TRIAS Resources

Regulations. Standards. Practical guidance.

Understand the requirements behind data protection. Explore guides to global privacy laws, sector requirements and control frameworks, with official sources and practical data security workflows.

21 in-depth guidesOfficial sourcesReviewed October 2026

The library

Regulations & standards

Choose a guide for scope, implementation steps and source references.

Privacy regulationEU / EEA

GDPR and Sensitive Data Discovery

Find personal data, distinguish special categories and turn discovery findings into proportionate security decisions.

Regulation (EU) 2016/679
Management system standardInternational

ISO 27001 Annex A.8.12: Data Leakage Prevention

Translate a risk-based leakage prevention objective into a control design, test plan and reviewable evidence.

ISO/IEC 27001:2022 and Amd 1:2024
Cybersecurity directiveEuropean Union

NIS2 and Sensitive Data Protection

Connect sensitive-data handling to cybersecurity risk management while checking sector and national requirements.

Directive (EU) 2022/2555
Privacy lawTürkiye

KVKK and Personal Data Classification

Connect personal-data classification to lawful handling, proportionate monitoring and documented incident decisions.

Law No. 6698, as amended
Cybersecurity frameworkInternational use

NIST CSF 2.0 and Data Security Controls

Use the six CSF Functions to connect data-security decisions to ownership, measurable outcomes and continuous improvement.

NIST CSF 2.0 / CSWP 29
Healthcare regulationUnited States

HIPAA and Electronic Health Information Security

Protect clinical information while separating technical alerts, patient-care needs and breach notification decisions.

HIPAA Privacy, Security and Breach Notification Rules
Financial reporting lawUnited States

SOX and Financial Reporting Data Controls

Focus data-security controls on risks to financial reporting rather than treating every financial document as the same control problem.

Sarbanes-Oxley Act / SEC ICFR requirements
Privacy lawCalifornia, United States

CCPA and Sensitive Personal Information

Connect discovery findings to California privacy rights, business purposes and the applicable 2026 compliance timetable.

CCPA, as amended by CPRA / 2026 regulations
Education privacy lawUnited States

FERPA and Education Records Protection

Review direct and indirect identifiers, authorised disclosures and the working copies created by schools and their service providers.

FERPA / 34 CFR Part 99
Securities rule frameworkUnited States

FINRA Records and Communications Security

Keep supervisory records and approved communications usable while reducing uncontrolled copies and customer-information exposure.

FINRA Rules 4511 and 3110 / related SEC rules
Financial privacy lawUnited States

GLBA and Customer Information Safeguards

Build a customer-information security workflow that reflects the institution, regulator and actual information flows.

GLBA / FTC Safeguards Rule, 16 CFR Part 314
Prudential banking frameworkInternational banking

Basel Operational Risk and Data Security

Place data-handling controls within banking operational risk rather than treating Basel III as a data-pattern checklist.

Basel Framework / BCBS operational risk principles
Investment services regulationEuropean Union

MiFID II Communications and Recordkeeping

Preserve relevant communications while controlling unauthorised sharing and keeping supervisory evidence retrievable.

MiFID II / MiFIR framework, as amended
Internal control frameworkInternational use

COSO and Data Security Internal Controls

Build a control narrative that explains the objective, responsible people, expected operation and evidence of improvement.

COSO Internal Control—Integrated Framework (2013)
Privacy lawCanada

PIPEDA and Personal Information Safeguards

Connect discovery to appropriate safeguards and assess the real risk of significant harm without assuming all Canadian activity has identical coverage.

PIPEDA / applicable provincial laws
Privacy lawJapan

APPI and Personal Information Handling in Japan

Review information categories, third-party handling and overseas transfers while separating enacted amendments from their commencement.

Act on the Protection of Personal Information
Privacy lawBrazil

LGPD and Personal Data Security in Brazil

Make discovery useful to data owners and prepare incident decisions around the ANPD's actual notification criteria.

LGPD / ANPD Resolution 15/2024
Privacy lawSingapore

Singapore PDPA and Data Protection Controls

Link reasonable security arrangements to actual information flows and a clearly owned breach assessment process.

Personal Data Protection Act 2012, as amended
Privacy lawUnited Kingdom

UK Data Protection and Information Security

Use the amended UK framework when reviewing personal-data handling, organisational responsibilities and privacy workflows.

UK GDPR / DPA 2018 / DUAA 2025 changes
Privacy lawSouth Africa

POPIA and Personal Information Security

Connect data ownership and proportionate safeguards to the Information Regulator's current security-compromise reporting process.

Protection of Personal Information Act 4 of 2013