GDNG) Sections 1 and 6 to 9, Secondary Use and Protection of Health Data, Germany Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg
	CT.DM-P1Data elements can be accessed for review.	3	2	3 in force
	The 3 laws behind AIR-DET-004 and CT.DM-P1 Ley 25.326, Ley de Protección de los Datos Personales, Argentina Crypto-Asset Service Providers, Records of Communication with Clients, European Union MiFID II, European Union
	ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate...	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-DET-004 and ID.DE-P3 AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act), California from 1 Jan 2027, in 2 months General Data Protection Regulation (GDPR), Comprehensive Regime, European Union
	GV.AT-P1The workforce is informed and trained on its roles and responsibilities.	2	2	2 in force
	The 2 laws behind AIR-DET-004 and GV.AT-P1 Law of the Republic of Belarus On Personal Data Protection, Belarus MiFID II, European Union
	CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing...	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-DET-004 and CT.PO-P3 Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Ley N° 7593/2025, la Agencia Nacional, faltas y sanciones, Paraguay from 27 Nov 2027, in 13 months
	CT.DP-P2Data are processed to limit the identification of individuals (e.g., de-identification...	2	2	2 in force
	The 2 laws behind AIR-DET-004 and CT.DP-P2 Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, Burkina Faso Health Data Use Act (GDNG) Sections 1 and 6 to 9, Secondary Use and Protection of Health Data, Germany
	PR.PO-P3Backups of information are conducted, maintained, and tested.	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-DET-004 and PR.PO-P3 e-Health Law Articles 26 to 27 and 32 to 35, Provider Records Banks, Access Logging and Confidentiality of Health Data, Cyprus from a date not yet set Organic Act on the Protection of Personal Data, Tunisia
	PR.PO-P8Response and recovery plans are tested.	2	2	2 in force
	The 2 laws behind AIR-DET-004 and PR.PO-P8 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning,...	2	2	1 in force, 1 proposed
	The 2 laws behind AIR-DET-004 and PR.PO-P9 Lei n.º 03/2016, Protecção de Dados Pessoais, Sao Tome and Principe Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed
	PR.DS-P3Systems/products/services and associated data are formally managed throughout removal,...	2	2	2 in force
	The 2 laws behind AIR-DET-004 and PR.DS-P3 Data Classification Policy, Kuwait Personal Health Information Protection Act, 2004, custodian and agent duties: consent, safeguards, information practices and marketing, Ontario
AIR-DET-011Human Feedback Loop for AI Systems	GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.	132	85	117 in force, 9 not yet in force, 6 proposed
	The 132 laws behind AIR-DET-011 and GV.PO-P5 Law No. 124/2024 On the Protection of Personal Data, Albania Law No. 124/2024, Commissioner, remedies, liability and penalties, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Loi n° 18-07 relative à la protection des personnes physiques, contrôle, sanctions et voies de recours, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra LQPD, the Andorran Data Protection Agency, its powers, infractions and sanctions, Andorra Law on the Protection of Personal Data, enforcement and supervision, Angola Data Protection Act, 2013, information commissioner and enforcement, Antigua and Barbuda Ley 25.326, enforcement, sanctions, and the habeas data action, Argentina Ley 25.326, Ley de Protección de los Datos Personales, Argentina and 122 more, every one in the free file.
	GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such...	55	52	48 in force, 4 not yet in force, 3 proposed
	The 55 laws behind AIR-DET-011 and GV.PO-P1 Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Ley 25.326, Ley de Protección de los Datos Personales, Argentina Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Personal Information Protection Act, comprehensive regime, British Columbia Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, Burkina Faso Law No. 133/V/2001 on the Protection of Personal Data, data quality principles and processor contracts, Cabo Verde Loi n° 24.001 portant protection des données à caractère personnel, Central African Republic Ley 1581 de 2012, General Personal Data Protection, Colombia Law on the Protection of Personal Data, Comoros and 45 more, every one in the free file.
	PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans...	50	36	47 in force, 2 not yet in force, 1 proposed
	The 50 laws behind AIR-DET-011 and PR.PO-P7 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 40 more, every one in the free file.
	GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.	45	43	39 in force, 3 not yet in force, 3 proposed
	The 45 laws behind AIR-DET-011 and GV.PO-P3 Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Law of the Republic of Belarus On Personal Data Protection, Belarus Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Personal Information Protection Act, comprehensive regime, British Columbia and 35 more, every one in the free file.
	ID.IM-P4Data actions of the systems/products/services are inventoried.	32	31	29 in force, 1 not yet in force, 2 proposed
