The Role of Compliance and Regulatory Requirements

Compliance in an information security context refers to an organisation’s obligation to meet the requirements set by laws, regulations, industry standards and contractual agreements. It is a necessary but insufficient condition for effective security. An organisation can be fully compliant with a regulation yet still have significant vulnerabilities; conversely, a strongly secure organisation will almost certainly exceed the minimum requirements of most compliance frameworks.

For mid-level managers, compliance is not an abstract concern. You are often directly responsible for ensuring that your team’s day-to-day behaviours and processes meet regulatory requirements. Understanding what those requirements are, why they exist and what the consequences of non-compliance can be is an important part of your management role.

The General Data Protection Regulation

The EU General Data Protection Regulation (GDPR), which came into force in May 2018, is one of the most significant and far-reaching data protection regulations in the world. Its reach extends well beyond the European Union: it applies to any organisation, anywhere in the world, that processes the personal data of individuals located in the EU. A business in Nigeria, a university in Australia or a software company in Canada that holds data about EU citizens may be subject to GDPR requirements. The GDPR is built around six key principles for the lawful processing of personal data:

• Lawfulness, fairness and transparency: personal data must be processed on a lawful basis, in a manner that is fair to the individuals concerned, and in a way that is transparent about how their data is being used.
• Purpose limitation: data must be collected for specified, explicit and legitimate purposes and not processed in ways that are incompatible with those purposes.
• Data minimisation: only data that is necessary for the stated purpose should be collected. Organisations should not collect data on the basis that it might be useful at some point in the future.
• Accuracy: personal data must be kept accurate and up to date. Inaccurate data must be corrected or deleted without delay.
• Storage limitation: data should not be kept for longer than is necessary for the purpose for which it was collected. Organisations must have clear retention policies and processes for secure deletion.
• Integrity and confidentiality: personal data must be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

Fines for serious breaches can reach four per cent of global annual revenue or twenty million euros, whichever is the higher amount. Significant fines have been issued to organisations across the world, including a record fine of over one billion euros issued to Meta in 2023 for unlawful data transfers between the EU and the United States. For managers, the GDPR creates direct and practical obligations. You must ensure that your team handles customer, employee or partner data in accordance with your organisation’s data protection policies. You must understand what personal data your team holds, why it holds it and how long it is retained. You must ensure that suspected data breaches are reported promptly through the appropriate channels: under the GDPR, organisations typically have 72 hours to notify their supervisory authority of a qualifying breach once it is discovered.

The Global Data Protection Landscape

The GDPR has been enormously influential globally. Its principles have informed data protection legislation in jurisdictions around the world, creating an increasingly complex but coherent international framework of personal data rights and organisational obligations.

• Singapore’s Personal Data Protection Act (PDPA): one of the most developed data protection frameworks in Asia, the PDPA governs how private sector organisations in Singapore collect, use and disclose personal data. It requires organisations to designate a Data Protection Officer, obtain consent for data collection, notify affected individuals and the regulator in the event of a breach, and implement reasonable security arrangements. The PDPA was comprehensively reviewed in 2020 and has been regularly updated since, with significant amendments in 2024 expanding the scope of the Cybersecurity Act to cover cloud infrastructure and supply chain risks.
• Brazil’s Lei Geral de Proteção de Dados (LGPD): Brazil’s general data protection law, which came into full effect in 2020, mirrors many GDPR principles including consent, purpose limitation, data subject rights and breach notification. It applies to any processing of personal data that takes place in Brazil or relates to Brazilian data subjects, regardless of where the processing organisation is based.
• India’s Digital Personal Data Protection Act (DPDPA): enacted in 2023, India’s data protection framework establishes rights for data subjects and obligations for organisations processing personal data in India. As one of the world’s most populous countries and one of the fastest-growing digital economies, India’s adoption of a comprehensive data protection framework has significant global implications.
• California Consumer Privacy Act (CCPA): in the United States, where there is no single federal data protection law, California’s CCPA and its successor the California Privacy Rights Act (CPRA) have established significant rights for California consumers and obligations for organisations that process their data. Several other US states have enacted or are developing similar legislation.

The global trend is unambiguous: data protection regulation is expanding, penalties are increasing and the expectation that organisations will demonstrate accountability for how they handle personal data is growing. Managers operating across international teams or working with global suppliers must be aware of the regulatory landscape in the countries where their organisation operates and where its customers are located.

Sector-Specific Compliance

Beyond general data protection legislation, many sectors are subject to specific regulatory requirements that carry additional information security obligations. Financial services organisations may be subject to requirements from regulators such as the Financial Conduct Authority in the UK, the Securities and Exchange Commission in the United States, the Monetary Authority of Singapore, or the Reserve Bank of India. Healthcare organisations face specific obligations around the protection of patient data. Critical infrastructure providers, including energy, water, telecommunications and transport organisations, face increasingly prescriptive cyber security requirements in many jurisdictions as governments recognise that the disruption of these sectors would have severe societal consequences.

Managers working in regulated sectors should understand the specific compliance obligations that apply to their organisation and their team, and should seek guidance from their compliance or legal function when they are uncertain about their obligations. Regulatory compliance is not something that can be delegated entirely to a specialist team; every manager who handles data or oversees systems that process it has a role to play.

Compliance as a Foundation, Not a Ceiling

A crucial insight for managers is that compliance sets a minimum standard, not an aspirational one. Regulations are necessarily general: they are designed to apply across many different organisations, sectors and contexts, and they cannot anticipate every threat or scenario. An organisation that treats compliance as the destination, rather than as the starting point for a genuine security programme, is likely to find itself exposed.

The most resilient organisations use compliance requirements as a baseline and build genuine security capability above that baseline. They ask not only whether they are meeting the minimum requirements of the law but whether those requirements are sufficient given their specific risk profile, the sensitivity of the data they hold and the threats they face. This is the difference between an organisation that has a data protection policy because the law requires one and an organisation that genuinely understands why data protection matters and has embedded that understanding into the way it operates every day.