Cal. Civ. Code s. 1798.100 onwards · Consumer privacy law · California, United States
The California Consumer Privacy Act is California's privacy law, operative since 1 January 2020 and amended by the California Privacy Rights Act from 1 January 2023. It applies to for-profit businesses doing business in California that cross a revenue, volume or data-sale threshold, wherever they are based, and is enforced by the California Privacy Protection Agency and the Attorney General.
In force · 1 Jan 2020ADMT rules apply · 1 Jan 2027
Regulation (EU) 2016/679 · Data protection law · European Union
The General Data Protection Regulation is the European Union's data protection law, applied since 25 May 2018. It binds organisations established in the EU and those outside it, including Indian companies, that offer goods or services to people in the EU or monitor their behaviour. Fines reach EUR 20 million or 4 percent of worldwide turnover, whichever is higher.
In force · applies since 25 May 2018
ISO/IEC 27001:2022 · Information security management system · Certifiable standard
ISO/IEC 27001:2022 is the international standard for an information security management system, or ISMS: the risk assessment, policies, controls, internal audit and management review an organisation runs to protect information. Published on 25 October 2022, it is certifiable, with a three-year certificate and annual surveillance audits, and its Annex A lists 93 reference controls in four themes.
Voluntary2013 edition · withdrawn 31 Oct 2025
ISO/IEC 27701:2025 · Privacy information management system · Certifiable standard
ISO/IEC 27701 is the international standard for a privacy information management system, or PIMS: the governance, controls and records an organisation runs to handle personally identifiable information as a controller or processor. The second edition, published in October 2025, is an independent management system standard that can be certified on its own and is built to align with ISO/IEC 27001.
Voluntary2019 edition · replaced Oct 2025
ISO/IEC 42001:2023 · AI management system · Certifiable standard
ISO/IEC 42001 is the international standard for an AI management system, or AIMS: the policies, roles, risk and impact assessments and controls an organisation runs to develop or use AI responsibly. Published in December 2023, it is certifiable like ISO 27001, with a three-year certificate and annual surveillance audits. Its Annex A lists 38 reference controls.
Voluntary
AICPA Trust Services Criteria · Attestation report · United States
SOC 2 is an attestation report, not a certificate. A CPA firm examines a service organisation's controls against the AICPA's Trust Services Criteria for security and, optionally, availability, processing integrity, confidentiality and privacy, and issues an opinion. A Type 1 report covers control design at a point in time; a Type 2 report covers operating effectiveness over a period.
Voluntary2027 criteria proposed · 26 Oct 2026