	The 32 laws behind AIR-DET-011 and ID.IM-P4 Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Draft Law on Personal Data Protection, final draft, Cambodia proposed Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun, Cameroon Law No. 2013-450 on the Protection of Personal Data, Côte d'Ivoire and 22 more, every one in the free file.
	CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	18	17	15 in force, 1 not yet in force, 2 proposed
	The 18 laws behind AIR-DET-011 and CT.PO-P1 Personal Information Protection Act 2016, Commissioner, enforcement and offences, Bermuda Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Law No. 133/V/2001 on the Protection of Personal Data, data quality principles and processor contracts, Cabo Verde AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Einwilligungsverwaltungsverordnung (EinwV, Consent Management Services Ordinance), Recognized Consent-Management Services, Germany Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Law No. 06/L-082 on Protection of Personal Data, Kosovo Use of artificial intelligence in therapy or psychotherapy services, Maine Personal Data Protection Bill, pending before the People's Majlis, Maldives proposed and 8 more, every one in the free file.
	CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance...	16	11	11 in force, 5 not yet in force
	The 16 laws behind AIR-DET-011 and CT.DM-P8 Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia e-Health Law Articles 26 to 27 and 32 to 35, Provider Records Banks, Access Logging and Confidentiality of Health Data, Cyprus from a date not yet set AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection), Lebanon and 6 more, every one in the free file.
	ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.	13	13	11 in force, 1 not yet in force, 1 proposed
	The 13 laws behind AIR-DET-011 and ID.RA-P4 Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Draft Law on Personal Data Protection, final draft, Cambodia proposed Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Data Protection Act 2025, Kiribati Law No. 06/L-082 on Protection of Personal Data, Kosovo Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Law No. 195/2024 on Personal Data Protection, Moldova Loi sur la Protection des Données Personnelles, Monaco Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguay, Paraguay from 27 Nov 2027, in 13 months Law No. 29-2019 on the Protection of Personal Data, Republic of the Congo and 3 more, every one in the free file.
	GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements...	10	8	8 in force, 1 not yet in force, 1 proposed
	The 10 laws behind AIR-DET-011 and GV.MT-P3 SIC Circular on AI, Demonstrated Accountability, Colombia SPDP Norma General guaranteeing personal-data protection in the use of AI systems, Ecuador General Data Protection Regulation, Principles Relating to Processing of Personal Data and Accountability (Article 5), European Union MiFID II, European Union Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands Nigeria Data Protection Act, 2023 (NDPA), general data protection duties, Nigeria Nigeria Data Protection Act, 2023, complaints, enforcement and redress, Nigeria Law on Personal Data Protection, Serbia Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed
	ID.IM-P1Systems/products/services that process data are inventoried.	8	6	7 in force, 1 not yet in force
	The 8 laws behind AIR-DET-011 and ID.IM-P1 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	GV.PO-P2Processes to instill organizational privacy values within system/product/service...	6	6	6 in force
	The 6 laws behind AIR-DET-011 and GV.PO-P2 Law No. 124/2024 On the Protection of Personal Data, Albania LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Law No. 06/L-082 on Protection of Personal Data, Kosovo Law No. 195/2024 on Personal Data Protection, Moldova San Marino Law No. 171 on the Protection of Natural Persons, San Marino
	PR.DS-P5Protections against data leaks are implemented.	6	6	6 in force
	The 6 laws behind AIR-DET-011 and PR.DS-P5 Law of the Republic of Belarus On Personal Data Protection, Belarus Ley No. 787, Ley de Protección de Datos Personales, Nicaragua San Marino Law No. 171 on the Protection of Natural Persons, San Marino Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City Data Protection Act, 2021, personal data processing framework, Zambia
	CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data...	5	5	5 in force
	The 5 laws behind AIR-DET-011 and CM.AW-P1 Use of artificial intelligence in therapy or psychotherapy services, Maine FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Electronic Transactions Law, Protection of Personal Electronic Data, Mozambique Personal Health Information Protection Act, 2004, custodian and agent duties: consent, safeguards, information practices and marketing, Ontario Organic Act on the Protection of Personal Data, Tunisia
	CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or...	4	4	4 in force
	The 4 laws behind AIR-DET-011 and CT.PO-P2 Ley 25.326, Ley de Protección de los Datos Personales, Argentina Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, Burkina Faso Personal Data Protection Proclamation, Ethiopia Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection), Lebanon
	CT.DM-P5Data are destroyed according to policy.	4	4	4 in force
	The 4 laws behind AIR-DET-011 and CT.DM-P5 Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision, Cabo Verde Loi sur la Protection des Données Personnelles, Monaco DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York Ley 29733, Ley de Protección de Datos Personales, Peru
	ID.RA-P2Data analytic inputs and outputs are identified and evaluated for bias.	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-011 and ID.RA-P2 AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
	CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and...	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-011 and CT.DM-P10 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius
	CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations...	3	3	1 in force, 2 not yet in force
	The 3 laws behind AIR-DET-011 and CM.AW-P5 Personal Data Protection Proclamation, enforcement, sanctions and offences, Ethiopia Data Protection Act, No. 1 of 2023, Information Commission, enforcement and offences, Grenada from a date not yet set Data Protection Act, 2018, Information Commissioner, enforcement and offences, Saint Kitts and Nevis from a date not yet set
	GV.AT-P1The workforce is informed and trained on its roles and responsibilities.	2	2	2 in force
	The 2 laws behind AIR-DET-011 and GV.AT-P1 Law of the Republic of Belarus On Personal Data Protection, Belarus MiFID II, European Union
	PR.PO-P3Backups of information are conducted, maintained, and tested.	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-DET-011 and PR.PO-P3 e-Health Law Articles 26 to 27 and 32 to 35, Provider Records Banks, Access Logging and Confidentiality of Health Data, Cyprus from a date not yet set Organic Act on the Protection of Personal Data, Tunisia
	PR.PO-P8Response and recovery plans are tested.	2	2	2 in force
	The 2 laws behind AIR-DET-011 and PR.PO-P8 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning,...	2	2	1 in force, 1 proposed
	The 2 laws behind AIR-DET-011 and PR.PO-P9 Lei n.º 03/2016, Protecção de Dados Pessoais, Sao Tome and Principe Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed
	PR.PO-P10A vulnerability management plan is developed and implemented.	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-DET-011 and PR.PO-P10 Cyber Resilience Act, Obligations of Open-Source Software Stewards, European Union from 11 Dec 2027, in 14 months Lag (2024:1278), DORA Supplementary Provisions, Sweden
	PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	2	2	2 in force
	The 2 laws behind AIR-DET-011 and PR.AC-P4 Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg
AIR-DET-021Agent Decision Audit and Explainability	CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data...	209	130	191 in force, 14 not yet in force, 4 proposed
	The 209 laws behind AIR-DET-021 and CM.AW-P1 Law No. 124/2024, rights of the data subject, Albania LQPD, rights of the data subject, Andorra Law on the Protection of Personal Data, Angola Law on the Protection of Personal Data, rights of data subjects, Angola Law on the Protection of Personal Data, sensitive data categories, Angola Data Protection Act, 2013, notice and rights of data subjects, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Ley 25.326, rights of data subjects, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas Spam Act 2003, Unsolicited Commercial Electronic Messages, Australia and 199 more, every one in the free file.
	CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing...	158	125	136 in force, 17 not yet in force, 5 proposed
	The 158 laws behind AIR-DET-021 and CT.PO-P3 Law No. 124/2024, rights of the data subject, Albania Loi n° 18-07 relative à la protection des personnes physiques, droits de la personne concernée, Algeria LQPD, rights of the data subject, Andorra Law on the Protection of Personal Data, rights of data subjects, Angola Data Protection Act, 2013, notice and rights of data subjects, Antigua and Barbuda Ley 25.326, rights of data subjects, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas Data Protection Act, 2019, automated decisions, Barbados Data Protection Act, 2019, rights of a data subject, Barbados Law of the Republic of Belarus On Personal Data Protection, rights of the personal data subject, Belarus and 148 more, every one in the free file.
	GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.	140	87	125 in force, 9 not yet in force, 6 proposed
	The 140 laws behind AIR-DET-021 and GV.PO-P5 Law No. 124/2024 On the Protection of Personal Data, Albania Law No. 124/2024, Commissioner, remedies, liability and penalties, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Loi n° 18-07 relative à la protection des personnes physiques, contrôle, sanctions et voies de recours, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra LQPD, the Andorran Data Protection Agency, its powers, infractions and sanctions, Andorra Law on the Protection of Personal Data, enforcement and supervision, Angola Data Protection Act, 2013, information commissioner and enforcement, Antigua and Barbuda Ley 25.326, enforcement, sanctions, and the habeas data action, Argentina Ley 25.326, Ley de Protección de los Datos Personales, Argentina and 130 more, every one in the free file.
	CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.	84	72	73 in force, 4 not yet in force, 7 proposed
	The 84 laws behind AIR-DET-021 and CM.AW-P7 Law No. 124/2024, notification of a personal data breach, Albania Law No. 25/2024, On Cybersecurity, Albania Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données, Algeria Llei 22/2022, Incident Handling and Notification Obligation, Andorra LQPD, personal data breach notification, Andorra Data Protection Act, 2019, personal data breach notification, Barbados Law of the Republic of Belarus On Personal Data Protection, notification of personal data protection violations, Belarus Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, notification des ruptures de sécurité, Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notification, Bosnia and Herzegovina LGPD, security incident notification, Brazil and 74 more, every one in the free file.
	PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans...	77	56	72 in force, 4 not yet in force, 1 proposed
	The 77 laws behind AIR-DET-021 and PR.PO-P7 Law No. 124/2024, notification of a personal data breach, Albania Law No. 25/2024, On Cybersecurity, Albania Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données, Algeria Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra LQPD, personal data breach notification, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Data Protection Act, 2019, personal data breach notification, Barbados Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium and 67 more, every one in the free file.
	GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such...	65	61	56 in force, 6 not yet in force, 3 proposed
	The 65 laws behind AIR-DET-021 and GV.PO-P1 Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Personal Information Protection Act, comprehensive regime, British Columbia Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, Burkina Faso Law No. 133/V/2001 on the Protection of Personal Data, data quality principles and processor contracts, Cabo Verde AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act), California from 1 Jan 2027, in 2 months California Consumer Privacy Act, as amended by the California Privacy Rights Act (Proposition 24), California and 55 more, every one in the free file.
	CT.DM-P1Data elements can be accessed for review.	64	59	57 in force, 7 not yet in force
	The 64 laws behind AIR-DET-021 and CT.DM-P1 Loi n° 18-07 relative à la protection des personnes physiques, droits de la personne concernée, Algeria LQPD, rights of the data subject, Andorra Law on the Protection of Personal Data, rights of data subjects, Angola Data Protection Act, 2013, notice and rights of data subjects, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Ley 25.326, rights of data subjects, Argentina Data Protection Act, 2024, rights of data subjects, Botswana LGPD, rights of the data subject, Brazil Personal Information Protection Act, comprehensive regime, British Columbia Personal Data Protection Law, rights of the data subject, Burkina Faso and 54 more, every one in the free file.
	CT.DM-P5Data are destroyed according to policy.	58	52	53 in force, 4 not yet in force, 1 proposed
	The 58 laws behind AIR-DET-021 and CT.DM-P5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina HB2112, internet pornography, minors, age verification, Arizona Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas Act of 30 July 2018, Article 10/1, Recording of Electronic Communications in Lawful Commercial Transactions, Belgium Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Personal Information Protection Act, comprehensive regime, British Columbia Electronic Communications Act, Articles 246 and 247, Confidentiality of Communications and Recording, Bulgaria Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision, Cabo Verde and 48 more, every one in the free file.
	CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations...	49	45	46 in force, 3 not yet in force
	The 49 laws behind AIR-DET-021 and CM.AW-P5 Law No. 124/2024, rights of the data subject, Albania LQPD, rights of the data subject, Andorra Law on the Protection of Personal Data, rights of data subjects, Angola Ley 25.326, Ley de Protección de los Datos Personales, Argentina Ley 25.326, rights of data subjects, Argentina Data Protection Act, 2019, rights of a data subject, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, droits des personnes concernées, Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, rights of data subjects, Bosnia and Herzegovina Personal Information Protection Act, comprehensive regime, British Columbia Personal Data Protection Law, rights of the data subject, Burkina Faso and 39 more, every one in the free file.
	GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.	46	44	40 in force, 3 not yet in force, 3 proposed
	The 46 laws behind AIR-DET-021 and GV.PO-P3 Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Law of the Republic of Belarus On Personal Data Protection, Belarus Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Personal Information Protection Act, comprehensive regime, British Columbia and 36 more, every one in the free file.
	CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	45	37	41 in force, 1 not yet in force, 3 proposed
	The 45 laws behind AIR-DET-021 and CT.PO-P1 Law on the Protection of Personal Data, Angola Ley 25.326, Ley de Protección de los Datos Personales, Argentina Personal Information Protection Act 2016, Commissioner, enforcement and offences, Bermuda Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Personal Data Protection Law, rights of the data subject, Burkina Faso Law No. 133/V/2001 on the Protection of Personal Data, data quality principles and processor contracts, Cabo Verde Automatic Dialing-Announcing Devices Act, California Consumers Legal Remedies Act, Unsolicited Prerecorded Telephone Messages, California Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, article 74 (atteinte à la vie privée et traitement illicite des données à caractère personnel), Cameroon Canada's Anti-Spam Legislation, Canada and 35 more, every one in the free file.
	CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or...	42	36	36 in force, 5 not yet in force, 1 proposed
	The 42 laws behind AIR-DET-021 and CT.PO-P2 Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, Burkina Faso AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act), California from 1 Jan 2027, in 2 months Loi n° 24.001 portant protection des données à caractère personnel, Central African Republic Loi n°007/PR/2015, principes directeurs du traitement des données (consentement, licéité, finalité, conservation), Chad Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Personal Data Protection Proclamation, Ethiopia and 32 more, every one in the free file.
	ID.IM-P4Data actions of the systems/products/services are inventoried.	32	31	29 in force, 1 not yet in force, 2 proposed
	The 32 laws behind AIR-DET-021 and ID.IM-P4 Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, Bosnia and Herzegovina Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Draft Law on Personal Data Protection, final draft, Cambodia proposed Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun, Cameroon Law No. 2013-450 on the Protection of Personal Data, Côte d'Ivoire and 22 more, every one in the free file.
	CT.DM-P3Data elements can be accessed for alteration.	22	22	16 in force, 6 not yet in force
	The 22 laws behind AIR-DET-021 and CT.DM-P3 LQPD, rights of the data subject, Andorra Data Protection Act, 2013, notice and rights of data subjects, Antigua and Barbuda Personal Information Protection Act, comprehensive regime, British Columbia Digital Code, Title III, rights of the data subject, Democratic Republic of the Congo Law No. 151 of 2020 Promulgating the Personal Data Protection Law, Egypt Ley para la Protección de Datos Personales, rights of data subjects, El Salvador Personal Data Protection Proclamation, rights of data subjects, Ethiopia European Health Data Space Regulation, Rights of Natural Persons in the Primary Use of Electronic Health Data (Articles 3 to 10), European Union from 26 Mar 2029, in 2.4 years Personal Data Protection and Privacy Act, 2025, rights of the data subject, Gambia from a date not yet set Data Protection Act, No. 1 of 2023, rights of data subjects, Grenada from a date not yet set and 12 more, every one in the free file.
	CT.DM-P2Data elements can be accessed for transmission or disclosure.	21	19	17 in force, 3 not yet in force, 1 proposed
	The 21 laws behind AIR-DET-021 and CT.DM-P2 Law No. 124/2024, rights of the data subject, Albania LQPD, rights of the data subject, Andorra Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, droits des personnes concernées, Benin Law No. 2013-450 on the Protection of Personal Data, rights of the data subject, Côte d'Ivoire Digital Code, Title III, rights of the data subject, Democratic Republic of the Congo Ley para la Protección de Datos Personales, rights of data subjects, El Salvador Personal Data Protection Proclamation, rights of data subjects, Ethiopia Data Act, User Access to Connected-Product Data and Sharing with Third Parties (Articles 3 to 5), European Union European Health Data Space Regulation, Rights of Natural Persons in the Primary Use of Electronic Health Data (Articles 3 to 10), European Union from 26 Mar 2029, in 2.4 years Platform Work Directive, Transparency, Human Oversight and Human Review of Automated Systems (Articles 9 to 11), European Union from 2 Dec 2026, in 6 weeks and 11 more, every one in the free file.
	CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance...	20	15	15 in force, 5 not yet in force
	The 20 laws behind AIR-DET-021 and CT.DM-P8 Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia e-Health Law Articles 26 to 27 and 32 to 35, Provider Records Banks, Access Logging and Confidentiality of Health Data, Cyprus from a date not yet set AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Health Data Use Act (GDNG) Sections 1 and 6 to 9, Secondary Use and Protection of Health Data, Germany and 10 more, every one in the free file.
	CT.DM-P4Data elements can be accessed for deletion.	18	18	17 in force, 1 not yet in force
	The 18 laws behind AIR-DET-021 and CT.DM-P4 LQPD, rights of the data subject, Andorra Law of the Republic of Belarus On Personal Data Protection, rights of the personal data subject, Belarus Personal Data Protection Law, rights of the data subject, Burkina Faso Law No. 2013-450 on the Protection of Personal Data, rights of the data subject, Côte d'Ivoire Digital Code, Title III, rights of the data subject, Democratic Republic of the Congo Ley para la Protección de Datos Personales, rights of data subjects, El Salvador Personal Data Protection Proclamation, rights of data subjects, Ethiopia Personal Data Protection and Privacy Act, 2025, rights of the data subject, Gambia from a date not yet set Law No. 06/L-082 on Protection of Personal Data, rights of the data subject, Kosovo Loi sur la Protection des Données Personnelles, droits de la personne concernée, Monaco and 8 more, every one in the free file.
	ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.	13	13	11 in force, 1 not yet in force, 1 proposed
	The 13 laws behind AIR-DET-021 and ID.RA-P4 Data Protection Act, 2024 (Act No. 18 of 2024), Botswana Draft Law on Personal Data Protection, final draft, Cambodia proposed Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Data Protection Act 2025, Kiribati Law No. 06/L-082 on Protection of Personal Data, Kosovo Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Law No. 195/2024 on Personal Data Protection, Moldova Loi sur la Protection des Données Personnelles, Monaco Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguay, Paraguay from 27 Nov 2027, in 13 months Law No. 29-2019 on the Protection of Personal Data, Republic of the Congo and 3 more, every one in the free file.
	PR.DS-P5Protections against data leaks are implemented.	12	12	11 in force, 1 proposed
	The 12 laws behind AIR-DET-021 and PR.DS-P5 Law of the Republic of Belarus On Personal Data Protection, Belarus Loi n°007/PR/2015, principes directeurs du traitement des données (consentement, licéité, finalité, conservation), Chad Protection of Children (Online Age Verification) Bill 2026, Ireland proposed Ley No. 787, Ley de Protección de Datos Personales, Nicaragua Ley 81 de 2019, Sobre Protección de Datos Personales, Panama Ley N° 6534/2020, de Protección de Datos Personales Crediticios, Paraguay San Marino Law No. 171 on the Protection of Natural Persons, San Marino Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria Data Protection Act, 2011, Trinidad and Tobago General Regulation on the Protection of Personal Data for Vatican City State, Vatican City and 2 more, every one in the free file.
	GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements...	10	8	8 in force, 1 not yet in force, 1 proposed
	The 10 laws behind AIR-DET-021 and GV.MT-P3 SIC Circular on AI, Demonstrated Accountability, Colombia SPDP Norma General guaranteeing personal-data protection in the use of AI systems, Ecuador General Data Protection Regulation, Principles Relating to Processing of Personal Data and Accountability (Article 5), European Union MiFID II, European Union Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands Nigeria Data Protection Act, 2023 (NDPA), general data protection duties, Nigeria Nigeria Data Protection Act, 2023, complaints, enforcement and redress, Nigeria Law on Personal Data Protection, Serbia Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed
	GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to...	9	9	9 in force
	The 9 laws behind AIR-DET-021 and GV.MT-P7 Data Protection Act, 2013, notice and rights of data subjects, Antigua and Barbuda Personal Information Protection Act, comprehensive regime, British Columbia Data Protection Act, 2022, rights of data subjects, Eswatini Temporary Derogation for Detecting Online Child Sexual Abuse in Messaging Services, European Union Data Protection Act, 2011, rights of data subjects, Lesotho Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications, Nauru Nigeria Data Protection Act, 2023, rights of a data subject, Nigeria National Digital Identification Act 2024, registered persons' data-subject rights, Samoa Data Protection Act, 2011, Trinidad and Tobago
	ID.IM-P1Systems/products/services that process data are inventoried.	8	6	7 in force, 1 not yet in force
	The 8 laws behind AIR-DET-021 and ID.IM-P1 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	CM.AW-P4Records of data disclosures and sharing are maintained and can be accessed for review...	7	7	6 in force, 1 not yet in force
	The 7 laws behind AIR-DET-021 and CM.AW-P4 Law of the Republic of Belarus On Personal Data Protection, rights of the personal data subject, Belarus LGPD, rights of the data subject, Brazil Health Information Act 2026 Sections 7, 8 and 13 to 15, Duty to Share Health Data and Patient Access to Electronic Health Records, Ireland from a date not yet set Law No. 06/L-082 on Protection of Personal Data, rights of the data subject, Kosovo Ley 81 de 2019, Sobre Protección de Datos Personales, Panama National Digital Identification Act 2024, registered persons' data-subject rights, Samoa Data Protection Act, 2021, rights of the data subject, Zambia
	PR.PO-P10A vulnerability management plan is developed and implemented.	7	6	6 in force, 1 not yet in force
	The 7 laws behind AIR-DET-021 and PR.PO-P10 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cybersecurity Law, Network Product and Service Security Duties, China Digital Code, Livre IV: ICT Product and Service Vendor Security Certification, Democratic Republic of the Congo Cyber Resilience Act, Obligations of Open-Source Software Stewards, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Impact Analysis Report and Disclosure, European Union Lag (2024:1278), DORA Supplementary Provisions, Sweden
	GV.PO-P2Processes to instill organizational privacy values within system/product/service...	6	6	6 in force
	The 6 laws behind AIR-DET-021 and GV.PO-P2 Law No. 124/2024 On the Protection of Personal Data, Albania LQPD, Llei 29/2021 del 28 d'octubre, Andorra Data Protection Act, 2019, Barbados Law No. 06/L-082 on Protection of Personal Data, Kosovo Law No. 195/2024 on Personal Data Protection, Moldova San Marino Law No. 171 on the Protection of Natural Persons, San Marino
	CT.DM-P6Data are transmitted using standardized formats.	5	4	2 in force, 2 not yet in force, 1 proposed
	The 5 laws behind AIR-DET-021 and CT.DM-P6 Data Act, User Access to Connected-Product Data and Sharing with Third Parties (Articles 3 to 5), European Union European Health Data Space Regulation, Rights of Natural Persons in the Primary Use of Electronic Health Data (Articles 3 to 10), European Union from 26 Mar 2029, in 2.4 years Health Information Act 2026 Sections 7, 8 and 13 to 15, Duty to Share Health Data and Patient Access to Electronic Health Records, Ireland from a date not yet set Loi n° 2022-59, droits des personnes concernées, Niger Draft Law on the Protection of Privacy and Personal Data, rights of the data subject, Suriname proposed
	GV.MT-P4Policies, processes, and procedures for communicating progress on managing privacy...	4	4	4 in force
	The 4 laws behind AIR-DET-021 and GV.MT-P4 CCPA Cybersecurity Audit Regulations, California Personal Data Protection Act 2025, competent authority, remedies, and complaints, Marshall Islands Nigeria Data Protection Act, 2023 (NDPA), general data protection duties, Nigeria Law No. 12 of 2024 on Protection of Electronic Personal Data, Authority, complaints and penalties, Syria
	CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and...	4	4	2 in force, 2 not yet in force
	The 4 laws behind AIR-DET-021 and CT.DM-P10 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Consumer Credit Act (2026:1011), Chapter 2 Section 7 and Chapter 3 Section 15, Personalised Offers and Credit Assessment by Automated Processing, Sweden from 20 Nov 2026, in 4 weeks
	ID.RA-P2Data analytic inputs and outputs are identified and evaluated for bias.	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-021 and ID.RA-P2 AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
	ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate...	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-021 and ID.DE-P3 AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act), California from 1 Jan 2027, in 2 months Digital Code, Data Protection Authority and sanctions, Democratic Republic of the Congo General Data Protection Regulation (GDPR), Comprehensive Regime, European Union
	PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	3	3	3 in force
	The 3 laws behind AIR-DET-021 and PR.AC-P4 Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia Health Data Use Act (GDNG) Sections 1 and 6 to 9, Secondary Use and Protection of Health Data, Germany Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg
	GV.AT-P1The workforce is informed and trained on its roles and responsibilities.	2	2	2 in force
	The 2 laws behind AIR-DET-021 and GV.AT-P1 Law of the Republic of Belarus On Personal Data Protection, Belarus MiFID II, European Union
CT.DP-P2Data are processed to limit the identification of individuals (e.g., de-identification...	2	2	2 in force
The 2 laws behind AIR-DET-021 and CT.DP-P2 Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, Burkina Faso Health Data Use Act (GDNG) Sections 1 and 6 to 9, Secondary Use and Protection of Health Data, Germany
CM.AW-P6Data provenance and lineage are maintained and can be accessed for review or...	2	2	1 in force, 1 not yet in force
The 2 laws behind AIR-DET-021 and CM.AW-P6 European Health Data Space Regulation, Rights of Natural Persons in the Primary Use of Electronic Health Data (Articles 3 to 10), European Union from 26 Mar 2029, in 2.4 years Consumer Reporting Act, consumer reporting agencies and users of consumer reports, Ontario
PR.PO-P3Backups of information are conducted, maintained, and tested.	2	2	1 in force, 1 not yet in force
The 2 laws behind AIR-DET-021 and PR.PO-P3 e-Health Law Articles 26 to 27 and 32 to 35, Provider Records Banks, Access Logging and Confidentiality of Health Data, Cyprus from a date not yet set Organic Act on the Protection of Personal Data, Tunisia
PR.PO-P8Response and recovery plans are tested.	2	2	2 in force
The 2 laws behind AIR-DET-021 and PR.PO-P8 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning,...	2	2	1 in force, 1 proposed
The 2 laws behind AIR-DET-021 and PR.PO-P9 Lei n.º 03/2016, Protecção de Dados Pessoais, Sao Tome and Principe Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed
PR.DS-P3Systems/products/services and associated data are formally managed throughout removal,...	2	2	2 in force
The 2 laws behind AIR-DET-021 and PR.DS-P3 Data Classification Policy, Kuwait Personal Health Information Protection Act, 2004, custodian and agent duties: consent, safeguards, information practices and marketing, Ontario

Not connected to the NIST Privacy Framework: 10 of FINOS AIGF's controls

No NIST Privacy Framework control on the same duties

Laws reach these, but no duty that reaches one of them also reaches a NIST Privacy Framework control.

AIR-DET-013 Providing Citations and Source Traceability for AI-Generated Information, 33 laws

No law we track reaches these

No duty in the laws we track reaches these controls.

AIR-PREV-002 Data Filtering From External Knowledge Bases
AIR-PREV-003 User/App/Model Firewalling/Filtering
AIR-PREV-010 AI Model Version Pinning
AIR-PREV-019 Tool Chain Validation and Sanitization
AIR-PREV-022 Multi-Agent Isolation and Segmentation
AIR-PREV-025 Skill/Plugin Integrity and Governance
AIR-DET-009 AI System Alerting and Denial of Wallet (DoW) / Spend Monitoring
AIR-DET-015 Using Large Language Models for Automated Evaluation (LLM-as-a-Judge)
AIR-DET-016 Preserving Source Data Access Controls in AI Systems

Lines of the news aggregation laws we track were not read against the NIST Privacy Framework, so none of them connects the two here (how each subject's lines were read).

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches the FINOS AIGF through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

A line placed on a control in the framework for its own subject, whose law carries a kind of duty that reaches another of the three frameworks read line by line, is read against that one as well: every such line, or only those whose wording reaches into it. For these two:

Laws on	Read against the NIST Privacy Framework
AI	such lines on personal data and privacy, biometrics, likeness and identity, profiling, surveillance and consent
scraping	such lines on interception, monitoring, personal data and privacy
news aggregation	not read
cybersecurity	every such line

Every duty line in the AI, scraping, privacy, communications, age assurance and cybersecurity laws we track has been read against the framework for its subject.

The FINOS AI Governance Framework, mapped to the NIST Privacy Framework

No NIST Privacy Framework control on the same duties

No law we track reaches these

How these connections are drawn

Sources and licenses